Safety detection method, device and equipment based on industrial Internet of Things and medium

Abstract

The invention discloses a security detection method, device and equipment based on an industrial Internet of Things, and a medium. The method comprises the following steps: obtaining various access traffic data of an industrial Internet of Things system, and setting a preset distance formula and an initial weight coefficient of each access traffic data; respectively calculating the correlation degree between each piece of access flow data and each piece of other access flow data, determining a first adjustment factor of each piece of access flow data based on a plurality of correlation degrees of each piece of access flow data, and adjusting an initial weight coefficient of each piece of access flow data to obtain an improved weight coefficient of each piece of access flow data; determining an abnormal IP based on various access traffic data, the improved weight coefficient of each access traffic data and the preset distance formula; and carrying out security detection on the industrial Internet of Things system based on the abnormal IP. According to the method and the device, the problem that an existing anomaly detection algorithm only aims at single-dimensional data when abnormal IP identification is carried out, so that a misjudgment risk is easy to occur is solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to security detection methods, devices, equipment and media based on the Industrial Internet of Things. Background Art

[0002] In the era of big data, network security issues are of vital importance. In the analysis of network security based on network traffic data, abnormal IPs can be identified first, and then in-depth network security detection can be performed on these abnormal IPs. This includes real-time monitoring of their traffic patterns and analysis of their interactions with other parts of the network. At the same time, intrusion detection systems (IDS) and intrusion prevention systems (IPS) can be used to intercept and alert them to prevent potential security threats.

[0003] Anomaly detection algorithms are usually used to identify abnormal IPs based on network traffic data. However, existing anomaly detection algorithms only target single-dimensional data. For example, when using the COF anomaly detection algorithm (Connectivity-Based Outlier Factor) to identify abnormal IPs, abnormal IPs can be identified only based on access frequency data or only based on connection frequency data. However, judging IP anomalies based only on single-dimensional data is not comprehensive enough and may lead to the risk of misjudgment.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a security detection method, device, equipment and medium based on the industrial Internet of Things, aiming to solve the technical problem that the existing anomaly detection algorithm usually only considers one type of data when identifying abnormal IPs, resulting in misjudgment and wrong judgment.

[0006] To achieve the above-mentioned purpose, the present application provides a security detection method based on the industrial Internet of Things, including: obtaining multiple access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data; respectively calculating the correlation degree between each access flow data and each other access flow data, and determining a first adjustment factor of each access flow data based on multiple correlation degrees of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; determining an abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0007] Optionally, the correlation degree is a positive value or a negative value or 0; the determining the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data includes: dividing multiple access traffic data into data to be enhanced, data to be weakened and independent data based on the quantitative relationship between positive values, negative values ​​and 0 in the multiple correlation degrees corresponding to each of the access traffic data; for any data to be enhanced, calculating the number of positive values ​​in the correlation degree, and determining the first adjustment factor of the data to be enhanced based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree; for any data to be weakened, calculating the number of negative values ​​in the correlation degree, and determining the first adjustment factor of the data to be weakened based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree; the first adjustment factor of the independent data is preset to 1.

[0008] Optionally, the multiple access traffic data are divided into data to be enhanced, data to be weakened and independent data based on the quantitative relationship among positive values, negative values ​​and 0 in multiple correlation degrees corresponding to each of the access traffic data, including: calculating the number of positive values, the number of negative values ​​and the number of 0 in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of 0, the access traffic data is divided into data to be weakened; if the number of 0 in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0009] Optionally, determining the first adjustment factor of the data to be enhanced based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees includes: determining the first adjustment factor of the data to be enhanced using the following formula (1):

[0010]

[0011] In the formula, τ i represents the first adjustment factor of the i-th type of data to be enhanced, r ia Indicates the correlation degree of the ath positive value of the i-th type of data to be enhanced, ω ia A represents the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, i represents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0012] Optionally, the adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data using the following formula (2) to obtain the improved weight coefficient of each access traffic data:

[0013]

[0014] In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of types of access traffic data.

[0015] Optionally, before adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data, the method also includes: calculating the influence factor of each access traffic data, and determining the second adjustment factor of each access traffic data based on the influence factor of each access traffic data; adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data, including: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data.

[0016] Optionally, the adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data using the following formula (3) to obtain the improved weight coefficient of each access traffic data:

[0017]

[0018] In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n represents the initial weight coefficient of the nth access traffic data, N represents the number of access traffic data, ζ n Indicates the second adjustment factor of the nth type of access traffic data.

[0019] In addition, to achieve the above-mentioned purpose, the present application also provides a security detection device based on the industrial Internet of Things, including: a data acquisition module, used to obtain multiple access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data; a first adjustment factor calculation module, used to respectively calculate the correlation between each access flow data and each other access flow data, and determine the first adjustment factor of each access flow data based on multiple correlations of each access flow data; a weight improvement module, used to adjust the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; an abnormal IP acquisition module, used to determine the abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula using the COF abnormal detection algorithm; a security detection module, used to perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0020] The present application also provides a security detection device based on the industrial Internet of Things, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned security detection method based on the industrial Internet of Things.

[0021] The present application also provides a computer-readable storage medium, comprising: a computer program stored therein, and when the computer program is executed by a processor, the above-mentioned security detection method based on the industrial Internet of Things is implemented.

[0022] The present application proposes a security detection method, device, equipment and medium based on the industrial Internet of Things. By presetting the distance formula for anomaly detection, the existing COF anomaly detection algorithm solves the problem that the existing COF anomaly detection algorithm only targets single-dimensional data when identifying abnormal IPs, which is prone to the risk of misjudgment. In addition, the present application also takes into account the correlation between multidimensional data, that is, multiple access flow data, so as to adjust the weight coefficient of the preset distance formula based on the correlation between multiple access flow data, so that when a certain access flow data has a strong correlation with other access flow data and is positively correlated, the initial weight coefficient of the access flow data is increased to enhance its influence on the distance measurement. When the correlation between a certain access flow data and other access flow data is mostly negatively correlated, the initial weight coefficient of the access flow data is reduced to reduce its influence on the distance measurement. Therefore, the present application improves the traditional COF anomaly detection algorithm based on the correlation between multiple access flow data, so that when the COF anomaly detection algorithm in the present application is used to identify abnormal IPs, the accuracy of identification is increased and the risk of misjudgment is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of a safety detection method based on the industrial Internet of Things according to an implementation mode of the present application;

[0024] Figure 2 It is a flowchart of a safety detection method based on industrial Internet of Things according to another embodiment of the present application;

[0025] Figure 3 This is a structural block diagram of a safety detection device based on industrial Internet of Things according to an implementation mode of the present application;

[0026] Figure 4 The present invention is a schematic diagram of the structure of a safety detection device based on the industrial Internet of Things according to an embodiment of the present application.

[0027] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0028] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0029] In the prior art, when using the COF anomaly detection algorithm (Connectivity-Based Outlier Factor) to identify abnormal IPs, it is usually based on only one-dimensional data, such as IP access frequency or IP connection frequency. However, using only one-dimensional data will lead to the risk of misjudgment.

[0030] To solve the above problems, the present application provides a security detection method, device, equipment and medium based on the industrial Internet of Things. The present application scheme is introduced in detail below.

[0031] Figure 1 is a flowchart of a security detection method based on the industrial Internet of Things according to an embodiment of the present application. The security detection method based on the industrial Internet of Things can be performed by an electronic device with data processing capabilities, and the electronic device can be configured as a security detection device based on the industrial Internet of Things. Figure 1 , the security detection method based on industrial Internet of Things may include the following steps:

[0032] Step S1, obtaining various access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data.

[0033] It should be noted that the steps of anomaly detection by the COF anomaly detection algorithm (Connectivity-Based Outlier Factor) are usually as follows:

[0034] Collect target datasets;

[0035] Calculate k nearest neighbors: For each data point, calculate its distance to other data points and select k nearest neighbors;

[0036] Calculate local density: Based on k nearest neighbors, calculate the local density of each data point, that is, the sum of the distances between the point and its neighboring points;

[0037] Calculate connectivity: For each point, calculate its connectivity, which is defined as the sum of the local density of the point and its neighboring points. The higher the connectivity, the more important the point is in the local space.

[0038] Calculate COF value: Use the connectivity of each point to calculate the COF value, where the COF value reflects the ratio between the local density of a point and the local density of its neighbors. Points with lower COF values ​​are considered potential outliers. Set a threshold and mark anomalies: Set a threshold based on the calculated COF value, and mark points with COF values ​​lower than the threshold as anomalies.

[0039] Among them, this embodiment improves the step of calculating the distance between each data point and other data points in the COF anomaly detection algorithm.

[0040] In the specific implementation process, multiple access flow data of a preset time length are obtained in the industrial Internet of Things system. The multiple access flow data can be flow data, IP connection times, IP address, data transmission volume, access frequency, etc. It should be noted that each IP corresponds to multiple access flow data, and the types and numbers of access flow data corresponding to different IPs are the same. It can be understood that this embodiment performs abnormal detection on multiple IPs based on the multiple access flow data corresponding to each IP.

[0041] Furthermore, the dimensions of various access traffic data are unified to eliminate the impact of different dimensions.

[0042] Furthermore, a preset distance formula is set, wherein the preset distance formula is a multidimensional Euclidean distance formula, the initial weight coefficient of each access traffic data is the weight of the preset distance formula, and the preset distance formula can be used to characterize the difference between each access traffic data corresponding to different IPs.

[0043] Specifically, taking four types of access traffic data as an example, we use the set {X x}, {Y y}、{Z z}、{P p} means that, taking the g-th IP and the h-th IP as an example, the distance between the g-th IP and the h-th IP can be calculated using the following preset distance formula (4):

[0044]

[0045] Where: Xg, X h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {X x},Y g , Y h They represent the access traffic data {Yy} corresponding to the g-th IP and the h-th IP, respectively. g , Z h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {Z z}, P g , P h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {P p}, c, d, e, and f represent the access traffic data {X x}, {Y y}、{Z z}、{P p} corresponds to the initial weight coefficient.

[0046] According to the multi-dimensional Euclidean distance formula, the initial weight coefficients of each access traffic data are equal and are all 1. This embodiment improves the initial weight coefficients of each access traffic data based on the correlation of different access traffic data.

[0047] Step S2, respectively calculating the correlation between each access traffic data and each other access traffic data, and determining a first adjustment factor for each access traffic data based on multiple correlations of each access traffic data.

[0048] Step S3: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

[0049] It should be noted that when using the usual steps of the COF anomaly detection algorithm to measure the distance, the initial weight coefficient of each item is 1, which cannot reflect the correlation between multiple access traffic data. This application can use the COF anomaly detection algorithm to identify abnormal IPs based on multiple access traffic data. Since there is a correlation between multiple access traffic data, different coefficients can be assigned to different access traffic data to adjust their importance in distance calculation based on the correlation between multiple access traffic data.

[0050] Based on this, the embodiment of the present application utilizes the correlation between different access traffic data to obtain the first adjustment factor of each access traffic data, and then uses the first adjustment factor of each access traffic data to improve the initial weight coefficient of the access traffic data to obtain an improved weight coefficient. It can be understood that the improved weight coefficient is a further improvement of the pre-set initial weight coefficient, highlighting the correlation between different access traffic data, so as to enhance or weaken the influence of different access traffic data on the distance measurement based on the correlation between different access traffic data, thereby improving the recognition accuracy when using the COF anomaly detection algorithm to identify abnormal IPs.

[0051] In a specific implementation process, the correlation between each access traffic data and each other access traffic data in the multiple access traffic data is calculated, and the correlation can be used to characterize the linear relationship between the two access traffics. For example, the Pearson correlation coefficient can be used to calculate the correlation between the two access traffic data, wherein the correlation can be a positive value, i.e., characterize the positive correlation between the two access traffic data; the correlation can also be a negative value, i.e., characterize the negative correlation between the two access traffic data; the correlation can also be 0, i.e., characterize the no linear relationship between the two access traffic data.

[0052] In one embodiment, in step S2, the correlation degree is a positive value, a negative value or 0, and determining the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data may specifically include:

[0053] S21, dividing the multiple access traffic data into data to be enhanced, data to be weakened, and independent data based on the quantitative relationship among the positive values, negative values, and 0 in the multiple correlation degrees corresponding to the access traffic data;

[0054] S22. For any data to be enhanced, calculate the number of positive values ​​in the correlation degree, and determine a first adjustment factor of the data to be enhanced based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree;

[0055] S23, for any data to be weakened, calculating the number of negative values ​​in the correlation degree, and determining a first adjustment factor of the data to be weakened based on multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree;

[0056] S24. Preset the first adjustment factor of the independent data to 1.

[0057] It should be noted that since the correlation degrees between different access traffic data may be different, each access traffic data may be positively correlated with other access traffic data, may be negatively correlated, or may have no linear relationship. Therefore, the multiple correlation degrees between each access traffic data and other access traffic data include at least one of positive values, negative values ​​and 0. The access traffic data can be divided into data to be enhanced, data to be weakened and independent data according to the difference in the number of positive values, negative values ​​and 0 in the multiple correlation degrees.

[0058] In one embodiment, in step S21, dividing the multiple access traffic data into data to be enhanced, data to be weakened, and independent data may specifically include:

[0059] S211, calculating the number of positive values, the number of negative values, and the number of 0 in multiple correlation levels of each access flow data;

[0060] S212: if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is classified as data to be enhanced;

[0061] S213, if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is classified as data to be weakened;

[0062] S214: If the number of 0s in the correlation degree of the access flow data is greater than the number of positive values ​​and greater than the number of negative values, the access flow data is divided into independent data.

[0063] In a specific implementation process, the number of positive values, the number of negative values, and the number of 0 in multiple correlation levels of each access flow data are calculated.

[0064] Furthermore, for any access traffic data, when the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; when the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; when the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0065] It should be noted that when a certain access traffic data is the data to be enhanced, it means that the access traffic data is positively correlated with other traffic data. At this time, it is necessary to increase the initial weight coefficient of the access traffic data, thereby enhancing the sensitivity of anomaly detection. When the correlation degree of a certain data to be enhanced is a positive value and its value is large, it means that the data to be enhanced is highly correlated with other access traffic data, and the importance of the data to be enhanced is strong. It is necessary to increase the initial weight coefficient of the access traffic data to a large extent to enhance its influence on the distance metric.

[0066] In a specific implementation process, for any data to be enhanced, the number of positive values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be enhanced is determined based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree.

[0067] Specifically, taking the i-th type of data to be enhanced as an example, the following formula (1) can be used to determine the first adjustment factor τ of the i-th type of data to be enhanced: i :

[0068]

[0069] In the formula, r ia Indicates the correlation degree of the ath positive value of the i-th type of data to be enhanced, ω ia A represents the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, i represents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0070] Since the greater the correlation between different access flow data, the stronger the correlation between different access flow data, in order to make the first adjustment factor more able to characterize the strength of the correlation between different flow data and increase the difference between the larger correlation and the smaller correlation, this embodiment uses a weighting coefficient to multiply each correlation, and the weighting coefficient corresponding to each correlation is equal to the correlation. For example, if a certain correlation is 0.9 and another correlation is 0.2, the difference between the two correlations is 0.7. When using a weighting coefficient to multiply each correlation, if a certain correlation is 0.9, the weighting coefficient corresponding to the correlation is also 0.9, and the product of the correlation and the weighting coefficient is 0.81; if another correlation is 0.2, the weighting coefficient corresponding to the correlation is also 0.2, and the product of the correlation and the weighting coefficient is 0.04, the difference between the product of the two correlations and the weighting coefficient is 0.77, and then the result obtained by multiplying the correlation and the corresponding weighting coefficient increases the difference between the larger correlation and the smaller correlation, and then it is more convenient to characterize the specific numerical value of the correlation.

[0071] It should be noted that if a certain data to be enhanced is positively correlated with the other 6 access traffic data, and the correlation degrees are 0.1, 0.2, 0.3, 0.4, 0.2, and 0.3 respectively; at the same time, if another data to be enhanced is positively correlated with the other 3 access traffic data, and the correlation degrees are 0.9, 0.8, and 0.7 respectively. Although the number of positive correlations between the second data to be enhanced and the other access traffic data is less than that of the first data to be enhanced, the correlation degrees between the second data to be enhanced and the other access traffic data are both greater, that is, the correlation is stronger, and then compared with the number of positive numbers in the correlation degree, the specific value of the correlation degree can better highlight the correlation between different access traffic data. Therefore, this exemplary embodiment sets the sum of the first preset coefficient α and the second preset coefficient β to 1, and α is greater than β, α can be 0.7, and β can be 0.3.

[0072] Further, for any data to be weakened, the number of negative values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be weakened is determined based on multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree.

[0073] Specifically, taking the jth type of data to be weakened as an example, the following formula (5) can be used to determine the first adjustment factor τ of the jth type of data to be weakened: j :

[0074]

[0075] In the formula, r jb Indicates the correlation degree of the bth negative value of the jth type of data to be weakened, ω ja The weighting coefficient corresponding to the bth negative correlation degree of the jth data to be weakened, B j represents the number of negative values ​​in the correlation degree of the j-th type of data to be weakened, α represents the first preset coefficient, and β represents the second preset coefficient.

[0076] It should be further explained that when the number of 0s included in the multiple correlation degrees of a certain access traffic data is large, it means that there is no linear relationship between the access traffic data and other multiple traffic data, that is, the access traffic data is an independent factor. At this time, the initial weight coefficient of the access traffic data is not adjusted, and the impact of the access traffic data on anomaly detection can be maintained.

[0077] In a specific implementation process, the first adjustment factor of the independent data is preset to 1.

[0078] Furthermore, the initial weight coefficient of each access traffic data is adjusted based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

[0079] Specifically, taking the nth access traffic data as an example, the following formula (2) can be used to adjust the initial weight coefficient of the nth access traffic data to obtain the improved weight coefficient of the nth access traffic data:

[0080]

[0081] In the formula, τ n Represents the first adjustment factor of the nth access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of access traffic data.

[0082] Step S4, determining abnormal IP based on multiple access flow data, improved weight coefficients of each access flow data and the preset distance formula.

[0083] Step S5: Perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0084] In the specific implementation process, firstly, a variety of access flow data and the improved weight coefficient of each access flow data are substituted into the preset distance formula, and then the abnormal IP is determined using the COF anomaly detection algorithm based on the preset distance formula after the substitution value.

[0085] Furthermore, a risk assessment is conducted on the abnormal IPs obtained to confirm whether they have malicious activities or potential attacks, and appropriate response measures are taken based on the assessment results, such as restricting or blocking access to suspicious IPs, to complete the security detection of the industrial Internet of Things system.

[0086] In this exemplary embodiment, since the first adjustment factor characterizes the degree of correlation between different access traffic data, on this basis, the initial weight coefficient of each access traffic data is adjusted by using the first adjustment factor to obtain an improved weight coefficient. In this way, the improved weight coefficient is used to determine the abnormal IP, thereby increasing the accuracy of identification.

[0087] Based on the above embodiments, Figure 2 This is a flow chart of a safety detection method based on industrial Internet of Things according to another embodiment of the present application. Figure 2 Based on Figure 1 The corresponding preferred embodiment of the security detection method based on the industrial Internet of Things is shown in FIG. Figure 2 , the security detection method based on industrial Internet of Things may include the following steps:

[0088] S1. Obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data;

[0089] S2, respectively calculating the correlation degree of each access traffic data with each other access traffic data, and determining the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data;

[0090] S3, calculating the impact factor of each access traffic data, and determining the second adjustment factor of each access traffic data based on the impact factor of each access traffic data;

[0091] S4, adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data;

[0092] S5. Determine the abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula;

[0093] S6. Perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0094] In step S3, the influence factor of each access traffic data can be calculated using the random forest algorithm, wherein the influence factor of each access traffic data is the feature importance evaluation of each access traffic data for IP anomaly detection using the random forest algorithm. The influence factors of all access traffic data are normalized, and the normalized influence factor of each access traffic data is the second adjustment factor of each access traffic data.

[0095] In one embodiment, in step S4, taking the nth type of access traffic data as an example, the initial weight coefficient of the nth type of access traffic data can be adjusted using the following formula (3) based on the first adjustment factor and the second adjustment factor of the nth type of access traffic data to obtain an improved weight coefficient of the nth type of access traffic data:

[0096]

[0097] In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n represents the initial weight coefficient of the nth access traffic data, N represents the number of access traffic data, ζ n Indicates the second adjustment factor of the nth type of access traffic data.

[0098] In this exemplary embodiment, a second adjustment factor is added on the basis of the above embodiment. The second adjustment factor can characterize the influence of each access traffic data on the abnormal IP. The improved weight coefficient is obtained by adjusting the initial weight coefficient of each access traffic data using the first adjustment factor and the second adjustment factor. Not only the correlation of different access traffic data but also the influence of each access traffic data on the abnormal IP is considered. In this way, the improved weight coefficient is used to determine the abnormal IP, the recognition accuracy is increased, and the risk of misjudgment is reduced.

[0099] Based on the above embodiments, Figure 3 is a structural block diagram of a safety detection device based on industrial Internet of Things according to an implementation mode of the present application, such as Figure 3 As shown, the security detection device based on the industrial Internet of Things may include: a data acquisition module 210, a first adjustment factor calculation module 220, a weight improvement module 230, an abnormal IP acquisition module 240, and a security detection module 250, wherein:

[0100] The data acquisition module 210 is used to obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data;

[0101] The first adjustment factor calculation module 220 is used to respectively calculate the correlation degree of each access traffic data with each other access traffic data, and determine the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data;

[0102] The weight improvement module 230 is used to adjust the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data;

[0103] The abnormal IP acquisition module 240 is used to determine the abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula;

[0104] The security detection module 250 is used to perform security detection of the industrial Internet of Things system based on abnormal IP.

[0105] In an exemplary embodiment, the correlation degree in the first adjustment factor calculation module 220 is a positive value, a negative value or 0. The first adjustment factor calculation module 220 can also be used to divide multiple access traffic data into data to be enhanced, data to be weakened and independent data based on the quantitative relationship between positive values, negative values ​​and 0 in multiple correlation degrees corresponding to each of the access traffic data; for any data to be enhanced, the number of positive values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be enhanced is determined based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees; for any data to be weakened, the number of negative values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be weakened is determined based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degrees; the first adjustment factor of the independent data is preset to 1.

[0106] In an exemplary embodiment, the first adjustment factor calculation module 220 can also be used to calculate the number of positive values, the number of negative values, and the number of 0s in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; if the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0107] In an exemplary embodiment, the first adjustment factor calculation module 220 can also be used to calculate the number of positive values, the number of negative values, and the number of 0s in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; if the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0108] In an exemplary embodiment, the first adjustment factor calculation module 220 uses the following formula (1) to determine the first adjustment factor of the data to be enhanced:

[0109]

[0110] In the formula, τ i represents the first adjustment factor of the i-th type of data to be enhanced, r ia Indicates the correlation degree of the ath positive value of the i-th type of data to be enhanced, ω ia A represents the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, irepresents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0111] In an exemplary embodiment, the weight improvement module 230 uses the following formula (2) to adjust the initial weight coefficient of each access traffic data to obtain an improved weight coefficient of each access traffic data:

[0112]

[0113] In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of types of access traffic data.

[0114] The safety detection device based on industrial Internet of Things also includes a second adjustment factor acquisition module, which is used to calculate the influence factor of each access flow data, and determine the second adjustment factor of each access flow data based on the influence factor of each access flow data.

[0115] Those skilled in the art should understand that the division of the various modules in the embodiment is only a division of logical functions, and can be fully or partially integrated into one or more actual carriers in actual application, and these modules can be all implemented in the form of software called by the processing unit, or all implemented in the form of hardware, or implemented in the form of a combination of software and hardware. It should be noted that each module in a safety detection device based on the industrial Internet of Things in this embodiment corresponds one by one to each step in a safety detection method based on the industrial Internet of Things in the aforementioned embodiment. Therefore, the specific implementation method of this embodiment can refer to the implementation method of the aforementioned safety detection method based on the industrial Internet of Things, which will not be repeated here.

[0116] Based on the above embodiments, Figure 4 Schematic diagram of a safety detection device based on industrial Internet of Things according to an implementation mode of the present application. Figure 4As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 complete mutual communication through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute a security detection method based on the industrial Internet of Things, the method comprising: obtaining multiple access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data; respectively calculating the correlation degree of each access flow data with each other access flow data, and determining the first adjustment factor of each access flow data based on the multiple correlation degrees of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; determining an abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0117] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0118] On the basis of the above embodiments, on the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security detection method based on the industrial Internet of Things provided by the above methods, the method including: obtaining multiple access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data; respectively calculating the correlation between each access flow data and each other access flow data, and determining a first adjustment factor for each access flow data based on multiple correlations of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; determining an abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0119] On the basis of the above embodiments, on another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute the security detection method based on the industrial Internet of Things provided by the above methods, the method comprising: obtaining a plurality of access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data; respectively calculating the degree of correlation between each access flow data and each other access flow data, and determining a first adjustment factor for each access flow data based on multiple correlation degrees of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; determining an abnormal IP based on a plurality of access flow data, the improved weight coefficient of each access flow data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0120] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A safety detection method based on industrial Internet of Things, characterized in that: include: Obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient for each access flow data; Calculate the correlation degree of each access flow data with each other access flow data respectively, and determine the first adjustment factor of each access flow data based on multiple correlation degrees of each access flow data; Adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; Determine abnormal IP based on multiple access flow data, improved weight coefficients of each access flow data and the preset distance formula; The security detection of the industrial Internet of Things system is performed based on the abnormal IP.

2. The safety detection method based on industrial Internet of Things according to claim 1, characterized in that: The correlation degree is a positive value, a negative value or 0; the determining the first adjustment factor of each access flow data based on the multiple correlation degrees of each access flow data includes: Based on the quantitative relationship among the positive values, negative values ​​and 0 in the multiple correlation degrees corresponding to the access traffic data, the multiple access traffic data are divided into data to be enhanced, data to be weakened and independent data; For any data to be enhanced, the number of positive values ​​in the correlation degree is calculated, and a first adjustment factor of the data to be enhanced is determined based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree; For any data to be weakened, the number of negative values ​​in the correlation degree is calculated, and a first adjustment factor of the data to be weakened is determined based on a plurality of correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree; The first adjustment factor of the preset independent data is 1.

3. The safety detection method based on industrial Internet of Things according to claim 2, characterized in that: The method of dividing the multiple access traffic data into data to be enhanced, data to be weakened and independent data based on the quantitative relationship among the positive values, negative values ​​and 0 in the multiple correlation degrees corresponding to the access traffic data includes: Calculate the number of positive values, the number of negative values, and the number of 0 in multiple correlation levels of each access flow data; If the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is classified as data to be enhanced; If the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is classified as data to be weakened; If the number of 0s in the correlation degree of the access flow data is greater than the number of positive values ​​and greater than the number of negative values, the access flow data is divided into independent data.

4. The safety detection method based on industrial Internet of Things according to claim 2, characterized in that: The determining a first adjustment factor of the data to be enhanced based on a plurality of correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees includes: The first adjustment factor of the data to be enhanced is determined using the following formula (1): In the formula, τ i represents the first adjustment factor of the i-th type of data to be enhanced, r ia Indicates the correlation degree of the ath positive value of the i-th type of data to be enhanced, ω ia A represents the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, i represents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

5. The safety detection method based on industrial Internet of Things according to claim 1, characterized in that: The step of adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: Based on the first adjustment factor of each access traffic data, the initial weight coefficient of each access traffic data is adjusted using the following formula (2) to obtain the improved weight coefficient of each access traffic data: In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of types of access traffic data.

6. The safety detection method based on industrial Internet of Things according to claim 1, characterized in that: Before adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data, the method further includes: Calculating the impact factor of each access traffic data, and determining the second adjustment factor of each access traffic data based on the impact factor of each access traffic data; The step of adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: The initial weight coefficient of each access traffic data is adjusted based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

7. The safety detection method based on industrial Internet of Things according to claim 6, characterized in that: The adjusting of the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: Based on the first adjustment factor and the second adjustment factor of each access traffic data, the initial weight coefficient of each access traffic data is adjusted using the following formula (3) to obtain the improved weight coefficient of each access traffic data: In the formula, represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth access traffic data, δ n represents the initial weight coefficient of the nth access traffic data, N represents the number of access traffic data, ζ n Indicates the second adjustment factor of the nth type of access traffic data.

8. A safety detection device based on industrial Internet of Things, characterized in that: include: A data acquisition module is used to obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data; A first adjustment factor calculation module is used to calculate the correlation degree of each access flow data and each other access flow data respectively, and determine the first adjustment factor of each access flow data based on multiple correlation degrees of each access flow data; A weight improvement module, used for adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; An abnormal IP acquisition module, used to determine abnormal IPs using a COF anomaly detection algorithm based on multiple access flow data, an improved weight coefficient of each access flow data and the preset distance formula; The security detection module is used to perform security detection of industrial Internet of Things systems based on abnormal IP.

9. A safety detection device based on industrial Internet of Things, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the industrial Internet of Things-based security detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the safety detection method based on the industrial Internet of Things as described in any one of claims 1 to 7 is implemented.

Images