Mine network security operation system

Abstract

The present application relates to the technical field of mine network security operation, and particularly discloses a mine network security operation system, which comprises a data acquisition and preprocessing module, a threat detection and intelligent analysis module, a defense strategy generation and response module, a quantum encryption and secure communication module and an event response and recovery module.The data acquisition and preprocessing module collects various types of equipment and sensor data of the mine network, and the collected data is processed by a self-encoder denoising and Gaussian mixture model to improve the data quality.The threat detection and intelligent analysis module adopts a DCNN and RL combined model to accurately monitor attack behavior.The defense strategy generation and response module generates and adjusts the defense strategy in real time according to the attack type and network state by means of a hybrid reinforcement learning and genetic algorithm.The quantum encryption and secure communication module uses QKD technology to encrypt and transmit data to ensure its security.The event response and recovery module quickly responds to security events and recovers the system through an adaptive algorithm.The present application effectively deals with the challenge of mine network security, comprehensively improves the security, ensures the continuity of mine production, and provides reliable protection for the operation of mine network security.

Description

Technical Field

[0001] This invention relates to the field of mine network security operation technology, specifically a mine network security operation system. Background Technology

[0002] In today's digital age, the information transformation of the mining industry is accelerating, and the role of mine networks in production and operation is becoming increasingly critical. Mine networks encompass numerous devices and systems, including but not limited to the interconnection of various sensors (for collecting environmental and equipment operation data such as temperature, pressure, and vibration), production equipment (such as mining machinery and transportation equipment), monitoring systems (for real-time monitoring of mine production areas and equipment status), and management information systems (for handling production planning, personnel scheduling, resource management, and other tasks). However, with the widespread application of network technology, mine network security faces severe challenges. On the one hand, network attack methods are becoming increasingly complex and diverse, and hackers may exploit system vulnerabilities. On the other hand, the complex mine network environment, with its diverse and widely distributed equipment, increases the difficulty of network management and security protection. Differences in operating systems and communication protocols among different types of equipment increase the complexity of unified deployment and management of security strategies; simultaneously, the harsh environment of the mine site (such as high temperature, high humidity, and strong electromagnetic interference) may also affect the normal operation of network equipment, reducing network stability and security, and consequently impacting the continuity and safety of mine production.

[0003] Existing network security solutions on the market have many limitations in addressing network security issues in mines. Traditional network security protection technologies mainly focus on perimeter protection, such as firewalls and intrusion detection systems, but their ability to detect and defend against internal attacks and new, complex attacks is insufficient. Firewalls can only filter network traffic based on preset rules and are unable to identify malicious traffic that has been disguised or transformed; while intrusion detection systems can detect known attack patterns, they are often powerless against unknown attacks. Furthermore, existing security solutions lack the ability to dynamically assess and adaptively adjust the overall security of mine networks. The mine network environment is complex and constantly changing; equipment status and network traffic can change at any time, and existing systems cannot adjust security policies in a timely manner according to these changes, resulting in significantly reduced protection effectiveness when facing dynamically changing security threats. At the same time, existing solutions are not adequately designed to ensure secure data transmission. In mine production, a large amount of sensitive data (such as geological data, production plans, and equipment operation data) needs to be transmitted over the network. Once this data is leaked, it can seriously impact the production operations and economic benefits of mining enterprises. Existing encryption technologies may have problems such as complex key management and easy cracking of encryption algorithms, which cannot meet the high requirements of mine networks for secure data transmission. Therefore, a mine network security operation system is proposed to address the above problems. Summary of the Invention

[0004] The purpose of this invention is to provide a mine network security operation system to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A mine network security operation system, comprising:

[0007] Data acquisition and preprocessing module: It connects to various devices and sensors in the mining network to acquire real-time data from the devices and sensors, and performs noise reduction and standardization processing on the acquired real-time data;

[0008] Threat Detection and Intelligent Analysis Module: It is connected to the data acquisition and preprocessing module. It adopts a model that combines deep convolutional neural network (DCNN) and reinforcement learning (RL) to monitor attack behavior in the mining network in real time based on preprocessed data and perform threat detection.

[0009] The defense strategy generation and response module, which is connected to the threat detection and intelligent analysis module, automatically generates defense strategies using a hybrid reinforcement learning and genetic algorithm, and adjusts them in real time based on the different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mining network.

[0010] Quantum encryption and secure communication module: It connects to the data transmission link in the mining network and uses quantum key distribution (QKD) technology to encrypt the data transmitted in the mining network, ensuring the security of data transmission;

[0011] Event Response and Recovery Module: It is connected to the Threat Detection and Intelligent Analysis Module and the Defense Strategy Generation and Response Module. After receiving security event information detected by the Threat Detection and Intelligent Analysis Module, it initiates an emergency response through an adaptive algorithm and quickly restores the system to ensure the continuity of mine production.

[0012] As a preferred approach, the data acquisition and preprocessing module employs an autoencoder and a Gaussian mixture model (GMM) to denoise, normalize, and standardize the data, including:

[0013] Autoencoder denoising: Let the input data be... An autoencoder is defined by an encoder function. and decoder function The encoder consists of input data. Mapping to a low-dimensional latent space representation The decoder then reconstructs the data from the latent space. Parameters are learned by minimizing the reconstruction error, which is measured by the mean squared error (MSE), as shown in the formula: ,in, For the number of data samples, and The first and second data are the original data and the reconstructed data, respectively. Each element; by optimizing the loss function and adjusting the parameters of the encoder and decoder, the reconstructed data is made more efficient. Close to the original data Remove noise components to obtain denoised data. ;

[0014] Gaussian Mixture Model (GMM) processing: For data denoised by an autoencoder Assuming it obeys the rules of The probability density function of the distribution formed by the mixture of Gaussian distributions is:

[0015] ,in, For the first The mixing coefficients of a Gaussian distribution satisfy the following conditions: , The mean is The covariance matrix is Gaussian probability density function

[0016] ,in, For the data dimension, the maximum likelihood estimation method is used to estimate the... and Parameters, for data Normalization and standardization processes are performed.

[0017] As a preferred option, the threat detection and intelligent analysis module includes:

[0018] Deep Convolutional Neural Network (DCNN) Feature Extraction: For preprocessed input data, let the convolution kernel be... , bias is The output of the convolutional layer It is obtained through convolution operation, and the formula is:

[0019] ,in, Represents the location of the convolutional layer The output at that location, These represent the number of rows and columns of the convolution kernel, respectively. To output the coordinates of the feature map, As the activation function, after passing through convolutional and pooling layers, the features are extracted and transformed into vector representations;

[0020] Reinforcement Learning (RL) Optimization: Suppose the agent at time t... The state is The action taken is set as The reward for environmental feedback is The state transition probability is Reinforcement learning is based on Markov Decision Processes (MDPs), and its goal is to maximize long-term cumulative rewards. ,in, As a discount factor, , Indicates the agent at time... The agent obtains rewards from the environment and uses policy functions to... To select actions, the value function Update according to the relevant update formula to dynamically optimize the detection strategy of the deep convolutional neural network (DCNN).

[0021] As a preferred approach, the operation of the defense strategy generation and response module includes:

[0022] Hybrid reinforcement learning evaluates defensive actions: Let the state space be... The action space is Hybrid reinforcement learning is based on Learning combined with policy gradient methods, in The learning section is arranged according to the corresponding Value update method update Value, in the policy gradient part, policy function parameters The goal of updating using the gradient ascent algorithm is to maximize the expected reward. Its gradient calculation formula is:

[0023] Based on the current state and attack type, defensive action options are evaluated;

[0024] Genetic algorithm optimizes defense strategy combinations: Defense action options are encoded to form individuals, and the population size is set to . ,individual The encoding is represented as Through fitness function The fitness of individuals is evaluated, and the fitness function is defined based on factors related to the effectiveness of defense strategies. The basic operations of the genetic algorithm, including selection, crossover, and mutation, are used for iterative evolution to generate the optimal combination of defense strategies.

[0025] Real-time adjustment and deployment: Adjust the generated defense strategy in real time according to the attack type and system status, and deploy it to the relevant security protection equipment in the mining network.

[0026] As a preferred solution, the quantum encryption and secure communication module ensures data transmission security by following these steps:

[0027] Quantum Key Distribution (QKD) Key Generation: Based on a quantum key distribution protocol, the sender prepares a sequence of qubits and sends it to the receiver. Both parties publicly compare partial information via a classical channel, and after error correction and privacy amplification steps, a quantum key is generated. Among them, error correction and privacy amplification operations are implemented based on the mathematical models and algorithm processes of the corresponding standards to ensure that the quantum key meets the security requirements;

[0028] Data Encryption and Decryption: Using Quantum Keys Let the data block to be encrypted be , which is the key for the symmetric encryption algorithm. The encrypted ciphertext is then encrypted using an encryption function. The corresponding quantum key is obtained at the receiving end. Decryption is performed; the decryption function is... .

[0029] As a preferred option, the adaptive algorithm for the event response and recovery module is a reinforcement learning algorithm. The reinforcement learning algorithm implements emergency response and system recovery according to the following process:

[0030] Input state determination: The input state of the reinforcement learning algorithm is determined based on the threat information received in real time. Threat information includes relevant quantitative characteristics of security incidents;

[0031] Reinforcement learning strategy adjustment: Let the action space of the emergency response strategy be... The agent is in a state Take action below Rewards for environmental feedback Based on the effects of actions taken on system recovery and reducing production downtime, and using a Markov Decision Process (MDP) based on the value function... and policy function Learn the optimal strategy according to the corresponding updated formula, and dynamically adjust the emergency response strategy;

[0032] Strategy Execution and System Recovery: Quickly execute the identified emergency response strategies to minimize mine production downtime and restore the mine network system to normal operation.

[0033] As can be seen from the technical solution provided by the present invention above, the beneficial effects of the mine network security operation system provided by the present invention are:

[0034] The data acquisition and preprocessing module of this invention is connected to various devices and sensors in the mine network to achieve real-time data acquisition. It uses an autoencoder and a Gaussian mixture model (GMM) to process the data. The autoencoder learns parameters by minimizing the mean square error (MSE) to measure the reconstruction error through encoder and decoder functions, effectively removing noise from the data and improving data accuracy. The Gaussian mixture model (GMM) assumes that the denoised data follows a multi-Gaussian distribution mixture. After estimating the parameters by maximum likelihood, the data is normalized and standardized, enabling unified comparison and analysis of data from different devices and scales, enhancing the ability to identify abnormal patterns, and laying a solid data foundation for subsequent safe operation.

[0035] The threat detection and intelligent analysis module adopts a combined architecture of deep convolutional neural network (DCNN) and reinforcement learning (RL). The convolutional and pooling operations of DCNN can automatically extract data features, the sliding calculation of convolutional kernels captures local features, and the downsampling of pooling layers preserves key features and improves computational efficiency and model invariance, enabling it to keenly detect abnormal patterns in network traffic and device operation data. The reinforcement learning (RL) is based on Markov decision process (MDP). The agent defines its state, takes actions, and receives rewards based on features extracted by DCNN and the real-time network state. By iteratively updating the value function and policy function, the threat detection strategy is dynamically optimized, effectively responding to new and complex attacks and improving detection accuracy and timeliness.

[0036] The defense strategy generation and response module generates defense strategies using a hybrid reinforcement learning and genetic algorithm; the hybrid reinforcement learning combines... - Learning and policy gradient methods to evaluate defensive actions -Learning Updates The value evaluation of long-term returns of actions is used to select the optimal action by updating the policy function parameters through policy gradient. The genetic algorithm encodes defense action options as individuals, and the fitness is evaluated by a fitness function that comprehensively considers factors such as attack prevention success rate, network performance impact, and recovery speed. Through selection, crossover, and mutation operations, it iterative evolution is carried out to search for the optimal policy combination. The defense strategy can be adjusted according to the real-time situation of the mining network to improve the overall defense capability and ensure network security.

[0037] The quantum encryption and secure communication module connects to the mine network data transmission link and uses quantum key distribution (QKD) technology to ensure data security. The sender prepares a sequence of qubits for transmission, and both parties compare information through a classical channel. The principle of quantum mechanics is used to detect eavesdropping and ensure the security of key K generation. The generated quantum key is used as the key for the symmetric encryption algorithm to ensure the confidentiality and integrity of transmitted data, prevent information leakage and security accidents, and effectively guarantee the safe and stable operation of mine production.

[0038] The incident response and recovery module works in conjunction with the threat detection and intelligent analysis module and the defense strategy generation and response module. It responds to security incidents through an adaptive algorithm (reinforcement learning algorithm). After receiving security incident information, it determines the input state based on quantitative characteristics such as incident type and severity. Based on the Markov decision process (MDP), it selects the optimal emergency response strategy through value function and policy function adjustment, and performs operations such as activating backup equipment and adjusting network topology. It also continuously monitors the system status, evaluates and optimizes the strategy based on the recovery status, reduces production interruption time, ensures mine production continuity, and reduces the impact of security incidents. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the overall structure of a mine network security operation system according to the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0041] To better understand the above technical solutions, the following will provide a detailed description of the technical solutions in conjunction with the accompanying drawings and specific embodiments.

[0042] like Figure 1 As shown in the figure, this embodiment of the invention provides a mine network security operation system, including a data acquisition and preprocessing module, a threat detection and intelligent analysis module, a defense strategy generation and response module, a quantum encryption and secure communication module, and an event response and recovery module.

[0043] In this embodiment, the data acquisition and preprocessing module is connected to various devices and sensors in the mine network to collect real-time data from the devices and sensors, and to perform noise reduction and standardization processing on the collected real-time data; the specific operation steps are as follows:

[0044] Step S1: Autoencoder denoising

[0045] Step S1-1: Data Mapping and Restoration

[0046] Let the real-time data collected from devices and sensors in the mining network be... The autoencoder is composed of encoder functions. and decoder function The process involves the encoder first processing the input data, mapping it to a low-dimensional latent space representation. ,Right now This process can be viewed as a feature extraction and compression of the original data, transforming high-dimensional data containing information such as the operating status of mining equipment. Convert to low-dimensional vector For example, multi-dimensional data such as temperature, pressure, and vibration collected by multiple sensors can be mapped to a low-dimensional space to highlight the key features of the data;

[0047] Next, the decoder from the latent space Restore the data and obtain The decoder attempts to determine the low-dimensional representation obtained from the encoder. Reconstructing the original data Restore data as similar as possible For example, based on information in low-dimensional vectors, estimated values ​​for parameters such as temperature, pressure, and vibration can be regenerated. This makes it numerically close to the original collected data. ;

[0048] Step S1-2: Reconstruction Error Calculation and Parameter Learning

[0049] The reconstruction error is calculated using the mean squared error (MSE) as the metric; the formula for mean squared error is... middle, The number of data samples collected. It is the raw data. The first in One element, It is the data restored by the decoder. The There are m elements; for example, if mining equipment data is collected at m time points, then n=m, and for each parameter (such as temperature, pressure, etc.) at each time point, its original value is calculated. With restoration value The square of the difference is then summed and averaged to obtain the reconstruction error. ;

[0050] The parameters of the autoencoder are learned by minimizing the reconstruction error; during the optimization process, the parameters of the encoder and decoder (such as weights and biases in the neural network) are continuously adjusted to optimize the reconstruction of the data. Gradually approaching the original data When the reconstruction error reaches its minimum or meets certain convergence conditions, the autoencoder is considered to have learned suitable parameters, and the denoised data obtained at this time... While removing noise, the system retains as much useful information as possible from the original data. For example, in a mining environment, data collected by sensors may be affected by noise such as electromagnetic interference. After denoising by the autoencoder, the data... It can more accurately reflect the actual operating status of mining equipment;

[0051] Step S2: Gaussian Mixture Model (GMM) Processing

[0052] Step S2-1: Assumption of Probability Density Function

[0053] For mining equipment data after noise reduction by an autoencoder Assume it follows a distribution consisting of a mixture of K Gaussian distributions, with the probability density function being...

[0054] ,in, For the first The mixing coefficients of a Gaussian distribution satisfy the following conditions: Taking temperature data from mining equipment as an example, it may be composed of multiple different "sub-distributions" (Gaussian distributions), each of which may correspond to different equipment operating states or environmental conditions. The data comes from the first The probability weights of each sub-distribution;

[0055] The mean is The covariance matrix is Gaussian probability density function

[0056] ,in, For the data dimension, the goal of maximum likelihood estimation is to find a set of parameter values ​​that make the observed data... The probability (likelihood function) is maximized for multi-parameter data of mining equipment (such as temperature, pressure, vibration, etc.). It refers to the number of parameters. It is the first The mean of a Gaussian distribution in each parameter dimension It describes the covariance relationship of the data across various parameter dimensions, reflecting the correlation and dispersion between different parameters;

[0057] Step S2-2: Parameter Estimation and Data Processing

[0058] The maximum likelihood estimation method is used to estimate the... and Parameters; the goal of maximum likelihood estimation is to find a set of parameter values ​​that make the observed data... The probability (likelihood function) is maximized; for equipment data in a mining network, based on existing denoised data... The most likely result is calculated using the mathematical algorithm of maximum likelihood estimation. and For example, based on historical operating data of mining equipment, the mean, covariance, and weight of each sub-distribution (Gaussian distribution) in the mixed distribution can be determined by maximum likelihood estimation.

[0059] Using the estimated parameters on the data Normalization and standardization are performed; normalization maps data to a specific range (e.g., ...). or Standardization imparts specific statistical characteristics to data (such as a mean of 0 and a standard deviation of 1). This makes mine network data more convenient and effective for subsequent analysis and processing. For example, mine equipment data from different sources and at different scales (such as temperature data in the range of tens of degrees Celsius and pressure data in the range of hundreds of megapascals) can be compared and analyzed on the same scale after normalization and standardization. This helps to more accurately identify abnormal patterns in the data, thereby detecting security threats such as network attacks or equipment failures, and providing a better data foundation for subsequent threat detection and intelligent analysis modules.

[0060] In this embodiment, the threat detection and intelligent analysis module is connected to the data acquisition and preprocessing module. It employs a model combining deep convolutional neural networks (DCNN) and reinforcement learning (RL) to monitor attack behaviors in the mining network in real time based on preprocessed data and perform threat detection. The specific operation steps are as follows:

[0061] Step S1: Feature extraction using a deep convolutional neural network (DCNN)

[0062] Step S1-1: Convolution operation

[0063] Let the preprocessed mine network data received from the data acquisition and preprocessing module be the input data; first, determine the convolution kernel. (its size is) , For the number of rows, (number of columns) and bias For each position in the input data The output of the convolutional layer The following convolution operation is used to obtain: ,in, This represents the element value at the corresponding position in the input data; activation function. Common functions such as ReLU (Rectified Linear Unit) can be chosen, which introduce nonlinear factors to enhance the model's expressive power; for example, when processing sequence data of sensor data collected from mining equipment (such as temperature, pressure, vibration, etc.), the convolution kernel... The convolution kernel slides across the data with a set stride. For each sliding position, the sum of the products of the kernel elements and the corresponding input data elements is calculated, plus the bias. Finally, through the activation function Obtain the output feature map elements in This process can extract local features from the data, such as detecting local change features like rising or falling temperature trends in a temperature data sequence.

[0064] Step S1-2: Pooling layer operations and feature transformation

[0065] After the convolutional layer operation, the pooling layer operation is performed next. The main function of the pooling layer is to downsample the feature map output by the convolutional layer to reduce the amount of data and retain the main features. Common pooling methods include max pooling and average pooling. For example, if max pooling is used, it will downsample the feature map in a small local region (such as...). or The maximum value within a region is selected as the representative value of that region. This can highlight the significant features in the data and has a certain degree of invariance to small translations and rotations of the data. In mining network data processing, for example, for feature maps of equipment operating parameters, pooling operations can reduce the impact of minor fluctuations caused by sensor measurement errors on subsequent analysis, while retaining key information in the data.

[0066] After a series of operations in the convolutional and pooling layers, the extracted features are transformed into vector representations. Specifically, the feature maps output by the pooling layer are arranged into a one-dimensional vector in a certain order (such as from left to right or from top to bottom). This vector can comprehensively reflect the key information in the mine network data. For example, it can combine features related to equipment temperature, pressure, vibration, etc., into a vector to provide a basis for subsequent analysis (such as comparison with normal operating mode) and decision-making (such as determining whether there is an attack).

[0067] Step S2: Reinforcement Learning (RL) Optimization

[0068] Step S2-1: Define State, Action, and Reward

[0069] Step S2-1-1: State Definition; Let the agent be at time t. status It is determined based on the feature vectors extracted by the deep convolutional neural network (DCNN) and some current state information of the mining network; specifically, the state It can include the following parts: First, feature vectors of equipment operating parameters extracted by DCNN, such as the comprehensive feature representation of equipment parameters such as temperature, pressure, and vibration after feature extraction; second, the current status information of the mining network, such as network traffic volume (including total traffic, traffic distribution of each device, etc.), device connection status (number of connected devices, connection duration, type of connected devices, etc.), and network data packet transmission delay, etc.; this information, when combined, comprehensively reflects the real-time status of the mining network. The state of the agent; for example, when the temperature characteristics of a critical piece of equipment in a mining network fluctuate abnormally, and network traffic suddenly increases while a new, unknown device attempts to connect, this information collectively constitutes the agent's state at that moment. ;

[0070] Step 2-1-2: Action definition; the agent in the state Multiple actions can be taken below. These actions primarily target cybersecurity operations in mining operations; for example, actions This can include blocking suspicious network connections (cutting off a connection when it is detected as potentially posing a security risk to prevent the potential attack from spreading further), isolating abnormal devices (isolating a device from the network if it is determined to be abnormal to prevent it from affecting other normal devices), adjusting network security policies (such as changing firewall rules, encryption methods, etc. to enhance the network's ability to defend against specific attacks), and issuing security alerts (notifying network administrators to pay attention to the current network status so that manual intervention can be carried out for further inspection and handling).

[0071] Step S2-1-3: Reward definition; Rewards for environmental feedback The reward is set based on the effectiveness of the agent's actions in detecting attacks and maintaining mine network security; if the agent's actions successfully prevent a potential attack (such as timely blocking the intrusion connection of malware), it will receive a high positive reward, for example... If an action helps improve network security (e.g., the network exhibits higher security in subsequent detections after adjusting security policies), it will also receive a positive reward, such as... Conversely, if the action leads to a misjudgment (such as mistakenly blocking the connection of normal equipment) or causes unnecessary interference to normal production (such as frequently issuing alarms but there is no real safety threat, affecting mine production operations), a negative reward will be given, such as -5 or -10.

[0072] Step S2-2: Optimization based on Markov Decision Process (MDP)

[0073] Step S2-2-1: Goal setting; Reinforcement learning based on Markov decision processes Its goal is to maximize long-term cumulative rewards. ,in, As a discount factor, , Indicates the agent at time... Rewards obtained from the environment; discount factor Used to weigh the importance of future rewards against current rewards; when When it is close to 1, such as This indicates that long-term rewards also significantly influence current decisions, suggesting that the agent prioritizes long-term interests and considers the ongoing impact of current actions on future cybersecurity. When approaching, such as Intelligent agents focus more on immediate rewards, and their decisions prioritize the immediate safety benefits of their actions. For example, in a mining network, an action that might cause short-term production disruptions (such as temporarily isolating some equipment for inspection) could significantly improve network security in the long run (avoiding potential large-scale attacks that could lead to prolonged shutdowns). When the size is large, the agent may be more inclined to take this action;

[0074] Step S2-2-2: Policy Function and Action Selection; the agent selects actions through the policy function. To select an action, the function represents the state. Take action below The probability; for example, when the mining network is in a state of high traffic and abnormal connection requests. At that time, the policy function The probability of blocking the connection is calculated to be 0.7, issuing an alarm is 0.2, and adjusting the security policy is 0.1. The agent randomly selects an action to execute based on these probabilities (other action selection strategies can also be used, such as selecting the action with the highest probability).

[0075] Step S2-2-3: Value function update and policy optimization; Value function Update according to the relevant update formula to dynamically optimize the detection strategy of the Deep Convolutional Neural Network (DCNN); Value Function Indicates the state of the agent. The long-term value of a time; for example, when it is found that taking a specific action in a certain state can bring high long-term cumulative rewards, such as in a specific network state. After taking action to isolate abnormal devices, subsequent network security significantly improves and long-term cumulative rewards increase. Therefore, this state will be updated through the value function update formula. Value estimation of isolated abnormal device actions, and then adjustment of policy function. This increases the probability of selecting to isolate abnormal devices in this state, thereby optimizing the overall threat detection and response strategy. During the continuous operation of the mining network, the agent continuously adjusts the value function and policy function based on new data and environmental feedback (rewards), gradually improving the detection accuracy and response effectiveness of various attack behaviors, and ensuring the safe and stable operation of the mining network.

[0076] In this embodiment, the defense strategy generation and response module is connected to the threat detection and intelligent analysis module. It automatically generates defense strategies using a hybrid reinforcement learning and genetic algorithm, and adjusts them in real time based on different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mining network. The specific operation steps are as follows:

[0077] Step S1: Hybrid reinforcement learning to evaluate defensive actions

[0078] Step S1-1: Definition of State Space and Action Space

[0079] Step S1-1-1: State space construction; State space It encompasses a wide range of information. First, it includes attack-related information identified by the threat detection and intelligent analysis module. For example, when a network attack is detected, it identifies the attack type, such as DDoS (Distributed Denial of Service) attack, QL injection attack, or malware propagation. It also determines the severity of the attack, classifying it as minor, moderate, or severe based on factors such as attack traffic volume, attack duration, and potential impact range. In addition, it includes detailed information about the affected devices or network areas, such as device name, IP address range, and location in the network topology.

[0080] The network's real-time state information is also an important component of the state space; this includes the current network traffic volume, traffic distribution (such as the traffic ratio between different regions and devices), device load status (such as CPU utilization, memory usage, etc.), currently deployed defense strategies and their effectiveness evaluation (such as the filtering effect of enabled firewall rules on network traffic, false positive rate and false negative rate of intrusion detection system, etc.); this information, taken together, comprehensively describes the actual state of the mining network when it is under attack. For example, at a certain moment, the state This may indicate that a moderate DDoS attack has been detected, with the attack source IP address range being [192.168.1.10 - 192.168.1.20], the target being the server area, the total network traffic reaching a peak, the server device CPU utilization exceeding 80%, and the current firewall rules partially blocking the attack traffic but still allowing some to penetrate;

[0081] Step S1-1-2: Determine the motion space; Motion space It includes various defensive actions that the defense strategy generation and response module can take; for example, initiating firewall rule updates, dynamically adjusting the firewall's access control list based on attack type and network status, allowing or blocking access from specific IP addresses or ports; isolating infected devices, isolating devices detected as infected with malware or under attack from the network to prevent the spread of attacks; adjusting network access permissions, setting different access levels for different users or device groups, and restricting access for suspicious devices or users; increasing network monitoring frequency, strengthening the monitoring of network traffic, device status, etc., to detect anomalies in a timely manner; activating specific detection modes of the intrusion detection system, such as feature detection modes for a new type of attack or improving detection sensitivity, etc.; each action All of these are designed to address specific attack scenarios or improve the security posture of networks;

[0082] Step S1-2: Policy evaluation and update based on hybrid reinforcement learning

[0083] Step S1-2-1: -Learning component; Hybrid reinforcement learning combines... -Learning and policy gradient methods; in In the learning part, for each state-action pair Each has a corresponding value It indicates the state. Take action below The expected long-term return; initially, The value can be initialized randomly or set based on experience; when an attack event occurs in the mining network, such as detecting a QL injection attack (status) Take action to activate a specific detection mode of the intrusion detection system (action) Then observe the network's response and the final result; if the attack is successfully blocked and the network returns to normal operation, a pre-set reward mechanism will be implemented (e.g., a reward for successfully blocking the attack will be given). (The reward), combined with the next state The maximum of all actions Value (assuming it is) ,according to Value update formula

[0084] (in, For learning rate, Updated for discount factor Value; as more attacks occur and are dealt with, this process is repeated continuously, making... The value gradually converges to the optimal value, thus enabling a more accurate evaluation of the merits and demerits of different actions in each state;

[0085] Step S1-2-2: Policy gradient part; In the policy gradient part, the policy function... parameters The goal of updating using the gradient ascent algorithm is to maximize the expected reward. Its gradient calculation formula is: During the operation of the mining network, based on the current status and policy function Choose an action Execution; for example, when the network is under DDoS attack and some devices are overloaded. At that time, according to the current policy function It is possible to choose to isolate some of the affected equipment (action) The probability is 0.6, so we choose to increase the network monitoring frequency (action). The probability is 0.4; the action is executed. Then, based on changes in network status and the rewards obtained (such as a +8 reward for successfully alleviating device load and partially blocking attack traffic), the gradient is calculated. And update the parameters according to the gradient ascent algorithm. By continuously iterating and updating parameters Strategy function It can gradually adapt to the attack scenarios of mining networks and select the best defensive actions under different conditions. To maximize long-term cumulative rewards;

[0086] Step S1-2-3: Evaluation of defensive action options; based on the current state and attack types, utilizing the updated Values ​​and policy functions evaluate defensive action options; for example, when malware is detected spreading on the network (state...). At that time, according to the current Value and policy functions Calculate each action The expected return; assuming that, after calculation, isolating infected equipment (action) The expected return is the highest, then It is assessed as the current state The preferred defensive action option is one that can minimize the impact on normal network operation and improve network security while dealing with malware propagation attacks.

[0087] Step S2: Genetic algorithm optimizes the combination of defense strategies

[0088] Step S2-1: Encoding and Individual Generation

[0089] Step 2-1-1: Encoding Defensive Actions; Encode the defensive action options evaluated by hybrid reinforcement learning to form individuals; Use an appropriate encoding method, such as binary encoding; Map each possible defensive action to a binary bit, and combine multiple defensive actions into a binary string as an individual; For example, suppose there are 5 defensive actions, namely... (Start firewall rule updates) (Isolate infected equipment) (Adjust network access permissions) (Increase network monitoring frequency) (Activating a specific detection mode of the intrusion detection system) can be defined as "1" indicating that the action is performed, and "0" indicating that it is not performed; an individual might be represented as "10110", indicating that the action is performed. Do not perform the action and ;

[0090] Step S2-1-2: Population initialization; Let the population size be... 1 (e.g.) By randomly generating multiple such binary string individuals An initial population is constructed; each individual represents a possible combination of defense strategies, and these individuals will serve as initial candidate solutions for optimization by the genetic algorithm; for example, the generated initial population may contain individuals such as "01001", "11010", and "00111", each representing a different combination of defense strategies, covering different choices of defense actions;

[0091] Step S2-2: Fitness Assessment

[0092] Step S2-2-1: Fitness function design; through the fitness function The fitness of each individual is assessed; the fitness function is defined based on multiple factors related to the effectiveness of the defense strategy; for example, the success rate of the defense strategy in preventing attacks. It is a key factor, which can be obtained through simulated attack tests or statistical analysis of actual attack data; if a combination of defense strategies can successfully block most attacks, its blocking success rate is high, and it will receive a high weight in the fitness function.

[0093] The extent to which network operation is affected is also an important factor; including the increase in network latency. This can be measured by monitoring changes in network packet transmission time before and after implementing defense strategies; device resource usage. For example, the percentage of extra resources used, such as CPU and memory; and the speed at which the network returns to normal. This refers to the time required for the network to return to normal operation after an attack; the fitness function can be a weighted combination of these factors, such as:

[0094] ;

[0095] in, The weights of the corresponding factors are set according to the degree of importance the mining network places on different performance indicators; for example, for mining production control networks with high real-time requirements, The network latency-related weight may be set relatively high to prevent the defense strategy from causing excessive network latency that could affect the normal control of production equipment.

[0096] Step S2-2-2: Fitness calculation and evaluation; for each individual in the population Calculate its fitness value based on the fitness function described above. A higher fitness value indicates a better defense strategy combination for that individual; for example, the defense strategy combination corresponding to individual "10101" successfully blocked 80% of attacks in actual testing. This resulted in a 10-millisecond increase in network latency. Equipment resource utilization rate increased It will take 5 minutes to restore the network to normal. Assuming weights Then its fitness value

[0097] By calculating the fitness value of each individual, we can quantitatively evaluate all combinations of defense strategies in the population, providing a basis for subsequent genetic operations.

[0098] Step S2-3: Genetic Operations and Iterative Evolution

[0099] Step S2-3-1: Selection operation; The selection operation is used to select superior individuals from the current population to enter the next generation; a selection method such as roulette wheel selection is used, determining the probability of selection based on the individual's fitness value; individuals with higher fitness values ​​have a greater probability of being selected, thus preserving their superior genes (i.e., defense strategy combinations); for example, calculating the selection probability of each individual in the population. Assuming there are three individuals in the population Their fitness values ​​are respectively Their selection probabilities are respectively

[0100] Through roulette wheel selection, individuals are randomly selected to enter the next generation of the population based on these probabilities; those with high fitness are selected. Individuals with lower fitness have a greater chance of being selected. The probability of being selected is relatively small, but there is still a certain chance of being retained to maintain the diversity of the population;

[0101] Step S2-3-2: Crossover operation; select individuals with a certain probability (e.g., ... Crossover is performed by randomly selecting two individuals, determining the crossover point, and then exchanging some genes after the crossover point to generate new individuals. For example, selecting two individuals "01010" and "10101", and randomly selecting the third crossover point, results in "01101" and "10010". The purpose of crossover is to combine the superior genes of different individuals, potentially generating better combinations of defense strategies. Through crossover, new individuals inherit the characteristics of their parents in choosing different defense actions, increasing the diversity of defense strategy combinations in the population and helping to discover more effective defense strategies.

[0102] Step S2-3-3: Mutation operation; with a low probability (e.g.) Mutation operations are performed on certain genes in an individual; one or more binary bits in an individual are randomly selected and reversed; for example, if an individual is "01010", the second bit is randomly selected for mutation, resulting in "00010"; mutation operations can introduce new gene combinations and prevent the algorithm from getting stuck in local optima; in the process of population evolution, although the mutation probability is low, it brings new possibilities to the population, allowing the algorithm to jump out of the local optimum region and explore a wider space of defense strategy combinations, thereby finding the globally optimal or near-optimal defense strategy combination;

[0103] Step S2-3-4: Iterative evolution; through multiple iterations (e.g., setting the number of iterations). The genetic algorithm iterates through selection, crossover, and mutation operations. In each iteration, the fitness of individuals in the current population is first evaluated based on the fitness function. Then, selection is performed to retain the best individuals, followed by crossover and mutation to generate new individuals, forming the next generation of the population. As the iteration progresses, the population evolves, and the defensive strategy combinations represented by the individuals are gradually optimized. For example, in the first iteration, the defensive strategy combination corresponding to the best individual in the population may be able to successfully prevent 70% of attacks with minimal impact on network performance. By the 50th iteration, the defensive strategy combination of the best individual may be able to successfully prevent 85% of attacks, and performance indicators such as network latency and device resource consumption are further optimized. When the set number of iterations is reached or other termination conditions are met (such as the fitness of the best individual no longer increasing for several consecutive iterations), the iteration stops. The defensive strategy combination represented by the best individual obtained at this point is the result optimized by the genetic algorithm.

[0104] Step S3: Real-time Adjustment and Deployment

[0105] Step S3-1: Obtaining the basis for strategy adjustment

[0106] Step S3-1-1: Attack Type Identification; The threat detection and intelligent analysis module continuously monitors the mining network and accurately identifies the attack type. This is achieved through the analysis of various aspects of information, such as network traffic, device behavior, and data characteristics. For example, for network traffic, it detects whether there are abnormal traffic patterns, such as a large number of connection requests from the same source IP address (which may be a DDoS attack) or abnormal scanning behavior on specific ports (which may be a port scanning attack). For device behavior, it monitors whether there are abnormal process startups, file accesses, or system calls (which may be caused by malware infection). For data characteristics, it analyzes whether the data has been tampered with, encrypted, or exhibits abnormal transmission patterns. By integrating this information, it accurately determines the type of attack currently occurring, such as a DDoS attack, malware infection attack, or data theft attack, providing a crucial basis for subsequent strategy adjustments.

[0107] Step S3-1-2: Real-time network status monitoring; Simultaneously, closely monitor the real-time status information of the mining network, including dynamic changes in network traffic, such as the increase or decrease trend of traffic volume, and the distribution of traffic flow (which areas or devices have large or abnormal traffic); real-time data of device performance indicators, such as device CPU utilization, memory usage, disk I / O rate, etc., to determine whether the device is overloaded or in an abnormal state; changes in network topology, such as whether new devices have been connected, and whether the connection relationship between devices has changed abnormally, etc.; This real-time status information, combined with attack type information, comprehensively reflects the actual situation of the mining network at the current moment, providing rich data support for formulating targeted defense strategy adjustment plans; for example, if a sudden surge in CPU utilization of a device in a certain area is detected and abnormal fluctuations in network traffic are observed, and a malware infection attack is identified, this information will serve as an important basis for adjusting the defense strategy.

[0108] Step S3-2: Strategy Adjustment and Optimization

[0109] Step S3-2-1: Dynamic parameter adjustment; In addition to selecting and combining defense strategies, the relevant parameters of the strategies are dynamically adjusted according to real-time conditions. For example, for access control lists in firewall rules, the range of allowed or blocked IP addresses and port numbers are dynamically adjusted according to the size and trend of attack traffic. If attack traffic continues to increase and the range of source IP addresses continues to expand, the firewall's blocking scope is expanded in a timely manner to more effectively prevent attack traffic from entering the mining network. For the detection threshold of the intrusion detection system, when the network is in a normal state, the detection threshold can be appropriately increased to reduce false alarms. When attack signs are detected or the network state is unstable, the detection threshold is lowered to increase detection sensitivity and ensure that potential attack behaviors can be detected in a timely manner. In addition, the network monitoring frequency is adjusted according to the severity and duration of the attack. In the early stages of an attack or when the attack is relatively minor, the normal monitoring frequency is maintained. When the attack intensifies or lasts for a long time, the monitoring frequency is increased to obtain network status information more timely and provide a basis for further adjustments to the defense strategy.

[0110] Step S3-2-2: Strategy Coordination Optimization; Emphasize the coordinated work between different defense strategies to ensure they can cooperate effectively in responding to attacks and maximize their efficiency; for example, while isolating infected devices, adjust network routing policies to redirect traffic that originally passed through the infected device to other normal devices or backup links, ensuring network connectivity and business continuity; simultaneously, coordinate with other security tools such as antivirus software and vulnerability patching systems, and promptly notify relevant tools to perform virus scanning and vulnerability patching on infected devices when adopting network-level defense strategies, forming a comprehensive defense system; through this coordination optimization, improve the overall performance of the entire mine network defense system and its ability to cope with complex attacks;

[0111] Step S3-3: Strategy Deployment and Implementation

[0112] Step S3-3-1: Security Equipment Adaptation; Adapt the adjusted defense strategy to various relevant security equipment in the mining network; different types of security equipment have different interfaces and configuration methods, requiring targeted adaptation; for firewall devices, convert the updated firewall rules into a format that they can recognize and execute, and configure the rules through the device's management interface (such as command line interface, web interface, etc.); for intrusion detection systems, send the adjusted detection parameters and mode configuration information to the corresponding devices to ensure that they can perform detection according to the new strategy; for antivirus gateways, push the updated virus database and protection strategy to enable them to effectively identify and block the intrusion of new malicious software; during the adaptation process, ensure the accuracy and completeness of the configuration information to avoid security equipment malfunctions or vulnerabilities due to configuration errors;

[0113] Step S3-3-2: Deployment Order and Verification; Determine the deployment order of the defense strategy, generally following the principle of critical equipment first, then general equipment, and core areas first, then edge areas; for example, first deploy the defense strategies related to critical equipment such as network core switches and servers to ensure that the core part of the network is protected first; then gradually deploy the strategies to edge devices (such as sensor nodes, workstations, etc.); after the strategy deployment of each device is completed, perform verification to check whether the device correctly receives and executes the new defense strategy; verification can be performed by simulating attack tests, checking device logs, monitoring network traffic and device status, etc.; if the strategy deployment fails or the device does not execute the strategy as expected, troubleshoot and repair it in time to ensure that the defense strategy can be reliably implemented in the entire mining network;

[0114] Step S3-3-3: Continuous Monitoring and Feedback Adjustment; After the defense strategy is deployed and implemented, continuously monitor the operational status and defense effectiveness of the mining network; evaluate the effectiveness of the defense strategy by monitoring indicators such as network traffic, device performance, and security incident occurrences in real time; if security vulnerabilities are still found in the network or the defense strategy fails to effectively respond to attacks, collect relevant information in a timely manner (such as new attack characteristics, changes in network status, etc.) and feed it back to the defense strategy generation and response module to trigger a new round of strategy adjustment and optimization; at the same time, record the deployment and execution of the defense strategy, including deployment time, configuration parameters, device response, etc., to form a strategy execution log, providing data support for subsequent strategy analysis and improvement; through this continuous monitoring and feedback adjustment mechanism, ensure that the mining network's defense strategy can be continuously optimized and improved according to the actual situation to adapt to the ever-changing network security threats.

[0115] In this embodiment, the quantum encryption and secure communication module is connected to the data transmission link in the mining network. It uses quantum key distribution (QKD) technology to encrypt data transmitted in the mining network, ensuring the security of data transmission. The specific operation steps are as follows:

[0116] Step S1: Quantum Key Distribution (QKD) Key Generation

[0117] Step S1-1: Preparation and transmission of the quantum bit sequence

[0118] Step S1-1-1: Quantum State Selection and Encoding; Based on the selected quantum key distribution protocol (such as the BB84 protocol), the sender must first determine the quantum state used to encode the information; for example, for polarization state encoding of photons, the sender can specify the horizontal polarization state. Represents binary information "0", vertical polarization state This represents "1"; then, a series of qubits based on these codes are prepared using specialized quantum devices (such as quantum light sources); for example, to generate a sequence containing 100 qubits, the sender will generate photons of the corresponding polarization states as qubits one by one according to the coding rules.

[0119] Step S1-1-2: Quantum Channel Transmission; The prepared qubit sequence is transmitted to the receiver through a specially laid quantum channel (such as low-loss optical fiber) in the mining network; During transmission, it is necessary to ensure that the quantum properties of the qubits are not destroyed, which requires strict control of the quantum channel environment, such as maintaining a stable temperature and reducing external electromagnetic field interference; For example, the laying of optical fiber should avoid areas with strong electromagnetic fields, and appropriate optical fiber materials and packaging technologies should be used to reduce photon loss and decoherence during transmission, ensuring that the qubit sequence can reach the receiver accurately from the sender;

[0120] Step S1-2: Classical Channel Information Comparison

[0121] Step S1-2-1: Measurement basis selection and disclosure; the sender and receiver communicate through a classical channel (such as a regular network communication line); both parties first randomly select a measurement basis to measure the received qubits; for example, the measurement basis can be chosen as horizontal. Vertical polarization base Or diagonally Anti-angle polarization basis ( , ,in, This indicates the horizontal polarization state (usually corresponding to binary information "0"). The vertical polarization state is represented (usually corresponding to binary information "1"); then, both parties randomly select a subset of qubit positions (e.g., randomly select 30 positions from 100 qubits) and disclose these positions and the measurement basis used;

[0122] Step S1-2-2: Measurement Result Comparison and Eavesdropping Detection; The receiver measures the qubits at the corresponding positions according to the measurement basis information disclosed by the sender, and informs the sender of the measurement results through a classical channel; The sender compares its measurement results at the same positions and under the same measurement basis with the receiver's results; If the proportion of consistent measurement results reaches a high threshold (e.g., above 95%), it indicates that the quantum channel is highly secure, and the qubits are unlikely to have been eavesdropped on during transmission; If the consistency proportion is low, eavesdropping may have occurred, and the two parties may need to re-prepare and transmit the qubit sequence to ensure the security of key generation;

[0123] Steps S1-3: Error Correction and Privacy Enhancement

[0124] Step S1-3-1: Error Correction Code Determination and Error Detection; After determining that the quantum channel security is high (i.e., the measurement result consistency ratio meets the requirements), both parties need to perform error correction operations on the remaining undisclosed qubits; First, both parties need to determine the type of error correction code to use (such as the classic low-density parity-check code LDPC, etc.); Then, based on the previously disclosed information of the comparison measurement basis and results, a syndrome is calculated to detect possible errors in the qubits; for example, the value of the syndrome is calculated through a specific algorithm, and the value of the syndrome is used to determine which qubits may have errors and the type of error (such as bit flip error or phase flip error, etc.).

[0125] Step S1-3-2: Error Correction and Privacy Amplification; Using error correction algorithms, based on the calculated checksum information, erroneous qubits are corrected to ensure the final qubit sequences obtained by both parties are as consistent as possible; for example, using an LDPC code decoding algorithm, the location of the erroneous bit is found and corrected based on the checksum; After error correction, a privacy amplification operation is performed; both parties use a pre-agreed hash function (such as SHA-256) to process the error-corrected qubit sequence and compress it into the final quantum key. This process ensures that even if an eavesdropper obtains some information during the initial stages, the effective information they can acquire will be greatly reduced after privacy amplification, thus guaranteeing the security of the quantum key distribution. It has extremely high security and meets the stringent requirements for encryption of network data in mines;

[0126] Step S2: Data Encryption and Decryption

[0127] Step S2-1: Encryption Process

[0128] Step S2-1-1: Key Distribution and Preparation; Distribute the quantum key generated by quantum key distribution (QKD) into the quantum key distribution array. Securely distribute the quantum key to sending devices (such as sensor nodes and control center servers) within the mining network that require data encryption; ensure that the sending devices ensure the quantum key is secure before transmitting data. The quantum key has been correctly acquired and is ready for use in encryption operations; for example, in a mining equipment monitoring system, after the sensor nodes collect equipment operation data, they acquire the quantum key before sending the data to the control center. ;

[0129] Step 2-1-2: Encryption algorithm execution; for the data block to be encrypted (For example, data collected by sensors such as temperature, pressure, and vibration), the transmitting device uses a selected symmetric encryption algorithm (such as AES algorithm) combined with a quantum key. Perform encryption operations; specifically, encrypt the data blocks. Divide the data into fixed-length blocks (e.g., 128 bits per block), and then associate each block with a quantum key. Perform bitwise XOR and other encryption operations to obtain the encrypted ciphertext. For example, for a 128-bit data block representing a temperature value Through quantum key distribution Perform a bitwise XOR operation to generate the encrypted ciphertext. In this way, even if the ciphertext is lost during data transmission... Illegally obtained, no quantum key Unable to recover the original data 1. This ensures the confidentiality of the data;

[0130] Step S2-2: Decryption process

[0131] Step S2-2-1: Ciphertext reception and key matching; the receiving device (such as the control center server) receives the encrypted ciphertext. Next, ensure that you have the quantum key corresponding to the sender. In mining networks, the receiving end obtains the correct quantum key through a secure key management mechanism (such as a key storage and retrieval system tightly integrated with the quantum key distribution system). This is so that decryption can be performed.

[0132] Step S2-2-2: Decryption algorithm restoration; the receiving end uses the decryption function corresponding to the encryption process. For ciphertext To perform decryption; for example, if the encryption process uses a quantum key. With data blocks Perform a bitwise XOR operation to obtain the ciphertext. Therefore, the quantum key is used again during decryption. With ciphertext Perform a bitwise XOR operation to recover the original data block. In a mining network data transmission scenario, after receiving encrypted data from sensor nodes, the control center server uses the correct quantum key... Decryption is performed to obtain accurate equipment operating parameter data, ensuring the integrity and confidentiality of mine network data transmission, enabling data to be transmitted and processed in a secure environment, and supporting the normal production and operation management of the mine.

[0133] In this embodiment, the event response and recovery module is connected to the threat detection and intelligent analysis module and the defense strategy generation and response module. After receiving security event information detected by the threat detection and intelligent analysis module, it initiates an emergency response through an adaptive algorithm and quickly restores the system to ensure the continuity of mine production; specifically, it includes the following steps:

[0134] Step S1: Input status confirmed

[0135] Step S1-1: Security Incident Information Collection

[0136] Step S1-1-1: Information Receiving Interface Establishment; The event response and recovery module and the threat detection and intelligent analysis module establish an efficient information receiving interface to ensure real-time acquisition of security event information; this interface can be implemented based on network communication protocols (such as TCP / IP protocol, etc.), using reliable data transmission methods to ensure the integrity and timeliness of information; for example, when the threat detection and intelligent analysis module detects a security event, it immediately sends the event information to the event response and recovery module through a pre-defined interface to avoid information transmission delays that cause delays in emergency response;

[0137] Step S1-1-2: Information Classification and Organization; The received security event information covers various types, and is first classified. Information types include network attack related information (such as attack type, attack source IP address, attack target, attack method, etc.), device failure information (such as device name, failure type, failure occurrence time, etc.), and data anomaly information (such as data tampering signs, data loss, abnormal data traffic, etc.). Then, this information is organized to remove redundant and erroneous information to ensure the accuracy and usability of the information. For example, information about the same security event from multiple detection sources is merged and deduplicated, and information in different formats is converted into a unified format for easier subsequent processing. For example, network attack information is organized into structured data containing fields such as attack type (such as DDoS attack, SQL injection attack, etc.), attack source IP address range (such as [192.168.1.1-192.168.1.10]), attack target device or system (such as server A, database server, etc.), and attack start time (such as 2023-05-01 10:00:00).

[0138] Step S1-2: Quantization Feature Extraction and State Determination

[0139] Step S1-2-1: Feature Selection and Calculation; Select key features from the organized security event information and perform quantitative calculations; For network attack events, select features such as the size of the affected network area (e.g., measured by the number of subnets or the range of IP address ranges), attack traffic intensity (e.g., the number of packets per second, traffic volume, etc.), and attack duration; For equipment failure events, select features such as the rate of decline in key performance indicators of the failed equipment (e.g., the increase in equipment temperature, the percentage decrease in rotational speed, etc.), and the scope of the failure's impact (e.g., the number of other devices connected to the failed equipment); For data anomaly events, select features such as the proportion of abnormal data to the total data volume and the rate of abnormal data change; For example, in a DDoS attack event, calculate the attack traffic intensity as 10,000 packets per second, the attack duration as 30 minutes, and the number of affected subnets as 3. These quantitative features will serve as important bases for constructing the input state;

[0140] Step S1-2-2: State Vector Construction; Combine the quantized features into a state vector to represent the current security event state s; the dimension of the state vector is determined according to the number of selected features, and each dimension corresponds to a feature value; for example, construct a state vector s=[3,10000,30,0.2], where the first element represents the number of affected subnets as 3, the second element represents the attack traffic intensity as 10000 packets per second, the third element represents the attack duration as 30 minutes, and the fourth element represents the proportion of abnormal data to the total data volume as 0.2 (assuming that abnormal data situations exist simultaneously); this state vector will be used as the input of the reinforcement learning algorithm for subsequent policy adjustment and decision-making;

[0141] Step S2: Adjusting the reinforcement learning strategy

[0142] Step S2-1: Define the action space of the emergency response strategy

[0143] Step S2-1-1: List of Action Types; Clarify the various possible action types in the emergency response strategy action space A; Action types include, but are not limited to, network-level operations, such as switching network topology (e.g., switching from a star topology to a ring topology to bypass faulty nodes), adjusting network routing strategies (e.g., dynamically changing packet forwarding paths to avoid congested or attacked areas), and initiating network traffic scrubbing (filtering out malicious attack traffic); system-level operations, such as restarting affected system services, switching to backup systems (e.g., backup servers, backup databases), and performing system snapshot rollback (restoring the system to its previous normal state); data-level operations, such as initiating data backup and recovery processes (backing up important data to a secure storage location and restoring it when needed), adjusting data encryption and decryption strategies (e.g., strengthening encryption strength or changing encryption algorithms during data transmission); and notification and collaboration actions, such as sending alert notifications to network administrators (via SMS, email, pop-ups, etc.) and collaborating with other security protection systems (e.g., intrusion detection systems, antivirus systems, etc.).

[0144] Step S2-1-2: Action Parameter Setting; For each action type, determine its related parameter settings; for example, for the action of switching network topology, it is necessary to set parameters such as the target topology type (e.g., specific parameters of a ring topology, such as node connection method, link bandwidth allocation, etc.), switching timing (e.g., switching when network latency exceeds a certain threshold or when a specific attack is detected); for the action of data backup and recovery, it is necessary to set parameters such as the range of backup data (e.g., full backup or incremental backup), backup storage location (e.g., local storage, cloud storage, etc.), and recovery point selection (e.g., selecting the most recent normal backup point for recovery); the reasonable setting of these parameters will affect the execution effect of the action, thereby affecting the overall effect of the emergency response;

[0145] Step S2-2: Reward Setting and Strategy Optimization

[0146] Step S2-2-1: Reward Function Design; Design the reward function. To quantify the actions taken In state The reward function is based on multiple factors, such as system recovery time (a higher positive reward is given if the system can quickly return to normal operation after the action is taken; the reward value is inversely proportional to the recovery time, for example, +10 for a system that recovers to normal within 1 minute, +5 for a system that recovers to normal within 5 minutes, etc.), the degree of impact of production interruption (the loss is calculated based on the importance of the mine's production operations and the interruption time; the smaller the loss, the higher the reward; for example, +8 for avoiding a major production interruption due to emergency response, and a negative reward, such as -3, for a prolonged production interruption time), and system stability improvement (a positive reward is given if the system stability is improved after the action is taken, such as a reduction in equipment failure rate or network jitter; the reward value is determined according to the degree of stability improvement). The reward function can be a weighted combination of these factors, such as...

[0147] (in, For system recovery time, The proportion of losses due to production interruption. As an indicator for improving system stability, (Weights of the corresponding factors);

[0148] Step S2-2-2: Value Function and Policy Function Update; Based on Markov Decision Process (MDP), update the value function... and policy function Updates are used to optimize emergency response strategies; value function Indicates the state The long-term value is updated using the following formula: (in, For learning rate, As a discount factor, In order to take action The next state after transition; policy function Indicates the state Take action below The probability of is determined by the specific reinforcement learning algorithm (such as the policy gradient algorithm), and its update formula is determined based on the specific algorithm. For example, (in, These are the parameters of the policy function. (As an action value function); In handling network security incidents in mines, when in a certain state (For example, if the network is attacked and some services are interrupted) the current policy function will be applied. Choose an action (For example, starting a backup server) Execute, and then adjust the value function according to the above update formula based on changes in system status (such as partial business recovery) and the obtained reward (such as +6). and policy function This enables the policy function to handle similar states in the future. It can select better actions to maximize long-term cumulative rewards, improve the effectiveness of emergency response and the speed of system recovery;

[0149] Step S3: Strategy Execution and System Recovery

[0150] Step S3-1: Determining and Executing the Optimal Strategy

[0151] Step S3-1-1: Policy Selection; Based on the results of the reinforcement learning policy adjustment, select the policy function... Determine the current state The optimal emergency response strategy is determined by the following: In practice, multiple strategy selection methods can be adopted, such as selecting the action with the highest probability as the optimal strategy (i.e., ...). Or based on the value function Choose the action that brings the greatest long-term value as the optimal strategy; for example, when the network is under DDoS attack and services are interrupted. At that time, after calculation by the policy function, network traffic scrubbing is initiated and the system switches to a backup server (action). The probability of this action is the highest, reaching 0.7, and the value function value corresponding to this action is... It is also the largest, therefore it is determined This is the optimal strategy;

[0152] Step S3-1-2: Action Execution and Coordination; Once the optimal strategy is determined, immediately execute all actions within that strategy and ensure coordination between actions; for actions involving multiple devices or systems, establish an effective coordination mechanism to ensure that actions are executed sequentially and without conflict; for example, when executing actions such as starting network traffic scrubbing and switching to a backup server, first start the traffic scrubbing device, configure scrubbing rules, and filter out malicious attack traffic; simultaneously, start the backup server switching procedure to smoothly migrate the business system from the primary server to the backup server, ensuring business continuity throughout the process; during execution, monitor the execution status of each action in real time, recording information such as the start time, execution progress, and execution results of the action, so that troubleshooting and handling can be carried out promptly when problems occur;

[0153] Step S3-2: System Status Monitoring and Recovery Assessment

[0154] Step S3-2-1: Setting and Collecting Monitoring Indicators; Set a series of system status monitoring indicators to comprehensively assess the recovery status of the mine network system; Monitoring indicators include network-level indicators, such as network latency (determined by sending test data packets and measuring round-trip time), network packet loss rate (the ratio of the difference between the number of sent and received data packets to the number of sent data packets), network bandwidth utilization (real-time monitoring of network link bandwidth usage), etc.; System-level indicators, such as equipment operating status (including equipment temperature, CPU utilization, memory usage, disk I / O rate, etc.), system service availability (checking whether critical system services are operating normally, such as Web services, database services, etc.); Business-level indicators, such as business system response time (the time from user operation to system return result), business processing success rate (the ratio of the number of successfully processed business requests to the total number of business requests), etc.; Collect data on these indicators in real time using specialized monitoring tools and software (such as network performance monitors, system management tools, etc.);

[0155] Step S3-2-2: Recovery Assessment and Decision-Making; Based on the collected monitoring data, periodically assess the system recovery status; Set recovery assessment thresholds, and consider the system to have recovered to normal when all monitoring indicators reach or exceed the thresholds during normal operation; For example, when network latency is below 10 milliseconds (normal threshold), network packet loss rate is below 0.1%, equipment operation is stable (e.g., CPU utilization is within the normal range), business system response time is within an acceptable range (e.g., less than 2 seconds), and business processing success rate reaches 99% or higher, it is determined that the system has recovered to normal operation; If it is found during the assessment process that the system has not fully recovered, continue to collect system status information, feed it back to the reinforcement learning algorithm, trigger a new round of strategy adjustment and execution until the system is fully recovered to normal, ensuring that the continuity of mine production is not seriously affected; At the same time, after the system recovers to normal, summarize and analyze the entire emergency response and recovery process, record the cause of the incident, the emergency response measures taken, system recovery time, and other information, to provide experience and reference for handling similar safety incidents in the future.

[0156] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A mine network security operation system, characterized in that: include: Data acquisition and preprocessing module: It is connected to various devices and sensors in the mining network, and is used to acquire real-time data from the devices and sensors, and to perform noise reduction and standardization processing on the acquired real-time data; The data acquisition and preprocessing module uses an autoencoder and a Gaussian mixture model (GMM) to denoise, normalize, and standardize the data, including: Autoencoder denoising: Let the input data be... An autoencoder is defined by an encoder function. and decoder function The encoder consists of input data. Mapping to a low-dimensional latent space representation The decoder then reconstructs the data from the latent space. Parameters are learned by minimizing the reconstruction error, which is measured by the mean squared error (MSE), as shown in the formula: ,in, For the number of data samples, and The first and second data are the original data and the reconstructed data, respectively. Each element; by optimizing and adjusting the parameters of the encoder and decoder, the reconstructed data is made... Close to the original data Remove noise components to obtain denoised data. ; Gaussian Mixture Model (GMM) processing: For data denoised by an autoencoder Assuming it obeys the rules of... The probability density function of the distribution formed by the mixture of Gaussian distributions is: ,in, For the first The mixing coefficients of a Gaussian distribution satisfy the following conditions: , The mean is The covariance matrix is Gaussian probability density function, ,in, For the data dimension, the maximum likelihood estimation method is used to estimate the... and Parameters, for data Perform normalization and standardization processing; Threat detection and intelligent analysis module: Connected to the data acquisition and preprocessing module, it employs a model combining deep convolutional neural networks (DCNN) and reinforcement learning (RL) to monitor attack behavior in the mining network in real time based on preprocessed data and perform threat detection. The threat detection and intelligent analysis module includes: Deep Convolutional Neural Network (DCNN) Feature Extraction: For preprocessed input data, let the convolution kernel be... , bias is The output of the convolutional layer It is obtained through convolution operation, and the formula is: ,in, Represents the location of the convolutional layer The output at that location, These represent the number of rows and columns of the convolution kernel, respectively. To output the coordinates of the feature map, As the activation function, after passing through convolutional and pooling layers, the features are extracted and transformed into vector representations; Reinforcement Learning (RL) Optimization: Suppose the agent at time t... The state is The action taken is set as The reward for environmental feedback is The state transition probability is Reinforcement learning is based on Markov Decision Processes (MDPs), and its goal is to maximize long-term cumulative rewards. ,in, As a discount factor, , Indicates the agent at time... The agent obtains rewards from the environment and uses policy functions to... To select actions, the value function Update according to the relevant update formula to dynamically optimize the detection strategy of deep convolutional neural network (DCNN); A defense strategy generation and response module, connected to the threat detection and intelligent analysis module, automatically generates defense strategies using a hybrid reinforcement learning and genetic algorithm, and adjusts them in real time based on different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mining network. The operation of the defense strategy generation and response module includes: Hybrid reinforcement learning evaluates defensive actions: Let the state space be... The action space is Hybrid reinforcement learning is based on Learning combined with policy gradient methods, in The learning section is arranged according to the corresponding Value update method update Value, in the policy gradient part, policy function parameters The goal of updating using the gradient ascent algorithm is to maximize the expected reward. Its gradient calculation formula is: Based on the current state and attack type, defensive action options are evaluated; Genetic algorithm optimizes defense strategy combinations: Defense action options are encoded to form individuals, and the population size is set to . ,individual The encoding is represented as Through fitness function The fitness of individuals is evaluated, and the fitness function is defined based on factors related to the effectiveness of defense strategies. The basic operations of the genetic algorithm, including selection, crossover, and mutation, are used for iterative evolution to generate the optimal combination of defense strategies. Real-time adjustment and deployment: Adjust the generated defense strategy in real time according to the attack type and system status, and deploy it to the relevant security protection equipment in the mining network; Quantum encryption and secure communication module: It is connected to the data transmission link in the mining network and uses quantum key distribution (QKD) technology to encrypt the data transmitted in the mining network to ensure the security of data transmission; Event Response and Recovery Module: It is connected to the Threat Detection and Intelligent Analysis Module and the Defense Strategy Generation and Response Module. After receiving security event information detected by the Threat Detection and Intelligent Analysis Module, it initiates an emergency response through an adaptive algorithm and quickly restores the system to ensure the continuity of mine production. The adaptive algorithm of the event response and recovery module is a reinforcement learning algorithm, which implements emergency response and system recovery according to the following process: Input state determination: The input state of the reinforcement learning algorithm is determined based on the threat information received in real time. Threat information includes relevant quantitative characteristics of security incidents; Reinforcement learning strategy adjustment: Let the action space of the emergency response strategy be... The agent is in a state Take action below Rewards for environmental feedback Based on the effects of actions taken on system recovery and reducing production downtime, and using a Markov Decision Process (MDP) based on the value function... and policy function Learn the optimal strategy according to the corresponding updated formula, and dynamically adjust the emergency response strategy; Strategy Execution and System Recovery: Quickly execute the identified emergency response strategies to minimize mine production downtime and restore the mine network system to normal operation.

2. The mine network security operation system according to claim 1, characterized in that: The quantum encryption and secure communication module ensures data transmission security according to the following steps: Quantum Key Distribution (QKD) Key Generation: Based on a quantum key distribution protocol, the sender prepares a sequence of qubits and sends it to the receiver. Both parties publicly compare partial information via a classical channel, and after error correction and privacy amplification steps, a quantum key is generated. Among them, error correction and privacy amplification operations are implemented based on the mathematical models and algorithm processes of the corresponding standards to ensure that the quantum key meets the security requirements; Data encryption and decryption: The quantum key Let the data block to be encrypted be , which is the key for the symmetric encryption algorithm. The encrypted ciphertext is then encrypted using an encryption function. The corresponding quantum key is obtained at the receiving end. Decryption is performed; the decryption function is... .

Images