Security detection methods, devices, equipment and media based on industrial Internet of Things

Abstract

This application discloses a security detection method, apparatus, device, and medium based on the Industrial Internet of Things (IIoT). The method comprises: obtaining multiple access flow data of an IIoT system and setting a preset distance formula and an initial weight coefficient for each access flow data; calculating the correlation between each access flow data and each other access flow data, determining a first adjustment factor for each access flow data based on the multiple correlations, and adjusting the initial weight coefficient for each access flow data to obtain an improved weight coefficient for each access flow data; determining abnormal IP addresses based on the multiple access flow data, the improved weight coefficient for each access flow data, and the preset distance formula; and performing security detection of the IIoT system based on the abnormal IP addresses. This application addresses the problem that existing anomaly detection algorithms only identify abnormal IP addresses based on a single dimension of data, which can easily lead to misjudgment.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to security detection methods, devices, equipment, and media based on the Industrial Internet of Things. Background Art

[0002] In the era of big data, network security is crucial. When analyzing network traffic data, we can first identify anomalous IP addresses and then conduct in-depth network security testing on them. This involves real-time monitoring of their traffic patterns and analyzing their interactions with the rest of the network. Furthermore, we can utilize intrusion detection systems (IDS) and intrusion prevention systems (IPS) to intercept and alert them, preventing potential security threats.

[0003] Anomaly detection algorithms are usually used to identify abnormal IP addresses based on network traffic data. However, existing anomaly detection algorithms only target single-dimensional data. For example, when using the COF anomaly detection algorithm (Connectivity-Based Outlier Factor) to identify abnormal IP addresses, abnormal IP addresses can be identified based only on access frequency data or connection frequency data. However, judging IP anomalies based solely on single-dimensional data is not comprehensive and may lead to the risk of misjudgment.

[0004] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a security detection method, device, equipment and medium based on the Industrial Internet of Things, aiming to solve the technical problem that the existing anomaly detection algorithm usually only considers one type of data when identifying abnormal IPs, resulting in misjudgment and wrong judgment.

[0006] To achieve the above-mentioned objectives, the present application provides a security detection method based on the industrial Internet of Things, including: obtaining multiple access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access flow data; respectively calculating the correlation between each access flow data and each other access flow data, and determining a first adjustment factor for each access flow data based on multiple correlation degrees of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient for each access flow data; determining an abnormal IP based on the multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0007] Optionally, the correlation degree is a positive value, a negative value or 0; the determining the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data includes: dividing the multiple access traffic data into data to be enhanced, data to be weakened and independent data based on the quantitative relationship between positive values, negative values ​​and 0 in the multiple correlation degrees corresponding to each access traffic data; for any data to be enhanced, calculating the number of positive values ​​in the correlation degree, and determining the first adjustment factor of the data to be enhanced based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees; for any data to be weakened, calculating the number of negative values ​​in the correlation degree, and determining the first adjustment factor of the data to be weakened based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degrees; the first adjustment factor of the independent data is preset to 1.

[0008] Optionally, the multiple access traffic data are divided into data to be enhanced, data to be weakened and independent data based on the quantitative relationship between positive values, negative values ​​and 0 in multiple correlation degrees corresponding to each of the access traffic data, including: calculating the number of positive values, negative values ​​and 0 in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; if the number of 0 in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0009] Optionally, determining the first adjustment factor of the data to be enhanced based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees includes: determining the first adjustment factor of the data to be enhanced using the following formula (1):

[0010]

[0011] Where, τ i represents the first adjustment factor of the i-th type of data to be enhanced, r ia Indicates the correlation degree of the a-th positive value of the i-th type of data to be enhanced, ω ia Indicates the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, A i represents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0012] Optionally, adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data using the following formula (2) to obtain the improved weight coefficient of each access traffic data:

[0013]

[0014] Where, Represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth type of access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of types of access traffic data.

[0015] Optionally, before adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data, the method also includes: calculating the influence factor of each access traffic data, and determining the second adjustment factor of each access traffic data based on the influence factor of each access traffic data; adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data.

[0016] Optionally, adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data using the following formula (3) to obtain the improved weight coefficient of each access traffic data:

[0017]

[0018] Where, Represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth type of access traffic data, δ n represents the initial weight coefficient of the nth type of access traffic data, N represents the number of access traffic data, ζ n Indicates the second adjustment factor of the nth type of access traffic data.

[0019] In addition, to achieve the above-mentioned purpose, the present application also provides a security detection device based on the industrial Internet of Things, including: a data acquisition module, used to obtain multiple access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data; a first adjustment factor calculation module, used to respectively calculate the correlation between each access flow data and each other access flow data, and determine the first adjustment factor of each access flow data based on the multiple correlation degrees of each access flow data; a weight improvement module, used to adjust the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient of each access flow data; an abnormal IP acquisition module, used to determine the abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula using the COF anomaly detection algorithm; a security detection module, used to perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0020] The present application also provides a security detection device based on the industrial Internet of Things, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned security detection method based on the industrial Internet of Things.

[0021] The present application also provides a computer-readable storage medium, comprising: a computer program stored therein, wherein when the computer program is executed by a processor, the computer program implements the above-mentioned security detection method based on the industrial Internet of Things.

[0022] The present application proposes a security detection method, device, equipment and medium based on the Industrial Internet of Things. By presetting a distance formula for anomaly detection, the present application solves the problem that the existing COF anomaly detection algorithm only targets single-dimensional data when identifying abnormal IP addresses, which is prone to the risk of misjudgment. In addition, the present application also takes into account the correlation between multidimensional data, that is, the existence of multiple access flow data, and thus adjusts the weight coefficient of the preset distance formula based on the correlation between multiple access flow data. When a certain access flow data has a strong correlation with other access flow data and is positively correlated, the initial weight coefficient of the access flow data is increased to enhance its impact on the distance measurement. When a certain access flow data has a relatively high correlation with other access flow data and is negatively correlated, the initial weight coefficient of the access flow data is reduced to reduce its impact on the distance measurement. Therefore, the present application improves the traditional COF anomaly detection algorithm based on the existence of correlation between multiple access flow data, so that when the COF anomaly detection algorithm in the present application is used to identify abnormal IP addresses, the accuracy of identification is increased and the risk of misjudgment is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flowchart of a security detection method based on the Industrial Internet of Things according to one embodiment of the present application;

[0024] Figure 2 This is a flow chart of a security detection method based on the Industrial Internet of Things according to another embodiment of the present application;

[0025] Figure 3 This is a structural block diagram of a safety detection device based on the Industrial Internet of Things according to one embodiment of the present application;

[0026] Figure 4 The figure is a schematic structural diagram of a safety detection device based on the industrial Internet of Things according to one embodiment of the present application.

[0027] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0028] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0029] In the prior art, the COF anomaly detection algorithm (Connectivity-Based Outlier Factor) is usually used to identify abnormal IP addresses based on only one-dimensional data, such as IP access frequency or IP connection frequency. However, using only one-dimensional data may lead to the risk of misjudgment.

[0030] To solve the above problems, this application provides a security detection method, device, equipment and medium based on the industrial Internet of Things. The application solution is introduced in detail below.

[0031] Figure 1 This is a flowchart of a security detection method based on the Industrial Internet of Things according to an embodiment of the present application. The security detection method based on the Industrial Internet of Things can be performed by an electronic device with data processing capabilities. The electronic device can be configured as a security detection device based on the Industrial Internet of Things. Figure 1 , the security detection method based on industrial Internet of Things may include the following steps:

[0032] Step S1: Acquire various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient of each access flow data.

[0033] It should be noted that the steps for anomaly detection using the COF (Connectivity-Based Outlier Factor) algorithm are generally as follows:

[0034] Collect target datasets;

[0035] Calculate k nearest neighbors: For each data point, calculate its distance to other data points and select k nearest neighbors;

[0036] Calculate local density: Based on k-nearest neighbors, calculate the local density of each data point, that is, the sum of the distances between the point and its neighboring points;

[0037] Calculate connectivity: For each point, calculate its connectivity, which is defined as the sum of the local density of the point and its neighboring points. The higher the connectivity, the more important the point is in the local space.

[0038] Calculate the COF value: Use the connectivity of each point to calculate the COF value, where the COF value reflects the ratio between the local density of a point and the local density of its neighbors. Points with lower COF values ​​are considered potential outliers. Set a threshold and mark anomalies: Based on the calculated COF value, set a threshold and mark points with COF values ​​lower than the threshold as anomalies.

[0039] Among them, this embodiment improves the step of calculating the distance between each data point and other data points in the COF anomaly detection algorithm.

[0040] During the specific implementation, multiple types of access traffic data are obtained from the industrial Internet of Things system over a preset time period. The multiple types of access traffic data can include traffic data, number of IP connections, IP address, data transmission volume, access frequency, etc. It should be noted that each IP corresponds to multiple types of access traffic data, and different IPs correspond to the same number of types of access traffic data. It is understood that this embodiment performs anomaly detection on multiple IPs based on the multiple types of access traffic data corresponding to each IP.

[0041] Furthermore, the dimensions of various access traffic data are unified to eliminate the impact of different dimensions.

[0042] Furthermore, a preset distance formula is set, wherein the preset distance formula is a multidimensional Euclidean distance formula, the initial weight coefficient of each access traffic data is the weight of the preset distance formula, and the preset distance formula can be used to characterize the differences in each access traffic data corresponding to different IPs.

[0043] Specifically, taking 4 types of access traffic data as an example, we use the set {X x}、{Y y}、{Z z}、{P p} means that, taking the gth IP and the hth IP as an example, the distance between the gth IP and the hth IP can be calculated using the following preset distance formula (4):

[0044]

[0045] Where: Xg, X h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {X x}, Y g 、Y h They represent the access traffic data {Yy} and Z corresponding to the g-th IP and h-th IP respectively. g 、Z h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {Z z}, P g 、P h Respectively represent the access traffic data corresponding to the g-th IP and the h-th IP {P p}, c, d, e, f represent the access traffic data {X x}、{Y y}、{Z z}、{P p} corresponds to the initial weight coefficient.

[0046] According to the multi-dimensional Euclidean distance formula, the initial weight coefficients of each access traffic data are equal and are all 1. This embodiment improves the initial weight coefficients of each access traffic data based on the correlation of different access traffic data.

[0047] Step S2: calculating the correlation between each access traffic data and each other access traffic data respectively, and determining a first adjustment factor for each access traffic data based on the multiple correlations of each access traffic data.

[0048] Step S3: adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

[0049] It should be noted that the COF anomaly detection algorithm typically uses an initial weight of 1 for each item when performing distance measurement, which fails to reflect the correlation between multiple access traffic data. This application uses the COF anomaly detection algorithm to identify anomalous IP addresses based on multiple access traffic data. Because there are correlations between multiple access traffic data, different coefficients can be assigned to different access traffic data to adjust their importance in distance calculations based on the correlations between the multiple access traffic data.

[0050] Based on this, the embodiment of the present application uses the correlation between different access traffic data to obtain the first adjustment factor of each access traffic data, and then uses the first adjustment factor of each access traffic data to improve the initial weight coefficient of the access traffic data to obtain an improved weight coefficient. It can be understood that the improved weight coefficient is a further improvement of the pre-set initial weight coefficient, highlighting the correlation between different access traffic data, so as to enhance or weaken the influence of different access traffic data on the distance measurement based on the correlation between different access traffic data, thereby improving the recognition accuracy when using the COF anomaly detection algorithm to identify abnormal IPs.

[0051] In a specific implementation, the correlation between each access traffic data item and each other access traffic data item among the multiple access traffic data items is calculated. The correlation degree can be used to characterize the linear relationship between the two access traffic items. For example, the Pearson correlation coefficient can be used to calculate the correlation degree between two access traffic items. The correlation degree can be a positive value, indicating a positive correlation between the two access traffic items; a negative value, indicating a negative correlation between the two access traffic items; or a zero value, indicating no linear relationship between the two access traffic items.

[0052] In one embodiment, in step S2, the correlation degree is a positive value, a negative value, or 0, and determining the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data may specifically include:

[0053] S21. Based on the relationship between the number of positive values, negative values, and zero in the multiple correlation levels corresponding to the access traffic data, the multiple access traffic data are divided into data to be enhanced, data to be weakened, and independent data;

[0054] S22. For any data to be enhanced, calculate the number of positive values ​​in the correlation degree, and determine a first adjustment factor for the data to be enhanced based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree;

[0055] S23. For any data to be weakened, calculate the number of negative values ​​in the correlation degree, and determine a first adjustment factor for the data to be weakened based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree;

[0056] S24. Preset the first adjustment factor of the independent data to 1.

[0057] It should be noted that since the correlation degrees between different access traffic data may be different, each access traffic data may be positively correlated with other access traffic data, may be negatively correlated, or may have no linear relationship. Therefore, the multiple correlation degrees between each access traffic data and other access traffic data include at least any one of positive values, negative values ​​and 0. The access traffic data can be divided into data to be enhanced, data to be weakened and independent data according to the difference in the number of positive values, negative values ​​and 0 in the multiple correlation degrees.

[0058] In one embodiment, in step S21, dividing the various access traffic data into data to be enhanced, data to be weakened, and independent data may specifically include:

[0059] S211, calculating the number of positive values, negative values, and 0s in multiple correlation levels of each access traffic data;

[0060] S212: If the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, classify the access traffic data as data to be enhanced;

[0061] S213: If the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is classified as data to be weakened;

[0062] S214: If the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0063] In a specific implementation process, the number of positive values, the number of negative values, and the number of 0 in multiple correlation levels of each access traffic data are calculated.

[0064] Furthermore, for any access traffic data, when the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; when the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; when the number of 0 in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0065] It should be noted that when a certain access traffic data item is selected for enhancement, it indicates that the access traffic data item is positively correlated with other traffic data items. In this case, the initial weight coefficient of the access traffic data item needs to be increased to enhance the sensitivity of anomaly detection. When the correlation degree of a certain access traffic data item is positive and the value is large, it indicates that the access traffic data item is highly correlated with other access traffic data items and is of high importance. Therefore, the initial weight coefficient of the access traffic data item needs to be increased significantly to enhance its influence on the distance metric.

[0066] In a specific implementation process, for any data to be enhanced, the number of positive values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be enhanced is determined based on multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree.

[0067] Specifically, taking the i-th type of data to be enhanced as an example, the following formula (1) can be used to determine the first adjustment factor τ of the i-th type of data to be enhanced: i :

[0068]

[0069] Where r ia Indicates the correlation degree of the a-th positive value of the i-th type of data to be enhanced, ω ia Indicates the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, A i represents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0070] Since the greater the correlation between different access traffic data, the stronger the correlation between them, in order to make the first adjustment factor more representative of the strength of the correlation between different traffic data and to increase the difference between larger and smaller correlations, this embodiment multiplies each correlation by a weighting coefficient, with the weighting coefficient corresponding to each correlation being equal to the correlation. For example, if one correlation is 0.9 and another is 0.2, the difference between the two correlations is 0.7. Furthermore, by multiplying each correlation by a weighting coefficient, if one correlation is 0.9, the corresponding weighting coefficient is also 0.9, and the product of the correlation and the weighting coefficient is 0.81; if another correlation is 0.2, the corresponding weighting coefficient is also 0.2, and the product of the correlation and the weighting coefficient is 0.04, the difference between the products of the two correlations and the weighting coefficients is 0.77. Consequently, the result obtained by multiplying the correlations by their corresponding weighting coefficients increases the difference between larger and smaller correlations, thereby more easily representing the specific numerical values ​​of the correlations.

[0071] It should be noted that if a certain data to be enhanced is positively correlated with the other six access traffic data, and the correlation degrees are 0.1, 0.2, 0.3, 0.4, 0.2, and 0.3, respectively; at the same time, if another data to be enhanced is positively correlated with the other three access traffic data, and the correlation degrees are 0.9, 0.8, and 0.7, respectively. Although the number of positive correlations between the second data to be enhanced and the other access traffic data is smaller than that of the first data to be enhanced, the correlation degrees between the second data to be enhanced and the other access traffic data are both greater, that is, the correlation is stronger. Therefore, compared with the number of positive numbers in the correlation degree, the specific value of the correlation degree can better highlight the correlation between different access traffic data. Therefore, this exemplary embodiment sets the sum of the first preset coefficient α and the second preset coefficient β to 1, and α is greater than β, α can be 0.7, and β can be 0.3.

[0072] Furthermore, for any data to be weakened, the number of negative values ​​in the correlation degree is calculated, and a first adjustment factor of the data to be weakened is determined based on multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree.

[0073] Specifically, taking the jth type of data to be attenuated as an example, the following formula (5) can be used to determine the first adjustment factor τ of the jth type of data to be attenuated: j :

[0074]

[0075] Where r jb Indicates the correlation degree of the bth negative value of the jth type of data to be weakened, ω ja Indicates the weighted coefficient corresponding to the bth negative correlation degree of the jth type of data to be weakened, B j represents the number of negative values ​​in the correlation degree of the j-th type of data to be weakened, α represents the first preset coefficient, and β represents the second preset coefficient.

[0076] It should be further explained that when the number of 0s contained in the multiple correlation degrees of a certain access traffic data is large, it means that there is no linear relationship between the access traffic data and other traffic data, that is, the access traffic data is an independent factor. At this time, the initial weight coefficient of the access traffic data is not adjusted, and the impact of the access traffic data on anomaly detection can be maintained.

[0077] In a specific implementation process, the first adjustment factor of the independent data is preset to 1.

[0078] Furthermore, the initial weight coefficient of each access traffic data is adjusted based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

[0079] Specifically, taking the nth type of access traffic data as an example, the following formula (2) can be used to adjust the initial weight coefficient of the nth type of access traffic data to obtain the improved weight coefficient of the nth type of access traffic data:

[0080]

[0081] Where, τ n Represents the first adjustment factor of the nth type of access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of access traffic data.

[0082] Step S4: determining abnormal IP addresses based on the multiple access traffic data, the improved weight coefficients of the respective access traffic data, and the preset distance formula.

[0083] Step S5: Perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0084] In the specific implementation process, firstly, multiple access traffic data and the improved weight coefficient of each access traffic data are substituted into the preset distance formula, and then the abnormal IP is determined using the COF anomaly detection algorithm based on the preset distance formula after the substitution value.

[0085] Furthermore, a risk assessment is conducted on the abnormal IPs obtained to confirm whether they have malicious activities or potential attacks, and appropriate response measures are taken based on the assessment results, such as restricting or blocking access to suspicious IPs, to complete the security detection of the industrial Internet of Things system.

[0086] In this exemplary embodiment, since the first adjustment factor characterizes the degree of correlation between different access traffic data, on this basis, the initial weight coefficient of each access traffic data is adjusted by using the first adjustment factor to obtain an improved weight coefficient. In this way, the improved weight coefficient is used to determine the abnormal IP, and the recognition accuracy is increased.

[0087] Based on the above embodiments, Figure 2 This is a flow chart of a security detection method based on the Industrial Internet of Things according to another embodiment of the present application. Figure 2 Based on Figure 1 The corresponding preferred embodiment of the security detection method based on the industrial Internet of Things is shown in FIG. Figure 2 , the security detection method based on industrial Internet of Things may include the following steps:

[0088] S1. Obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient for each access flow data;

[0089] S2. Calculate the correlation between each access traffic data and each other access traffic data, and determine a first adjustment factor for each access traffic data based on multiple correlations of each access traffic data;

[0090] S3. Calculate the impact factor of each access traffic data, and determine the second adjustment factor of each access traffic data based on the impact factor of each access traffic data;

[0091] S4, adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data;

[0092] S5. Determine abnormal IP addresses based on multiple access traffic data, improved weight coefficients of each access traffic data, and the preset distance formula;

[0093] S6. Perform security detection of the industrial Internet of Things system based on the abnormal IP.

[0094] In step S3, a random forest algorithm can be used to calculate the impact factor of each access traffic data set. The impact factor of each access traffic data set is the feature importance of each access traffic data set for IP anomaly detection using the random forest algorithm. The impact factors of all access traffic data sets are normalized, and the normalized impact factors of each access traffic data set serve as the second adjustment factor for each access traffic data set.

[0095] In one embodiment, in step S4, taking the nth type of access traffic data as an example, the initial weight coefficient of the nth type of access traffic data can be adjusted using the following formula (3) based on the first adjustment factor and the second adjustment factor of the nth type of access traffic data to obtain an improved weight coefficient of the nth type of access traffic data:

[0096]

[0097] Where, Represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth type of access traffic data, δ n represents the initial weight coefficient of the nth type of access traffic data, N represents the number of access traffic data, ζ n Indicates the second adjustment factor of the nth type of access traffic data.

[0098] In this exemplary embodiment, a second adjustment factor is added on the basis of the above embodiment. The second adjustment factor can characterize the degree of influence of each access traffic data on the abnormal IP. The improved weight coefficient is obtained by adjusting the initial weight coefficient of each access traffic data using the first adjustment factor and the second adjustment factor. Not only the correlation of different access traffic data but also the degree of influence of each access traffic data on the abnormal IP is considered. In this way, the improved weight coefficient is used to determine the abnormal IP, the recognition accuracy is increased, and the risk of misjudgment is reduced.

[0099] Based on the above embodiments, Figure 3 This is a structural block diagram of a safety detection device based on the industrial Internet of Things according to an embodiment of the present application, such as Figure 3 As shown, the security detection device based on the industrial Internet of Things may include: a data acquisition module 210, a first adjustment factor calculation module 220, a weight improvement module 230, an abnormal IP acquisition module 240, and a security detection module 250, wherein:

[0100] The data acquisition module 210 is used to obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient for each access flow data;

[0101] The first adjustment factor calculation module 220 is used to respectively calculate the correlation degree of each access traffic data with each other access traffic data, and determine the first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data;

[0102] The weight improvement module 230 is used to adjust the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data;

[0103] The abnormal IP acquisition module 240 is used to determine abnormal IP based on multiple access flow data, the improved weight coefficient of each access flow data and the preset distance formula;

[0104] The security detection module 250 is used to perform security detection of the industrial Internet of Things system based on abnormal IP.

[0105] In an exemplary embodiment, the correlation degree in the first adjustment factor calculation module 220 is a positive value, a negative value or 0. The first adjustment factor calculation module 220 can also be used to divide multiple access traffic data into data to be enhanced, data to be weakened and independent data based on the quantitative relationship between positive values, negative values ​​and 0 in multiple correlation degrees corresponding to each of the access traffic data; for any data to be enhanced, the number of positive values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be enhanced is determined based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees; for any data to be weakened, the number of negative values ​​in the correlation degree is calculated, and the first adjustment factor of the data to be weakened is determined based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degrees; the first adjustment factor of the independent data is preset to 1.

[0106] In an exemplary embodiment, the first adjustment factor calculation module 220 can also be used to calculate the number of positive values, negative values ​​and 0s in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; if the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0107] In an exemplary embodiment, the first adjustment factor calculation module 220 can also be used to calculate the number of positive values, negative values ​​and 0s in multiple correlation degrees of each access traffic data; if the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is divided into data to be enhanced; if the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is divided into data to be weakened; if the number of 0s in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data.

[0108] In an exemplary embodiment, the first adjustment factor calculation module 220 uses the following formula (1) to determine the first adjustment factor of the data to be enhanced:

[0109]

[0110] Where, τ i represents the first adjustment factor of the i-th type of data to be enhanced, r ia Indicates the correlation degree of the a-th positive value of the i-th type of data to be enhanced, ω ia Indicates the weighted coefficient corresponding to the a-th positive correlation degree of the i-th type of data to be enhanced, A irepresents the number of positive values ​​in the correlation degree of the i-th type of data to be enhanced, α represents the first preset coefficient, and β represents the second preset coefficient.

[0111] In an exemplary embodiment, the weight improvement module 230 uses the following formula (2) to adjust the initial weight coefficient of each access traffic data to obtain an improved weight coefficient of each access traffic data:

[0112]

[0113] Where, Represents the improved weight coefficient of the nth access traffic data, τ n Represents the first adjustment factor of the nth type of access traffic data, δ n It represents the initial weight coefficient of the nth type of access traffic data, and N represents the number of types of access traffic data.

[0114] The security detection device based on the industrial Internet of Things also includes a second adjustment factor acquisition module, which is used to calculate the impact factor of each access flow data and determine the second adjustment factor of each access flow data based on the impact factor of each access flow data.

[0115] Those skilled in the art should understand that the division of the various modules in the embodiment is merely a division of logical functions, and in actual application, they can be fully or partially integrated into one or more actual carriers, and these modules can all be implemented in the form of software called through a processing unit, or all in the form of hardware, or in the form of a combination of software and hardware. It should be noted that the modules in a security detection device based on the industrial Internet of Things in this embodiment correspond one-to-one to the steps in a security detection method based on the industrial Internet of Things in the aforementioned embodiment. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned security detection method based on the industrial Internet of Things, and will not be repeated here.

[0116] Based on the above embodiments, Figure 4 FIG. 1 is a structural diagram of a safety detection device based on the industrial Internet of Things according to an embodiment of the present application, such as Figure 4As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 may call logic instructions in the memory 330 to execute a security detection method based on the industrial Internet of Things, the method comprising: obtaining multiple access flow data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient for each access flow data; calculating the degree of correlation between each access flow data and each other access flow data, and determining a first adjustment factor for each access flow data based on the multiple correlation degrees of each access flow data; adjusting the initial weight coefficient of each access flow data based on the first adjustment factor of each access flow data to obtain an improved weight coefficient for each access flow data; determining an abnormal IP based on the multiple access flow data, the improved weight coefficient of each access flow data, and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0117] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] On the basis of the above embodiments, on the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security detection method based on the industrial Internet of Things provided by the above methods, which includes: obtaining multiple access traffic data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access traffic data; respectively calculating the correlation degree between each access traffic data and each other access traffic data, and determining a first adjustment factor for each access traffic data based on multiple correlation degrees of each access traffic data; adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient for each access traffic data; determining an abnormal IP based on multiple access traffic data, the improved weight coefficient of each access traffic data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0119] On the basis of the above embodiments, on another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the security detection method based on the industrial Internet of Things provided by the above methods, the method comprising: obtaining a plurality of access traffic data of the industrial Internet of Things system and setting a preset distance formula and an initial weight coefficient of each access traffic data; respectively calculating the degree of correlation between each access traffic data and each other access traffic data, and determining a first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data; adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data; determining an abnormal IP based on a plurality of access traffic data, the improved weight coefficient of each access traffic data and the preset distance formula; and performing security detection of the industrial Internet of Things system based on the abnormal IP.

[0120] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A security detection method based on industrial Internet of Things, characterized in that: include: Obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and initial weight coefficient for each access flow data; respectively calculating the correlation degree of each access traffic data with each other access traffic data, and determining a first adjustment factor of each access traffic data based on multiple correlation degrees of each access traffic data; Adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data; Determine abnormal IP based on multiple access traffic data, improved weight coefficients of each access traffic data and the preset distance formula; Perform security detection of the industrial Internet of Things system based on the abnormal IP; The correlation degree is a positive value, a negative value, or 0; and determining the first adjustment factor of each access traffic data based on the multiple correlation degrees of each access traffic data includes: Calculate the number of positive values, negative values, and 0 in multiple correlation levels of each access traffic data; If the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is classified as data to be enhanced; If the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is classified as data to be weakened; If the number of 0s in the correlation degree of access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data; For any data to be enhanced, calculating the number of positive values ​​in the correlation degree, and determining a first adjustment factor of the data to be enhanced based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree; For any data to be weakened, calculating the number of negative values ​​in the correlation degree, and determining a first adjustment factor of the data to be weakened based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree; The first adjustment factor of the preset independent data is 1; The determining of a first adjustment factor of the data to be enhanced based on a plurality of correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degrees includes: The first adjustment factor of the data to be enhanced is determined using the following formula (1): Where, Indicates the The first adjustment factor of the data to be enhanced, Indicates the The first type of data to be enhanced A positive correlation degree is Indicates the The first type of data to be enhanced The weighted coefficient corresponding to the positive correlation degree is, Indicates the The number of positive values ​​in the correlation degree of the data to be enhanced, represents the first preset coefficient, represents the second preset coefficient; The determining of the first adjustment factor of the data to be weakened based on the multiple correlation levels of the data to be weakened and the number of negative values ​​in the correlation levels includes: The first adjustment factor of the data to be attenuated is determined using the following formula (5): Where, Indicates the The first adjustment factor of the data to be attenuated, Indicates the The first type of data to be weakened A negative correlation degree, Indicates the The first type of data to be weakened The weighted coefficient corresponding to the negative correlation degree is, Indicates the The number of negative values ​​in the correlation degree of the data to be weakened, represents the first preset coefficient, Indicates the second preset coefficient.

2. The security detection method based on the industrial Internet of Things according to claim 1, characterized in that: The step of adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: Based on the first adjustment factor of each access traffic data, the initial weight coefficient of each access traffic data is adjusted using the following formula (2) to obtain the improved weight coefficient of each access traffic data: Where, Indicates the An improved weight coefficient for access traffic data, Indicates the The first adjustment factor for access traffic data, Indicates the The initial weight coefficient of access traffic data, Indicates the number of types of access traffic data.

3. The security detection method based on industrial Internet of Things according to claim 1, characterized in that: Before adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data, the method further includes: Calculating the impact factor of each access traffic data, and determining the second adjustment factor of each access traffic data based on the impact factor of each access traffic data; The step of adjusting the initial weight coefficient of each access traffic data based on the first adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: The initial weight coefficient of each access traffic data is adjusted based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data.

4. The security detection method based on industrial Internet of Things according to claim 3, characterized in that: The adjusting of the initial weight coefficient of each access traffic data based on the first adjustment factor and the second adjustment factor of each access traffic data to obtain the improved weight coefficient of each access traffic data includes: Based on the first adjustment factor and the second adjustment factor of each access traffic data, the initial weight coefficient of each access traffic data is adjusted using the following formula (3) to obtain the improved weight coefficient of each access traffic data: Where, Indicates the An improved weight coefficient for access traffic data, Indicates the The first adjustment factor for access traffic data, Indicates the The initial weight coefficient of access traffic data, Indicates the number of access traffic data. Indicates the A second adjustment factor for access traffic data.

5. A safety detection device based on industrial Internet of Things, characterized in that: include: A data acquisition module is used to obtain various access flow data of the industrial Internet of Things system and set a preset distance formula and an initial weight coefficient for each access flow data; a first adjustment factor calculation module, configured to respectively calculate a correlation degree between each access traffic data and each other access traffic data, and determine a first adjustment factor for each access traffic data based on a plurality of correlation degrees of each access traffic data, wherein the correlation degree is a positive value, a negative value, or 0; a weight improvement module, configured to adjust an initial weight coefficient of each access traffic data based on a first adjustment factor of each access traffic data to obtain an improved weight coefficient of each access traffic data; An abnormal IP acquisition module is used to determine abnormal IPs using the COF anomaly detection algorithm based on multiple access flow data, an improved weight coefficient of each access flow data, and the preset distance formula; Security detection module, used to perform security detection of industrial Internet of Things systems based on abnormal IP addresses; The first adjustment factor calculation module is further used to calculate the number of positive values, negative values ​​and 0s in multiple correlation levels of each access flow data; If the number of positive values ​​in the correlation degree of the access traffic data is greater than or equal to the number of negative values ​​and greater than or equal to 0, the access traffic data is classified as data to be enhanced; If the number of negative values ​​in the correlation degree of the access traffic data is greater than the number of positive values ​​and greater than 0, the access traffic data is classified as data to be weakened; If the number of 0s in the correlation degree of access traffic data is greater than the number of positive values ​​and greater than the number of negative values, the access traffic data is divided into independent data; For any data to be enhanced, calculating the number of positive values ​​in the correlation degree, and determining a first adjustment factor of the data to be enhanced based on the multiple correlation degrees of the data to be enhanced and the number of positive values ​​in the correlation degree; For any data to be weakened, calculating the number of negative values ​​in the correlation degree, and determining a first adjustment factor of the data to be weakened based on the multiple correlation degrees of the data to be weakened and the number of negative values ​​in the correlation degree; The first adjustment factor of the preset independent data is 1; The first adjustment factor calculation module uses the following formula (1) to determine the first adjustment factor of the data to be enhanced: Where, Indicates the The first adjustment factor of the data to be enhanced, Indicates the The first type of data to be enhanced A positive correlation degree is Indicates the The first type of data to be enhanced The weighted coefficient corresponding to the positive correlation degree is, Indicates the The number of positive values ​​in the correlation degree of the data to be enhanced, represents the first preset coefficient, represents the second preset coefficient; The first adjustment factor calculation module uses the following formula (5) to determine the first adjustment factor of the data to be attenuated: Where, Indicates the The first adjustment factor of the data to be attenuated, Indicates the The first type of data to be weakened A negative correlation degree, Indicates the The first type of data to be weakened The weighted coefficient corresponding to the negative correlation degree is, Indicates the The number of negative values ​​in the correlation degree of the data to be weakened, represents the first preset coefficient, Indicates the second preset coefficient.

6. A safety detection device based on industrial Internet of Things, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the industrial Internet of Things-based security detection method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the security detection method based on the industrial Internet of Things according to any one of claims 1 to 4 is implemented.

Images