Secure access method, terminal and system for AI industrial Internet of Things platform

Abstract

The invention relates to the technical field of digital information transmission, in particular to a secure access method, terminal and system for an AI industrial Internet of Things platform, and the method comprises the steps: obtaining a plurality of current instruction sequences and historical operation data output by a user on the AI industrial Internet of Things platform, and carrying out the secure access of the AI industrial Internet of Things platform according to the current instruction sequences and the historical operation data; the behavior anomaly degree of each current instruction sequence, the operation inertia influence degree of each current instruction sequence and the anomaly risk coefficient of each current instruction sequence are determined, and a user anomaly state value is determined according to multiple layers of verification factors such as the behavior anomaly degree, the operation inertia influence degree and the anomaly risk coefficient; the verification safety can be improved; according to the abnormal state value of the user, the access of the user to the AI industrial Internet of Things platform is controlled, so that the safe access of the AI industrial Internet of Things platform is ensured.

Description

Technical Field

[0001] The present invention relates to the field of digital information transmission technology, and in particular to a method, terminal and system for secure access to an AI industrial Internet of Things platform. Background Art

[0002] Currently, the Industrial Internet of Things platform integrates advanced AI technology and powerful Internet of Things infrastructure to achieve intelligent interconnection and efficient collaboration between devices, providing enterprises with real-time data analysis and decision-making support, greatly improving production efficiency and reducing operating costs; at the same time, it enhances production safety and reliability, making the industrial production process more intelligent and automated, bringing enterprises unprecedented competitive advantages and development opportunities.

[0003] At present, the identity authentication mechanism for secure access of early-deployed industrial Internet of Things platforms often uses simple usernames and passwords, making them vulnerable to brute force cracking and phishing attacks, and security verification faces certain challenges. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a method, terminal and system for secure access to an AI industrial Internet of Things platform. The technical solutions adopted are as follows: In a first aspect, an embodiment of the present application provides a method for secure access to an AI industrial Internet of Things platform, including: Obtain several current instruction sequences and historical operation data output by users on the AI ​​Industrial Internet of Things platform; According to the current instruction sequence and the historical operation data, respectively determine the behavior abnormality degree of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence; Determining a user abnormal state value according to the abnormal behavior degree, the operation inertia influence degree and the abnormal risk coefficient; According to the abnormal status value of the user, the access of the user to the AI ​​industrial Internet of Things platform is controlled.

[0005] In one embodiment, determining the behavior abnormality of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Determine a first instruction sequence from the current instruction sequence, and construct a first instruction group using any two instructions in the first instruction sequence to obtain a plurality of first instruction groups; Determine, based on the historical operation data, an average of a first position distance between two instructions in each of the first instruction groups that appear in a corresponding historical instruction sequence, and determine a second position distance between two instructions in each of the first instruction groups that appear in the first instruction sequence; Determine a first ratio of the second position distance to an average of the first position distance and a first difference between a preset value and the first ratio; Determine the degree of synergy between two instructions in each of the first instruction groups, and respectively calculate a first product of the degree of synergy corresponding to each of the first instruction groups and the absolute value of the first difference; A sum is taken according to the first product and the number of the first instruction groups, and the behavioral abnormality degree of the first instruction sequence is obtained according to the summation result and a normalization function, and the step of determining the first instruction sequence from the current instruction sequence is returned until the behavioral abnormality degree of each of the current instruction sequences is determined.

[0006] In one embodiment, determining the degree of synergy between two instructions in each of the first instruction groups includes: Determine that in each of the first instruction groups, two instructions appear at a first position and a second position of the first instruction sequence respectively, and determine a Pearson correlation coefficient between the first position and the second position; The frequency of occurrence of any instruction of each of the first instruction groups in the first instruction sequence is determined, and the degree of synergy between two of the instructions in each of the first instruction groups is obtained according to the product of the Pearson correlation coefficient and the frequency.

[0007] In one embodiment, determining the degree of influence of the operation inertia of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Determine a second instruction sequence from the current instruction sequence, divide the second instruction sequence into a preset number of sequence segments, divide the first two sequence segments that are ranked first into a module, add a sequence segment that is ranked after the module to the module according to the ranking to obtain a new module, and return to the step of adding a sequence segment that is ranked after the module to the module according to the ranking according to the new module, until the last sequence segment ranked is added to obtain a plurality of modules; Determine the target synergy degree between the last sequence segment and the remaining sequence segments in each of the modules, construct a two-dimensional curve according to the target synergy degree, and determine the integral of the first-order derivative of the two-dimensional curve; Determine the second difference of the integrals of each adjacent module respectively, calculate the arithmetic mean according to the absolute value of the second difference and the number of the modules and perform normalization processing to obtain the degree of influence of the operational inertia of the second instruction sequence, and return to the step of determining the second instruction sequence from the current instruction sequence until the degree of influence of the operational inertia of each of the current instruction sequences is determined.

[0008] In one embodiment, determining the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Splitting the historical operation data to determine a plurality of historical instruction sequences, and semantically vectorizing the historical instruction sequences to obtain a plurality of corresponding first vector sequences; Clustering the first vector sequence to determine operation intentions corresponding to different categories; respectively determining a second vector sequence of each current instruction sequence and a Euclidean distance between each second vector sequence and the operation intention, and determining a minimum target Euclidean distance corresponding to each second vector sequence; Determining the degree of sudden change of each current instruction sequence according to the operation intentions corresponding to different categories and the historical instruction sequence; A second ratio of the sudden change degree to the corresponding target Euclidean distance is determined respectively, and an abnormal risk coefficient of each current instruction sequence is determined based on the second ratio and a normalization function.

[0009] In one embodiment, determining the degree of sudden change of each current instruction sequence according to the operation intentions corresponding to different categories and the historical instruction sequence includes: Determine the occurrence frequency of each first vector sequence in the historical operation data, and assign different amplitudes to the first vector sequences according to different occurrence frequencies; According to different occurrence frequencies, split the second vector sequence of each current instruction sequence into a plurality of sub-sequence vectors, and match the sub-sequence vectors with the first vector sequence to determine a target amplitude corresponding to each sub-sequence vector; The amplitude mean of each of the current instruction sequences is calculated according to the target amplitude, and the mean absolute error is calculated according to the amplitude mean and the target amplitude to obtain the degree of sudden change of each of the current instruction sequences.

[0010] In one implementation, determining the user abnormal state value according to the behavior abnormality, the operation inertia influence degree, and the abnormal risk coefficient includes: respectively determining the product of the abnormal risk coefficient and the behavior abnormality degree of each current instruction sequence, and determining a third ratio of the product to the corresponding operation inertia influence degree; An arithmetic mean is calculated according to each of the third ratios and the number of the current instruction sequence to obtain a user abnormal state value.

[0011] In one implementation, controlling the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal status value includes: When the abnormal state value of the user is greater than the interception probability threshold, the user is prohibited from accessing the AI ​​industrial Internet of Things platform; Among them, the interception probability threshold is calculated based on the abnormal behavior interception probability of the AI ​​industrial Internet of Things platform in the last preset number of days.

[0012] In a second aspect, an embodiment of the present application provides an AI industrial Internet of Things platform security access system, including: The acquisition module is used to obtain several current instruction sequences and historical operation data output by the user on the AI ​​Industrial Internet of Things platform; A first determination module is used to determine the behavior abnormality of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data; A second determination module is used to determine the user abnormal state value according to the abnormal behavior degree, the operation inertia influence degree and the abnormal risk coefficient; A control module is used to control the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal state value.

[0013] In a third aspect, an embodiment of the present application provides a terminal, comprising: a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement a method in any one of the above-mentioned embodiments.

[0014] The present invention has the following beneficial effects: By obtaining several current instruction sequences and historical operation data output by the user on the AI ​​Industrial Internet of Things platform, the behavioral abnormality of each current instruction sequence, the degree of influence of the operating inertia of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence are determined respectively according to the current instruction sequence and the historical operation data. According to multiple layers of verification factors such as the degree of behavioral abnormality, the degree of influence of the operating inertia, and the abnormal risk coefficient, the user's abnormal state value is determined, which is conducive to improving the verification security; according to the user's abnormal state value, the user's access to the AI ​​Industrial Internet of Things platform is controlled, which is conducive to ensuring the safe access to the AI ​​Industrial Internet of Things platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A schematic diagram of the steps of a method for securely accessing an AI industrial Internet of Things platform provided by an embodiment of the present invention; Figure 2 A schematic diagram of a multi-layer verification provided by an embodiment of the present invention; Figure 3 A structural block diagram of a secure access system for an AI industrial Internet of Things platform provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the AI ​​industrial Internet of Things platform security access method, terminal and system proposed by the present invention, its specific implementation method, structure, features and effects in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0018] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0019] It should be noted that the term “exemplary” in the embodiments of the present application refers to examples listed for the convenience of explanation, and other embodiments are not limited to the examples listed.

[0020] The following is a detailed description of a method, terminal and system for secure access to an AI industrial Internet of Things platform provided by the present invention in conjunction with the accompanying drawings.

[0021] See also Figure 1 , which shows a flow chart of a secure access method for an AI industrial Internet of Things platform provided by an embodiment of the present invention. The secure access method for an AI industrial Internet of Things platform may at least include steps S100-S400: S100. Obtain several current instruction sequences and historical operation data output by the user on the AI ​​industrial Internet of Things platform.

[0022] S200, determining the behavior abnormality of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data.

[0023] S300: Determine the user abnormal state value according to the abnormal behavior degree, the influence degree of operation inertia and the abnormal risk coefficient.

[0024] S400. Control the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal status value.

[0025] The technical solution of the embodiment of the present application obtains several current instruction sequences and historical operation data output by the user on the AI ​​Industrial Internet of Things platform, and determines the behavioral abnormality of each current instruction sequence, the degree of influence of operation inertia of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data. According to multiple layers of verification factors such as the degree of behavioral abnormality, the degree of influence of operation inertia, and the abnormal risk coefficient, the user's abnormal state value is determined, which is conducive to improving the verification security; according to the user's abnormal state value, the user's access to the AI ​​Industrial Internet of Things platform is controlled, which is conducive to ensuring the safe access to the AI ​​Industrial Internet of Things platform.

[0026] In one embodiment, the data transmission system framework of the AI ​​industrial Internet of Things platform (referred to as the Internet of Things platform) is pre-configured. The Internet of Things platform mainly includes two modules: the user terminal and the device end. The central data processing platform between the user terminal and the device end includes an encryption verification module and a communication module, which are mainly responsible for the security verification and communication of the information interacting under the two ports. Among them, on the user terminal side, there are mainly user operation data with different operation permissions. The relevant instruction information issued by the user terminal is transmitted to the central processing platform, which is first identified by the encryption verification end and then transmitted to the communication layer, and then transmitted to the corresponding device by the communication layer; the user of the user terminal can select or enter an operation instruction to control the device end to perform a specific task. At the same time, the user can view the real-time data of the device end within the corresponding authority and collect information such as the status of the device end. In addition, the collected data of the device end is also sent to the central processing platform first, and the relevant instruction information for operating the device end is transmitted by the processing platform.

[0027] like Figure 2 As shown, in the embodiment of the present application, operations, data transmission, device interaction and other behaviors are verified in multiple dimensions and at multiple levels, so as to verify their security and compliance layer by layer. In the overall system architecture, a five-layer verification method is adopted for users / devices, including physical layer verification, network layer verification, behavior verification, transport layer verification and monitoring layer verification.

[0028] Specifically, when users and devices (i.e., user terminals and device terminals) access the AI ​​Industrial Internet of Things platform (hereinafter referred to as the Internet of Things platform), the physical layer of the access device is first verified at the physical layer to prevent illegal devices from entering the intranet or counterfeiting devices, and the verification is performed based on the device's own digital certificate. At the same time, the network layer verifies the network layer to ensure that the device and user access the system through legal channels, and uses multi-factor authentication or TLS / SSL certificates for communication authentication. After accessing the Internet of Things platform, in the process of overall information interaction, the transport layer encrypts the transmission information by combining AES and RSA through transport layer verification, and adds timestamps and sequence numbers to the data packets to prevent replay attacks and illegal data packet attacks. The operation information (such as each instruction) transmitted by the transport layer is recorded in the operation log each time, so the operation log contains the historical operation data of the user or device on the Internet of Things platform. The behavior verification of the behavior layer is to analyze the behavior of users and devices to ensure that the operation complies with the normal business process and prevent malicious operations and other behaviors; the monitoring layer check bit of the monitoring layer saves the relevant information generated by the above monitoring, and conducts a global assessment of the operating status of the entire system framework and the risks existing on each node to ensure the healthy operation of the entire system framework environment.

[0029] Optionally, in the data transmission system framework of the Internet of Things platform, the types of instructions usually involve equipment control, data collection, configuration management and other aspects. Therefore, different instructions have different degrees of impact on the system. Therefore, the impact of existing instructions is evaluated, and the proportion of personnel who can operate the corresponding instructions is obtained according to the authority allocation restrictions. The larger the proportion of personnel, the smaller the restrictions required for the corresponding operation, and the smaller the impact on the equipment. The frequency of use under different instructions is obtained. The lower the frequency of use, the higher the probability of abnormal behavior when the instruction appears.

[0030] It should be noted that in the current multi-layer verification design, the physical layer and the network layer can effectively intercept a large number of users who illegally access the device, but for users who bypass these two layers of verification, the system cannot completely prevent them from operating the device with instructions. These users who bypass the verification may enter abnormal instructions, which may have a greater verification impact on the device. For high-impact instructions, the system usually conducts strict review. However, continuous input of low-impact instructions will cause the device to gradually become abnormal during operation, and the intention identification of these low-impact operation instructions is more difficult, and they are easily ignored or misjudged, resulting in potential risks. At the same time, if an attacker bypasses the physical layer verification and the network layer verification by stealing an account or other means and then performs some abnormal attack operations on the device, during this operation, the current user's interactive behavior can be analyzed. Since each user will have his own operation bias during the operation, compared with different behavioral habits, the operation bias is some subtle operation bias in the potential operation process. Therefore, if the user's behavior habits suddenly change during the monitoring process, it is very likely that the account may be stolen.

[0031] In the embodiment of the present application, the historical operation data in the operation log can be analyzed, and the operation fingerprint of the single user can be extracted by mining the operation time, interactive device and instruction sequence of the single user in the instruction combination process. According to each instruction sequence of the single user, combined with the time and interactive device of the instruction, multi-dimensional interactive operation data is constructed, which is recorded as ,in Indicates the sequence number of the instruction. Indicates the operation behavior of the instruction sequence. Indicates the time of the operation. Indicates the object of interaction. For a single operation command issued by the current user, there are different correlation strengths, that is, some commands are usually output together with other commands. Therefore, the synergy between a single-numbered command and other commands can be analyzed based on the historical operation data of the user in the operation log.

[0032] In one embodiment, in step S100, after the user accesses the AI ​​Industrial Internet of Things platform, the user can operate on the user terminal, and the current instruction sequences output by the AI ​​Industrial Internet of Things platform can be obtained, and the historical operation data of the user in the AI ​​Industrial Internet of Things platform can be obtained from the operation log. The historical operation data may include several historical instruction sequences, and each historical instruction sequence may include several instructions.

[0033] In one embodiment, in step S200, the behavior abnormality of each current instruction sequence is determined according to the current instruction sequence and the historical operation data, including steps S201-S205: S201. Determine a first instruction sequence from a current instruction sequence, and construct a first instruction group from any two instructions in the first instruction sequence to obtain a plurality of first instruction groups.

[0034] Optionally, a first instruction sequence is determined from the current instruction sequence, for example, The current instruction sequence, =1, and construct a first instruction group by any two instructions in the first instruction sequence, and finally obtain several first instruction groups.

[0035] S202. Determine, based on historical operation data, an average of first position distances between two instructions in each first instruction group that appear in a corresponding historical instruction sequence, and determine a second position distance between two instructions in each first instruction group that appear in a first instruction sequence.

[0036] Optionally, based on historical operation data, determine the mean of the first position distance between two instructions in each first instruction group that appear in the corresponding historical instruction sequence. For example, there are two instructions A1 and A2, both appear in the corresponding historical instruction sequences B1 and B2. Instructions A1 and A2 appear in the historical instruction sequence B1 and their positions are separated by a first position distance L1. Instructions A1 and A2 appear in the historical instruction sequence B2 and their positions are separated by a first position distance L2. The mean of the first position distance is calculated based on L1 and L2, so the mean of the first position distance between the two instructions in each first instruction group that appear in the corresponding historical instruction sequence can be determined. Similarly, the second position distance between instructions A1 and A2 that appear in the first instruction sequence can be determined, thereby determining the second position distance between the two instructions in each first instruction group that appear in the first instruction sequence.

[0037] S203: Determine a first ratio of the second position distance to the average of the first position distance and a first difference between the preset value and the first ratio.

[0038] Optionally, taking the preset value as 1 as an example, a first ratio of the average of the second position distance and the first position distance is determined respectively. And the preset value 1 and the first ratio The first difference , Representative The first ratio of the second position distance corresponding to the first instruction group to the average of the first position distance, assuming that there are a total of The first instruction group.

[0039] S204 , determining the degree of synergy between two instructions in each first instruction group, and respectively calculating a first product of the degree of synergy corresponding to each first instruction group and the absolute value of the first difference.

[0040] It should be noted that for a single instruction in the current instruction sequence, if the instruction has strong synergistic behavior with other instructions, the instruction will first appear in a large number of instruction sequences of the current remaining instructions, and the position of the instruction in the corresponding instruction sequence will be affected by these other instructions.

[0041] Optionally, determining the degree of synergy between two instructions in each first instruction group includes: First, determine that in each first instruction group, two instructions appear in the first instruction sequence (for example, The current instruction sequence, =1) (In the first instruction sequence, one of the instructions is the first instruction sequence. instruction) and the second position (In the first instruction sequence, another instruction is the first instruction sequence. instruction), and determine the first position With the second position Pearson correlation coefficient .

[0042] Next, determine any instruction of each first instruction group (for example, Instructions or Instruction, the present application embodiment is based on instruction as an example), the frequency of occurrence in the first instruction sequence , respectively, according to the Pearson correlation coefficient and frequency The product of the two instructions in each first instruction group is obtained. , that is, The degree of synergy between two instructions in the first instruction group is expressed as: ; in, Indicates The degree of synergy between the two instructions corresponding to the first instruction group, Indicates The first instruction group corresponds to the The frequency of the instructions appearing in the first instruction sequence, and then the degree of coordination corresponding to each first instruction group is calculated respectively. The first difference The first product of the absolute values ​​of .

[0043] S205, summing the first product and the number of the first instruction groups, and obtaining the behavioral abnormality of the first instruction sequence according to the summation result and the normalization function, and returning to the step of determining the first instruction sequence from the current instruction sequence until the behavioral abnormality of each current instruction sequence is determined.

[0044] Optionally, according to the first product and the number of the first instruction group Sum and use the sum result and normalization function , the behavior abnormality of the first instruction sequence is obtained, the formula is: ; in, For the The abnormal behavior of the current instruction sequence, =1 represents the first instruction sequence, so the step of determining the first instruction sequence from the current instruction sequence is returned until the abnormality of the behavior of each current instruction sequence is determined. ,at this time Different values ​​represent different current instruction sequences. Indicates that The position deviation between the instructions included in the first instruction group and the historical operation data, Indicates that when a single When some highly coordinated instructions included in a first instruction group have a large deviation, it means that the behavior of the current instruction sequence is relatively abnormal.

[0045] It should be noted that during the user's operation, there may be deviations in the user's operating instruction intention due to non-subjective instruction errors. Therefore, in the process of abnormal user detection, such instructions need to be identified. When the user's instruction sequence is affected by the user's inertial operation mode, it is manifested as a high degree of coordination between two adjacent instruction segments in the instruction sequence. As the distance between the instruction segments increases, the degree of coordination between the two decreases, that is, the purpose of the initial operation instruction deviates as the instruction increases, and the subsequent operation has a strong coordination with the most recent previous operation.

[0046] In one embodiment, the step S200 determines the degree of influence of the operation inertia of each current instruction sequence according to the current instruction sequence and the historical operation data, including steps S211-S213: S211. Determine a second instruction sequence from the current instruction sequence, divide the second instruction sequence into a preset number of sequence segments, divide the first two sequence segments that are ranked first into a module, add a sequence segment that is arranged after the module to the module according to the ranking, and obtain a new module, and return to the step of adding a sequence segment that is arranged after the module to the module according to the ranking according to the new module, until the last sequence segment ranked is added to obtain a plurality of modules.

[0047] Optionally, a second instruction sequence is determined from the current instruction sequence. Similarly, for example, The current instruction sequence, =1, as the second instruction sequence, the second instruction sequence is divided into a preset number of sequence segments, for example, if the preset number of segments is 5, it is evenly divided into 5 sequence segments. Then, the first two sequence segments ranked at the top are divided into a module, and a sequence segment arranged after the module is added to the module according to the sorting to obtain a new module, for example, there are sequence segments 1, sequence segments 2, sequence segments 3, sequence segments 4, and sequence segments 5, and the first two sequence segments ranked at the top, i.e., sequence segments 1 and sequence segments 2, are divided into a module, recorded as module 1, and according to the new module, the step of adding a sequence segment arranged after the module to the module according to the sorting is returned until the last sequence segment ranked is added to obtain several modules, at which time, on the basis of module 1, a sequence segment arranged after the module is added according to the sorting. A sequence segment arranged after the module 1, namely, sequence segment 3, is added to the module 1 to obtain a new module 2 including sequence segment 1, sequence segment 2, and sequence segment 3. Then, based on the new module 2, a sequence segment arranged after the module 2, namely, sequence segment 4, is added to the module 2 to obtain a new module 3 including sequence segment 1, sequence segment 2, sequence segment 3, and sequence segment 4, until the new module 3 is added to the last sequence segment 5 to obtain a new module 4 including sequence segment 1, sequence segment 2, sequence segment 3, sequence segment 4, and sequence segment 5, and finally a plurality of modules are obtained, specifically 4 modules.

[0048] S212, determining the target synergy degree between the last sequence segment and the remaining sequence segments in each module, constructing a two-dimensional curve according to the target synergy degree, and determining the integral of the first-order derivative of the two-dimensional curve.

[0049] Optionally, the target synergy degree corresponding to the last sequence segment and the remaining sequence segments in each module is determined, and a two-dimensional curve is constructed according to the target synergy degree, and the integral of the first-order derivative of the two-dimensional curve is determined. , that is, The integral of the first-order derivative of the two-dimensional curve corresponding to each module.

[0050] The target synergy degree between the sequence segments can be obtained by calculating the synergy degree between the instructions contained in different sequence segments and then accumulating and averaging all synergy degrees. The synergy degree between the instructions refers to S204 and will not be described in detail.

[0051] S213. Determine the second difference of the integrals of each adjacent module respectively, calculate the arithmetic mean according to the absolute value of the second difference and the number of modules and perform normalization processing to obtain the degree of influence of the operational inertia of the second instruction sequence, and return to the step of determining the second instruction sequence from the current instruction sequence until the degree of influence of the operational inertia of each current instruction sequence is determined.

[0052] Optionally, the second difference of the integrals of each adjacent module is determined respectively , For the +1 module corresponds to the integral of the first derivative of the 2D curve and the second difference The absolute value of | And the number of modules Calculate the arithmetic mean and normalize according to the function After normalization, the influence degree of operation inertia of the second instruction sequence is obtained: ; in, Indicates The degree of influence of the operation inertia of the current instruction sequence. =1, represents the degree of influence of the operation inertia of the second instruction sequence; when the degree of influence of the operation inertia is greater, it means that the corresponding instruction of the user's operation is more affected by the user's inertia, and the possibility that the intention implied by the instruction is caused by the user's misoperation is higher, and the reference value of the corresponding instruction is lower.

[0053] Optionally, returning to the step of determining a second instruction sequence from the current instruction sequence until the degree of influence of the operation inertia of each current instruction sequence is determined. ,at this time Different values ​​represent different degrees of influence of the operation inertia of the current instruction sequence.

[0054] It should be noted that there are a variety of different levels of instructions in some operations of the user on the device, and different instructions have different degrees of adjustment on the device. When the user performs command operations on the device, there will be clear intentions for the issued command sequence, and different command sequences have different degrees of impact on the current device. In order to avoid system monitoring, attackers use low-impact command sequences. Some specific command combinations usually indicate high-risk operations or attack behaviors.

[0055] In one embodiment, in step S200, the abnormal risk coefficient of each current instruction sequence is determined according to the current instruction sequence and the historical operation data, including steps S221-S225: S221. Split the historical operation data to determine a number of historical instruction sequences, and semantically vectorize the historical instruction sequences to obtain a number of corresponding first vector sequences.

[0056] Optionally, the historical operation data is split to determine a number of historical instruction sequences, and the number of splits is determined based on actual conditions. In the embodiment of the present application, the individual instructions in each historical instruction sequence are numbered, and the historical instruction sequence is semantically vectorized, that is, BERT is used to convert the context information of the corresponding instruction in the historical instruction sequence into a semantic vector, and the semantic vector is recorded as Then, the semantic vector of each instruction is After concatenating them into a long vector and taking weighted average according to the influence of each semantic vector, a vector representing the corresponding historical instruction sequence is generated, namely the first vector sequence, denoted as It should be noted that the influence of each semantic vector can be normalized based on the derivative of the product of the authority ratio of the corresponding single instruction (i.e., the ratio of people who can enter the instruction to operate to the total number of people) and the usage frequency (the usage frequency of different instructions), as the influence of the semantic vector of a single instruction, denoted as .

[0057] S222: Cluster the first vector sequence to determine operation intentions corresponding to different categories.

[0058] Optionally, DBSCAN is used to cluster the first vector sequence, and a relationship modeling is constructed between the instruction sequences to obtain the operation intentions corresponding to different categories. Figure 1 、Operation intention Figure 2 Etc., each first vector sequence has a corresponding operation intention, ie, an operation behavior.

[0059] S223 , respectively determining the second vector sequence of each current instruction sequence and the Euclidean distance between each second vector sequence and the operation intention, and determining the minimum target Euclidean distance corresponding to each second vector sequence.

[0060] Optionally, the second vector sequence of each current instruction sequence is determined respectively (the determination method is the same as the principle of the first vector sequence, which will not be repeated here), and the Euclidean distance between each second vector sequence and the operation intention , that is, The Euclidean distance between the current instruction sequence and each operation intention, and determine the minimum target Euclidean distance corresponding to each second vector sequence .

[0061] S224. Determine the degree of sudden change of each current instruction sequence according to the operation intentions corresponding to different categories and the historical instruction sequences.

[0062] It should be noted that for some of the attacker's illegal operation instruction sequences, the match of the operation intentions matched by the instruction sequences is weak, and there are some sudden changes (the combination of instructions, target devices or operation intensity have changed dramatically, which may be the attacker's attempt to perform malicious operations).

[0063] First, the occurrence frequency of each first vector sequence in the historical operation data is determined, and then different amplitudes are assigned to the first vector sequence according to different occurrence frequencies. For example, a higher amplitude may be assigned to a higher frequency.

[0064] Secondly, according to different frequencies of occurrence, the second vector sequence of each current instruction sequence is split into multiple sub-sequence vectors. For example, according to the frequency of occurrence of the first vector sequence, the second vector sequence corresponding to the first vector sequence is split into sub-sequence vectors of the corresponding number of occurrence frequencies, and the sub-sequence vectors are matched with the first vector sequence to determine the target amplitude corresponding to each sub-sequence vector. For example, the amplitude of the first vector sequence with the highest matching degree (such as similarity) is used as the target amplitude corresponding to the corresponding sub-sequence vector , that is, The first instruction in the current instruction sequence The target magnitude of the subsequence vector.

[0065] Then, according to the target range , calculate the mean amplitude of each current instruction sequence , and respectively according to the amplitude mean and target range Mean absolute error The calculation of the sudden change degree of each current instruction sequence is obtained , that is, The degree of sudden change of the current instruction sequence, .

[0066] S225, respectively determine the degree of sudden change The Euclidean distance to the corresponding target The second ratio of , determine the abnormal risk factor of each current instruction sequence.

[0067] Specifically, the calculation formula of the abnormal risk coefficient is: ; in, For the The abnormal risk factor of the current instruction sequence, Indicates The abnormal risk level contained in the current instruction sequence. When the current instruction sequence of a single user has a large mutation rate and the matching degree between the current instruction sequence and the sequences in its environment is low, the current instruction sequence has a high risk of abnormality.

[0068] In one implementation, step S300 includes steps S301-S302: S301. Determine the product of the abnormal risk coefficient and the behavior abnormality degree of each current instruction sequence respectively, and determine a third ratio of the product to the corresponding operation inertia influence degree.

[0069] Optionally, determine the abnormal risk factor of each current instruction sequence separately and behavioral abnormality The product of , and determine the product and the corresponding degree of influence of operating inertia The third ratio .

[0070] S302: Based on the third ratios and the number of current instruction sequences , calculate the arithmetic mean and get the user abnormal status value.

[0071] Optionally, the user abnormal status value The calculation formula is: ; The embodiment of the present application comprehensively determines the abnormal user status value of the current user during the login process by evaluating the user's operation time, operation behavior, operation content, and operation intention in multiple dimensions.

[0072] In one embodiment, in step S400, when the user abnormal status value Greater than the interception probability threshold ', remotely close the user's connection channel to the AI ​​Industrial Internet of Things platform, prohibit the user from accessing the AI ​​Industrial Internet of Things platform, so as to better maintain the security of the Internet of Things platform and prevent abnormal users from accessing and attacking the Internet of Things platform and devices.

[0073] Optionally, the intercept probability threshold 'The interception probability of abnormal behavior based on the AI ​​industrial Internet of Things platform in the last preset number of days is calculated. The specific formula is: '= ; For example, the preset number of days is 3, and the total number of abnormal interceptions at the physical layer, network layer, and transport layer in the last 3 days is counted, and then the total number of abnormal interceptions is divided by the total number of monitoring to obtain the interception probability. , so the interception probability threshold can be determined based on the above formula '.

[0074] The embodiment of the present application constructs a multi-layer verification mode to improve security, and uses the user's current instruction sequence for verification and evaluation. Specifically, by extracting and analyzing the user's historical operation data and the current instruction sequence, the deviation of the degree of coordination can be determined, and finally the degree of behavioral abnormality of the current instruction sequence, the degree of influence of the operation inertia of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence can be determined. Among them, the degree of influence of the operation inertia can prevent the user's unconscious habitual instructions from causing deviations from the intention of its instruction sequence. Through the semantic vectorization of the instruction sequence, the operation intention can be identified to determine the abnormal risk coefficient. Based on the degree of behavioral abnormality, the degree of influence of the operation inertia, and the abnormal risk coefficient, the user's abnormal state value is comprehensively determined, thereby achieving accurate abnormal screening and ensuring the safe access of the AI ​​industrial Internet of Things platform.

[0075] Reference Figure 3 , shows a structural block diagram of an AI industrial Internet of Things platform security access system according to an embodiment of the present application, which may include: The acquisition module is used to obtain several current instruction sequences and historical operation data output by the user on the AI ​​Industrial Internet of Things platform; A first determination module is used to determine the behavior abnormality of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data; The second determination module is used to determine the user abnormal state value according to the abnormal behavior degree, the influence degree of operation inertia and the abnormal risk coefficient; The control module is used to control the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal status value.

[0076] In the embodiment of the present application, the functions of each module in the system can be found in the corresponding description in the above method and will not be repeated here.

[0077] In an embodiment of the present application, a terminal is also provided, including: a processor and a memory, the memory stores instructions, and the instructions are loaded and executed by the processor to implement the above-mentioned method of secure access to the AI ​​industrial Internet of Things platform.

[0078] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0079] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A secure access method for an AI industrial Internet of Things platform, characterized in that: The method comprises: Obtain several current instruction sequences and historical operation data output by users on the AI ​​Industrial Internet of Things platform; According to the current instruction sequence and the historical operation data, respectively determine the behavior abnormality degree of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence; Determining a user abnormal state value according to the abnormal behavior degree, the influence degree of the operation inertia, and the abnormal risk coefficient; According to the abnormal status value of the user, the access of the user to the AI ​​industrial Internet of Things platform is controlled.

2. The AI ​​industrial Internet of Things platform secure access method according to claim 1 is characterized by: Determining the behavior abnormality of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Determine a first instruction sequence from the current instruction sequence, and construct a first instruction group using any two instructions in the first instruction sequence to obtain a plurality of first instruction groups; Determine, based on the historical operation data, an average of a first position distance between two instructions in each of the first instruction groups that appear in a corresponding historical instruction sequence, and determine a second position distance between two instructions in each of the first instruction groups that appear in the first instruction sequence; Determine a first ratio of the second position distance to an average of the first position distance and a first difference between a preset value and the first ratio; Determine the degree of synergy between two instructions in each of the first instruction groups, and respectively calculate a first product of the degree of synergy corresponding to each of the first instruction groups and the absolute value of the first difference; A sum is taken according to the first product and the number of the first instruction groups, and the behavioral abnormality degree of the first instruction sequence is obtained according to the summation result and a normalization function, and the step of determining the first instruction sequence from the current instruction sequence is returned until the behavioral abnormality degree of each of the current instruction sequences is determined.

3. The AI ​​industrial Internet of Things platform secure access method according to claim 2 is characterized by: Determining the degree of synergy between two instructions in each of the first instruction groups includes: Determine that in each of the first instruction groups, two instructions appear at a first position and a second position of the first instruction sequence, respectively, and determine a Pearson correlation coefficient between the first position and the second position; The frequency of occurrence of any instruction of each of the first instruction groups in the first instruction sequence is determined, and the degree of synergy between two of the instructions in each of the first instruction groups is obtained according to the product of the Pearson correlation coefficient and the frequency.

4. The AI ​​industrial Internet of Things platform secure access method according to claim 1 is characterized by: Determining the degree of influence of the operation inertia of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Determine a second instruction sequence from the current instruction sequence, divide the second instruction sequence into a preset number of sequence segments, divide the first two sequence segments that are ranked first into a module, add a sequence segment that is ranked after the module to the module according to the ranking to obtain a new module, and return to the step of adding a sequence segment that is ranked after the module to the module according to the ranking according to the new module, until the last sequence segment ranked is added to obtain a plurality of modules; Determine the target synergy degree between the last sequence segment and the remaining sequence segments in each of the modules, construct a two-dimensional curve according to the target synergy degree, and determine the integral of the first-order derivative of the two-dimensional curve; Determine the second difference of the integrals of each adjacent module respectively, calculate the arithmetic mean according to the absolute value of the second difference and the number of the modules and perform normalization processing to obtain the degree of influence of the operational inertia of the second instruction sequence, and return to the step of determining the second instruction sequence from the current instruction sequence until the degree of influence of the operational inertia of each of the current instruction sequences is determined.

5. The AI ​​industrial Internet of Things platform secure access method according to claim 1 is characterized by: Determining the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data includes: Splitting the historical operation data to determine a plurality of historical instruction sequences, and semantically vectorizing the historical instruction sequences to obtain a plurality of corresponding first vector sequences; Clustering the first vector sequence to determine operation intentions corresponding to different categories; respectively determining a second vector sequence of each current instruction sequence and a Euclidean distance between each second vector sequence and the operation intention, and determining a minimum target Euclidean distance corresponding to each second vector sequence; Determining the degree of sudden change of each current instruction sequence according to the operation intentions corresponding to different categories and the historical instruction sequences; A second ratio of the sudden change degree to the corresponding target Euclidean distance is determined respectively, and an abnormal risk coefficient of each current instruction sequence is determined based on the second ratio and a normalization function.

6. The AI ​​Industrial Internet of Things platform secure access method according to claim 5 is characterized by: Determining the degree of sudden change of each current instruction sequence according to the operation intentions corresponding to different categories and the historical instruction sequence includes: determining the occurrence frequency of each first vector sequence in the historical operation data, and assigning different amplitudes to the first vector sequences according to different occurrence frequencies; According to different occurrence frequencies, split the second vector sequence of each current instruction sequence into a plurality of sub-sequence vectors, and match the sub-sequence vectors with the first vector sequence to determine a target amplitude corresponding to each sub-sequence vector; The amplitude mean of each of the current instruction sequences is calculated according to the target amplitude, and the mean absolute error is calculated according to the amplitude mean and the target amplitude to obtain the degree of sudden change of each of the current instruction sequences.

7. The AI ​​Industrial Internet of Things platform secure access method according to claim 1 is characterized by: The determining of the user abnormal state value according to the abnormal behavior degree, the operation inertia influence degree and the abnormal risk coefficient includes: respectively determining the product of the abnormal risk coefficient and the behavior abnormality degree of each current instruction sequence, and determining a third ratio of the product to the corresponding operation inertia influence degree; An arithmetic mean is calculated according to each of the third ratios and the number of the current instruction sequence to obtain a user abnormal state value.

8. The AI ​​Industrial Internet of Things platform secure access method according to claim 1 is characterized by: The controlling the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal state value includes: When the abnormal state value of the user is greater than the interception probability threshold, the user is prohibited from accessing the AI ​​industrial Internet of Things platform; Among them, the interception probability threshold is calculated based on the abnormal behavior interception probability of the AI ​​industrial Internet of Things platform in the last preset number of days.

9. An AI industrial Internet of Things platform security access system, characterized in that: include: The acquisition module is used to obtain several current instruction sequences and historical operation data output by the user on the AI ​​Industrial Internet of Things platform; A first determination module is used to determine the behavior abnormality degree of each current instruction sequence, the operation inertia influence degree of each current instruction sequence, and the abnormal risk coefficient of each current instruction sequence according to the current instruction sequence and the historical operation data; A second determination module is used to determine the user abnormal state value according to the abnormal behavior degree, the operation inertia influence degree and the abnormal risk coefficient; A control module is used to control the user's access to the AI ​​industrial Internet of Things platform according to the user's abnormal state value.

10. A terminal, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 8.

Images