Network security defense method and system for industrial environment

Abstract

The invention relates to the technical field of industrial communication security, and discloses a network security defense method and system for an industrial environment, and the method comprises the steps: obtaining the access information and network information of a to-be-accessed device; and determining the authority level of the access information according to the access operation and the to-be-accessed data. And initializing the access authority of the to-be-accessed device, and adjusting the access authority of the to-be-accessed device according to the network information. And verifying the access permission according to the permission level of the access information, and determining whether to allow the to-be-accessed device to execute the access information or not according to a verification result. Wherein if the to-be-accessed device is allowed to execute the access information, real-time network data of the to-be-accessed device is acquired, and whether the access operation of the to-be-accessed device is interrupted or not is determined according to the real-time network data. According to the invention, through dynamic evaluation and real-time monitoring of the equipment access authority, refined access control is realized, and the security, stability and intelligent protection capability of industrial communication under limited conditions are improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial communication security technology, and in particular to a network security defense method and system for an industrial environment. Background Art

[0002] With the rapid development of the Industrial Internet of Things, more and more devices and network connections are being added to industrial environments, and network security issues are becoming more complex and severe. Especially in key areas such as manufacturing and energy, the security of industrial control systems is directly related to production efficiency, data security and even public safety.

[0003] At present, traditional network security protection mainly focuses on external threats, but there are still large loopholes when dealing with malicious or abnormal behavior of equipment in industrial environments. Due to the wide variety of equipment in industrial systems, dynamic behavior changes and limited resources, traditional protection methods based on fixed access control and firewall policies are difficult to effectively deal with complex equipment behaviors and changing network environments. For example, when network traffic is abnormal, devices frequently reconnect or establish connections with suspicious IPs, traditional mechanisms are often difficult to detect and respond in a timely manner, resulting in potential security risks that exist for a long time and may even be exploited by malicious attackers to infiltrate the system and interfere with production processes.

[0004] Therefore, how to dynamically adjust access rights and operating behaviors based on real-time equipment and network information has become a key technical direction for improving industrial security protection capabilities. Summary of the invention

[0005] In view of this, the present invention proposes a network security defense method and system for industrial environments, aiming to solve the problem that traditional network security protection mechanisms are difficult to effectively deal with the dynamic behavior and abnormal operation of equipment in industrial environments, resulting in internal security risks being difficult to detect and prevent in a timely manner.

[0006] The present invention proposes a network security defense method for an industrial environment, comprising:

[0007] Obtain access information and network information of the device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication equipment, and network behavior data;

[0008] Determine the permission level for accessing information based on the access operation and the data to be accessed;

[0009] Initialize access rights of the device to be accessed, and adjust access rights of the device to be accessed according to network information;

[0010] Verify the access rights according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result;

[0011] If the device to be accessed is allowed to execute the access information, the real-time network data of the device to be accessed is obtained, and according to the real-time network data, it is determined whether to interrupt the access operation of the device to be accessed.

[0012] Further, the access authority is verified according to the permission level of the access information, and according to the verification result, it is determined whether to allow the device to be accessed to execute the access information, including:

[0013] When the permission level of the access information is greater than the access permission level, it is determined that the verification has failed, and the device to be accessed is not allowed to execute the access information;

[0014] When the permission level of the access information is less than or equal to the access permission level, it is determined that the verification is successful, and the device to be accessed is allowed to execute the access information.

[0015] Furthermore, when determining the permission level for accessing information according to the access operation and the data to be accessed, it includes:

[0016] Get each data byte in the data to be accessed, and determine the sensitivity score of the data to be accessed based on each data byte:

[0017] ;

[0018] Where T is the sensitivity score of the data to be accessed, S(di) is the sensitivity score of the di-th single byte, W(di) is the weight of the di-th data byte, f(di) is the data pattern confidence of the di-th data byte, and n is the total number of data bytes;

[0019] The permission level for accessing the information is determined based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score.

[0020] Furthermore, when obtaining the sensitivity score of the data byte, it includes:

[0021] S(di)=z1·C+z2·b+z3·V;

[0022] Among them, C is the character category of the data byte, b is the encryption level of the data character, V is the context relevance of the data character, z1, z2 and z3 are weight coefficients, and z1, z2 and z3 are not zero.

[0023] Furthermore, when determining the permission level for accessing information based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score, it includes:

[0024] Obtain the configured first preset sensitivity score and second preset sensitivity score, and determine the initial permission level for accessing the information according to the relationship between the sensitivity score of the data to be accessed and the first preset sensitivity score and the second preset sensitivity score:

[0025] When the sensitivity score is lower than the first preset sensitivity score, the initial permission level for accessing the information is determined to be a low level;

[0026] When the sensitivity score is higher than or equal to the first preset sensitivity score, and the sensitivity score is lower than the first preset sensitivity score, the initial permission level for accessing the information is determined to be a medium level;

[0027] When the sensitivity score is higher than or equal to the second preset sensitivity score, the initial permission level for accessing the information is determined to be a high level;

[0028] Among them, the first preset sensitivity score is lower than the second preset sensitivity score, and the initial permission levels are arranged from large to small as high level, medium level and low level.

[0029] Furthermore, when determining the initial permission level for accessing information, it includes:

[0030] Matching an access operation with a configured preset operation method, wherein the access operation includes data transmission and control signals;

[0031] Obtain the preset operation plan that matches the access operation and the corresponding operation permission level;

[0032] Determine the permission level for accessing information based on the relationship between the operation permission level and the initial permission level:

[0033] When the operation authority level is greater than the initial authority level, the operation authority level is determined as the authority level for accessing information;

[0034] When the operation authority level is less than or equal to the initial authority level, the initial authority level is determined as the authority level for accessing the information.

[0035] Further, initializing the access rights of the device to be accessed and adjusting the access rights of the device to be accessed according to the network information includes:

[0036] Based on the network behavior, determine the risk score of the network behavior of the device to be accessed:

[0037] ;

[0038] Among them, Rs is the network behavior risk score, Fi is the ith network behavior, and the network behavior includes abnormal data traffic, connection to suspicious IP, and frequent reconnection. αi is the weight coefficient of the ith network behavior. is the adjustment function of the ith network behavior, β is the global adjustment coefficient of the environmental threat impact, Ej is the jth environmental threat behavior, γj is the weight coefficient of the jth environmental threat behavior, Nt is the total number of communication sessions of the device to be accessed, is the smoothing parameter, n is the total number of network behaviors, and m is the total number of environmental threat behaviors;

[0039] Adjust access permissions for devices to be accessed based on network behavior risk scores, network location, and communication patterns.

[0040] Furthermore, based on the network behavior risk score, network location, and communication mode, the access rights of the device to be accessed are adjusted, including:

[0041] Pre-configure a preset risk score, and obtain the score difference between the network behavior risk score and the preset risk score;

[0042] Determining an adjustment level when adjusting the access rights of the device to be accessed according to a relationship between the score difference and a pre-configured first preset score difference and a second preset score difference;

[0043] When the score difference is lower than the first preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 0, and the operation permission of the device to be accessed is a low level;

[0044] When the score difference is higher than or equal to the first preset score difference, and the score difference is lower than the second preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 1 level, and the access permission of the device to be accessed is medium level;

[0045] When the score difference is higher than or equal to the second preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 2 levels, and the access permission of the device to be accessed is a high level;

[0046] Among them, the first preset score difference is smaller than the second preset score difference.

[0047] Further, when determining the adjustment level of the access authority of the device to be accessed according to the relationship between the score difference and the pre-configured first preset score difference and second preset score difference, it includes:

[0048] Determine whether the adjustment operation when adjusting the access rights of the device to be accessed is effective based on the network location and communication mode and the pre-configured preset network location and preset communication mode:

[0049] When the network location is consistent with the preset network location, and the communication mode is consistent with the preset communication mode, it is determined that the adjustment operation of the access permission of the device to be accessed is valid, and the access permission of the device to be accessed is adjusted according to the adjustment level;

[0050] When the network location is inconsistent with the preset network location, and / or the communication mode is inconsistent with the preset communication mode, it is determined that the adjustment operation for adjusting the access rights of the device to be accessed is invalid, and the access rights of the device to be accessed are not adjusted.

[0051] Further, when determining whether to interrupt the access operation of the device to be accessed according to the real-time network data, it includes:

[0052] Determine whether to interrupt access to the device to be accessed based on the relationship between the data traffic in the real-time network data and the historical data traffic:

[0053] When the data flow is lower than or equal to the historical data flow, it is determined not to interrupt the access operation of the device to be accessed;

[0054] When the data flow is higher than the historical data flow, the access operation of the device to be accessed is interrupted.

[0055] Compared with the prior art, the beneficial effect of the present invention is that the dynamic management of device access rights is realized through the comprehensive analysis of access information and network information. Traditional network security protection strategies usually rely on fixed access control rules and firewall strategies, which are difficult to adapt to the diversity of devices in industrial environments and the dynamic changes of network behaviors. However, this method can accurately identify the access requirements and network behaviors of devices by obtaining key information such as access operations, data to be accessed, network locations, and communication devices, and provide a more comprehensive basis for subsequent permission management. Secondly, by adopting a permission level division mechanism, the accuracy and security of access control are ensured. There may be differences in the operating permissions of different devices. For example, the access permissions of ordinary sensors and core control devices should be strictly distinguished. By dividing the access information into permission levels, this method can effectively verify permissions before access, avoid unauthorized access behaviors, and thus reduce potential security risks. Finally, by introducing a dynamic adjustment mechanism based on real-time network data, the ability to identify and respond to abnormal behaviors is enhanced. In traditional protection mechanisms, once access permissions are granted, they are often not adjusted with changes in the network environment, which easily leads to attackers using the obtained permissions for further penetration. This method can continuously obtain the real-time network data of the device during the access process, monitor its communication behavior, dynamically adjust access rights according to abnormal situations, and even interrupt suspicious operations when necessary, further improving the security and response capabilities of network security defense.

[0056] On the other hand, the present application also provides a network security defense system for an industrial environment, comprising:

[0057] An acquisition module is configured to acquire access information and network information of a device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication device, and network behavior data;

[0058] A permission analysis module is electrically connected to the acquisition module, and is configured to determine the permission level of the access information according to the access operation and the data to be accessed; the permission analysis module is also configured to initialize the access permission of the device to be accessed, and adjust the access permission of the device to be accessed according to the network information;

[0059] The central control module is electrically connected to the acquisition module and the permission analysis module respectively. The central control module is configured to verify the access permission according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result; wherein, if the device to be accessed is allowed to execute the access information, the central control module obtains the real-time network data of the device to be accessed, and determines whether to interrupt the access operation of the device to be accessed according to the real-time network data.

[0060] It can be understood that the network security defense method and system for an industrial environment in the above-mentioned embodiments of the present invention have the same beneficial effects and will not be described in detail. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0062] Figure 1 A flowchart of a network security defense method for an industrial environment provided by an embodiment of the present invention;

[0063] Figure 2 A functional block diagram of a network security defense system for an industrial environment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features described in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0065] like Figure 1 As shown, in some embodiments of the present application, this embodiment provides a network security defense method for an industrial environment, including:

[0066] Step S100: Obtain access information and network information of the device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication equipment, and network behavior data.

[0067] Step S200: Determine the permission level of access information according to the access operation and the data to be accessed.

[0068] Specifically, when determining the permission level of access information according to the access operation and the data to be accessed, it includes: obtaining each data byte in the data to be accessed, and determining the sensitivity score of the data to be accessed according to each data byte:

[0069] .

[0070] Where T is the sensitivity score of the data to be accessed, S(di) is the sensitivity score of the d-th single byte, W(di) is the weight of the d-th data byte, f(di) is the data pattern confidence of the d-th data byte, and n is the total number of data bytes. The permission level for accessing information is determined based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score.

[0071] Specifically, when obtaining the sensitivity score of the data byte, it includes S(di)=z1·C+z2·b+z3·V. Among them, C is the character category of the data byte, b is the encryption level of the data character, V is the context relevance of the data character, z1, z2 and z3 are weight coefficients, and z1, z2 and z3 are not zero.

[0072] Specifically, when determining the permission level for access information based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score, it includes: obtaining the configured first preset sensitivity score and the second preset sensitivity score, and determining the initial permission level for access information based on the relationship between the sensitivity score of the data to be accessed and the first preset sensitivity score and the second preset sensitivity score: when the sensitivity score is lower than the first preset sensitivity score, the initial permission level for access information is determined to be a low level. When the sensitivity score is higher than or equal to the first preset sensitivity score, and the sensitivity score is lower than the first preset sensitivity score, the initial permission level for access information is determined to be a medium level. When the sensitivity score is higher than or equal to the second preset sensitivity score, the initial permission level for access information is determined to be a high level. Among them, the first preset sensitivity score is lower than the second preset sensitivity score, and the initial permission levels are sorted from large to small as high level, medium level and low level.

[0073] It can be understood that the sensitivity of data is evaluated by analyzing the byte-level sensitivity score of the data to be accessed. The sensitivity score of each data byte is determined by the character category, encryption level and context relevance, and is weighted by the weight coefficient. The character category is used to distinguish between ordinary data and sensitive information (such as ID card number, bank card number, etc.), the encryption level reflects the protection strength of the data, and the context relevance measures the degree of relevance between data and sensitive information, thereby achieving a more accurate sensitivity assessment. Secondly, by introducing the data pattern confidence, it is used to calculate the overall sensitivity score of the data to be accessed. The data pattern confidence measures the degree of match between the data and the known sensitive data pattern, while the weight W(di) is used to distinguish the importance of the data in different scenarios. For example, the user identifier in the log may be more important than ordinary text information, so it is given a higher weight. Subsequently, the sensitivity scores of all bytes are adjusted by weight and confidence to form an overall data sensitivity score. The permission level is divided by presetting the sensitivity score threshold. The first preset sensitivity score and the second preset sensitivity score are configured as a reference benchmark for dividing permissions. When the data sensitivity score is lower than the first threshold, the access permission is set to a low level; when it is between the two thresholds, it is set to a medium level; and when it is higher than the second threshold, it is set to a high level. This division makes permission management more refined, and access permissions can be dynamically adjusted according to different data types and scenarios, reducing unnecessary access restrictions while ensuring strict control of highly sensitive data. Finally, by adopting a dynamic permission adjustment mechanism, access permissions can be optimized according to real-time conditions. Because different environments and data flows may cause changes in data sensitivity, real-time network behavior will be continuously evaluated during data access to determine whether permissions need to be adjusted. For example, when a device accesses highly sensitive data, access restrictions may be increased or even interrupted to prevent potential malicious behavior.

[0074] Specifically, when determining the initial permission level for access information, it includes: matching the access operation with the configured preset operation method, wherein the access operation includes data transmission and control signals. Obtaining the preset operation scheme that matches the access operation and the corresponding operation permission level. Determine the permission level for access information based on the relationship between the operation permission level and the initial permission level: when the operation permission level is greater than the initial permission level, the operation permission level is determined to be the permission level for access information. When the operation permission level is less than or equal to the initial permission level, the initial permission level is determined to be the permission level for access information.

[0075] It can be understood that the sensitivity of the data to be accessed is evaluated by calculating the sensitivity score at the data byte level. The sensitivity score of each data byte is determined by the character category, encryption level and context relevance, and is weighted by the weight coefficient. The character category is used to distinguish between ordinary data and sensitive data, the encryption level measures the protection strength of the data, and the context relevance evaluates the degree of association between the data and sensitive information. Finally, by accumulating the sensitivity scores of all data bytes, the sensitivity score of the overall data is calculated to provide a basis for permission management. Secondly, the initial permission level is divided based on the preset sensitivity score threshold. The first preset sensitivity score and the second preset sensitivity score are configured as the permission division standard to ensure that data of different levels are subject to appropriate access control. When the data sensitivity score is lower than the first preset value, the permission level is low; when it is between the first and second preset values, the permission level is medium; when it is higher than the second preset value, the permission level is high. This classification strategy can effectively distinguish low-sensitivity data (such as ordinary logs) from high-sensitivity data (such as encryption keys or user credentials), thereby preventing unauthorized access. Third, by introducing an access operation matching mechanism, permission management is further optimized. After determining the initial permission level, the access operations (such as data transmission, control signals, etc.) are analyzed and matched with the preset operation plan. Each access operation corresponds to a different operation permission level. For example, ordinary data query may belong to low-privilege operation, while key control instructions may belong to high-privilege operation. This matching mechanism ensures that different types of access operations are appropriately restricted to prevent the abuse of highly sensitive data. Finally, the final permission level is determined through a dynamic permission adjustment mechanism. Specifically, when the operation permission level is higher than the initial permission level, the operation permission level is used as the final permission level to ensure that high-privilege operations can cover low-privilege data access requirements; when the operation permission level is less than or equal to the initial permission level, the initial permission level is maintained to ensure that data access is not over-authorized. This mechanism combines data sensitivity and access operation type to ensure that permission management is both rigorous and flexible, and can adapt to the changing security needs in industrial environments.

[0076] It can be seen that the division of permissions by data byte-level sensitivity scoring is more accurate than the traditional static permission allocation method. By scoring the sensitivity of each data byte and combining factors such as character category, encryption level and context relevance, the actual sensitivity of the data can be more comprehensively evaluated. This refined analysis method ensures that different types of data can be reasonably classified when accessed, avoids excessive restrictions on low-sensitivity data, and strengthens the protection of highly sensitive data. Secondly, through the dynamic access control mechanism, the permission level can be flexibly adjusted according to the sensitivity of the data and the type of access operation. The access rights are not only affected by the sensitivity score of the data itself, but also dynamically matched in combination with the access operation, making the adjustment of the permission level more reasonable. For example, for the same data, different access operations (such as query vs. modification) may have different security risks, so different security control strategies can be provided for different access methods, thereby achieving more accurate permission management. Third, by setting the first preset sensitivity score and the second preset sensitivity score, potential high-risk access requests can be identified in time when accessing the data, and the permission control level can be automatically increased to prevent unauthorized access or malicious operations. This security mechanism helps to reduce the possibility of sensitive data leakage and enhance the security protection capabilities of industrial control systems. Fourth, due to the wide variety of devices and complex behavior patterns in industrial control networks, traditional security mechanisms based on static policies are often difficult to adapt to security requirements in different environments. This method can combine real-time data analysis with permission adjustment strategies to dynamically allocate permissions for different devices, data types, and access behaviors, ensuring that it can effectively protect against security risks without affecting normal production operations. Finally, traditional permission management relies on manually set rules and is difficult to respond quickly to emerging security risks. This method automatically calculates permission levels based on data features and access operations, which can achieve more efficient autonomous security management. This feature is particularly important for the Industrial Internet of Things (IIoT) environment, and can provide stronger security protection for scenarios such as smart manufacturing and remote operation and maintenance.

[0077] Step S300: Initialize access rights of the device to be accessed, and adjust the access rights of the device to be accessed according to network information.

[0078] Specifically, initializing the access rights of the device to be accessed and adjusting the access rights of the device to be accessed according to the network information includes: determining the risk score of the network behavior of the device to be accessed according to the network behavior:

[0079] .

[0080] Among them, Rs is the network behavior risk score, Fi is the ith network behavior, and the network behavior includes abnormal data traffic, connection to suspicious IP, and frequent reconnection. αi is the weight coefficient of the ith network behavior. is the adjustment function of the ith network behavior, β is the global adjustment coefficient of the environmental threat impact, Ej is the jth environmental threat behavior, γj is the weight coefficient of the jth environmental threat behavior, Nt is the total number of communication sessions of the device to be accessed, is a smoothing parameter, n is the total number of network behaviors, and m is the total number of environmental threat behaviors. The access rights of the accessed device are adjusted according to the network behavior risk score, network location, and communication mode.

[0081] Specifically, when adjusting the access rights of the device to be accessed according to the network behavior risk score, the network location and the communication mode, it includes: pre-configuring a preset risk score, and obtaining the score difference between the network behavior risk score and the preset risk score. According to the relationship between the score difference and the pre-configured first preset score difference and the second preset score difference, the adjustment level when the access rights of the device to be accessed are adjusted is determined. When the score difference is lower than the first preset score difference, the adjustment level when the access rights of the device to be accessed are determined to be 0 levels, and the operation authority of the device to be accessed is low. When the score difference is higher than or equal to the first preset score difference, and the score difference is lower than the second preset score difference, the adjustment level when the access rights of the device to be accessed are determined to be 1 level, and the access rights of the device to be accessed are medium. When the score difference is higher than or equal to the second preset score difference, the adjustment level when the access rights of the device to be accessed are determined to be 2 levels, and the access rights of the device to be accessed are high. Among them, the first preset score difference is less than the second preset score difference.

[0082] Specifically, when determining the adjustment level when adjusting the access rights of the device to be accessed based on the relationship between the score difference and the pre-configured first preset score difference and the second preset score difference, it includes: determining whether the adjustment operation when adjusting the access rights of the device to be accessed is valid based on the network location and communication mode and the pre-configured preset network location and preset communication mode: when the network location is consistent with the preset network location, and the communication mode is consistent with the preset communication mode, it is determined that the adjustment operation when adjusting the access rights of the device to be accessed is valid, and the access rights of the device to be accessed are adjusted according to the adjustment level. When the network location is inconsistent with the preset network location, and / or the communication mode is inconsistent with the preset communication mode, it is determined that the adjustment operation when adjusting the access rights of the device to be accessed is invalid, and the access rights of the device to be accessed are not adjusted.

[0083] It is understandable that the network behavior risk score (Rs) is calculated through network behavior analysis as a core indicator to measure the potential security risks of the device to be accessed. By analyzing behaviors such as abnormal data traffic, connection to suspicious IP, frequent reconnection, etc., combined with the weight of each behavior, environmental threat factors and global adjustment coefficient, a comprehensive risk score is calculated. This scoring mechanism can quantify the impact of different network behaviors on device security and provide data support for the dynamic adjustment of subsequent access rights. Secondly, the score difference calculation is used as the basis for adjusting access rights. By presetting a baseline risk score and calculating the difference between the network behavior risk score of the device to be accessed and the baseline value, the level of access right adjustment is determined. Specifically, if the score difference is low, it indicates that the device network behavior is relatively normal and the access right is maintained at a low level; if the score difference is high, it indicates that the device may have potential security risks, and its access right will be adjusted to a higher security level to limit the device's operating permissions. This access right adjustment method based on score difference enables adaptive adjustment of security policies rather than relying solely on fixed rules, which improves the flexibility of security protection. Third, the accuracy of access right adjustment is further enhanced through the network location and communication mode verification mechanism. Access rights adjustment is performed only when the current network location and communication mode of the device are consistent with the preset security location and mode. This location and communication mode matching mechanism can effectively prevent misadjustment. For example, some devices may trigger an increase in risk scores due to cross-segment migration and normal operation and maintenance activities, but they do not actually pose a security threat. In this case, the mechanism ensures that only truly abnormal devices will have their access rights adjusted to avoid misjudgment affecting normal production. Fourth, access rights adjustment uses a hierarchical strategy to divide different adjustment levels according to the range of score differences. By setting the first preset score difference and the second preset score difference, access rights adjustment can be divided into low, medium and high levels to ensure that the change of device permissions is gradual rather than sudden. For example, when the score difference is small, the device permissions may only be restricted to some key operations, while when the score difference is high, the device may be completely blocked from accessing sensitive resources. This hierarchical adjustment mechanism can both reduce the risk of misblocking and ensure that access to high-risk devices is strictly controlled. Finally, by combining environmental threat factors and dynamic weight adjustment, the intelligence level of the overall security strategy is improved. Environmental threat factors (Ej), such as network attack events and device abnormal events, will have an additional impact on the network behavior risk score (Rs), and the score will be dynamically adjusted through the global adjustment coefficient (β). This means that in specific environments (such as attack peaks or abnormal traffic surges), the sensitivity can be automatically increased and access rights can be more strictly controlled, while in a safe environment, restrictions can be appropriately relaxed. This environmental perception capability makes it possible to adapt to complex security requirements in industrial environments, thereby providing more effective access control strategies.

[0084] It can be seen that the risk level of the device is assessed by the network behavior risk score (Rs), and combined with the network location and communication mode matching mechanism, it is ensured that only devices that really pose a security threat will have their access rights adjusted. This access control mechanism based on quantitative scoring and multi-dimensional verification makes the permission adjustment more accurate and avoids the situation where false blocking or excessive permission opening may be caused by relying solely on fixed rules. Secondly, by evaluating network behavior (such as connecting to suspicious IPs, abnormal data traffic, frequent reconnection, etc.) and environmental threat factors (Ej), this method can timely discover potential security risks and automatically adjust access rights according to the score difference. When the risk score of a device is high, its access rights will be restricted to a higher security level to prevent high-risk devices from accessing sensitive resources, thereby reducing the possibility of potential attacks and data leaks. At the same time, the hierarchical adjustment strategy based on the score difference ensures that the change in access rights is gradual rather than sudden. For example: when the device behavior is slightly abnormal but does not reach a serious threat, its access rights are only partially restricted; when its risk score continues to rise, its rights are further restricted or even completely blocked. This dynamic adjustment mechanism enables real-time adaptation to changes in the security status of the device, rather than adopting a fixed static access control strategy, which is more in line with actual application needs. In addition, the network behavior risk score is adjusted by the global adjustment coefficient (β) of the environmental threat impact, so that access rights can be adaptively adjusted in different network security environments. For example, in a high-threat environment (such as when under a network attack), access rights will be more strictly managed, while in a low-risk environment, restrictions can be appropriately relaxed. This environmental adaptability enables the method to operate efficiently under different network conditions, enhancing the practicality of the access control strategy. Finally, by verifying whether the network location and communication mode of the device match the preset rules. Only when both meet the security requirements will the permission adjustment be performed. If the device is abnormal only due to changes in network topology or temporary business needs, and is not actually attacked, the mechanism can prevent the execution of the misjudgment operation, thereby reducing the impact of misjudgment on business continuity. This intelligent misjudgment prevention and control mechanism enables both high security and excessive intervention in normal devices, improving overall availability and stability.

[0085] Step S400: verify the access permission according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result.

[0086] Specifically, the access authority is verified according to the permission level of the access information, and according to the verification result, it is determined whether the device to be accessed is allowed to execute the access information, including: when the permission level of the access information is greater than the access permission level, it is determined that the verification fails, and the device to be accessed is not allowed to execute the access information. When the permission level of the access information is less than or equal to the access permission level, it is determined that the verification is successful, and the device to be accessed is allowed to execute the access information.

[0087] Specifically, if the device to be accessed is allowed to execute the access information, the real-time network data of the device to be accessed is obtained, and according to the real-time network data, it is determined whether to interrupt the access operation of the device to be accessed.

[0088] Specifically, when determining whether to interrupt the access operation of the device to be accessed according to the real-time network data, it includes: determining whether to interrupt the access operation of the device to be accessed according to the relationship between the data flow in the real-time network data and the historical data flow: when the data flow is lower than or equal to the historical data flow, it is determined not to interrupt the access operation of the device to be accessed. When the data flow is higher than the historical data flow, the access operation of the device to be accessed is interrupted.

[0089] It can be understood that the process of determining whether to allow a device to perform an access operation is to compare the access information permission level with the access permission level. When the access information permission level of the device to be accessed is higher than its current access permission level, the verification is considered to have failed, so the access will be denied. On the contrary, if the access information permission level is less than or equal to the device's access permission level, the verification is successful and the device can perform the corresponding access operation. Through this permission level-based verification mechanism, it can ensure that only devices that meet the preset security requirements can perform sensitive or critical operations, thereby effectively limiting the behavior of devices that do not meet security conditions and enhancing security. Secondly, after the verification is successful, the behavior of the device is further monitored based on real-time network data to determine whether its access operation needs to be interrupted. By comparing the relationship between real-time data traffic and historical data traffic, abnormal behavior can be identified. If the current data traffic is greater than the historical data traffic (which may mean potential malicious behavior or data leakage), the access operation will be interrupted to prevent the risk that the device may bring from spreading. In this way, real-time monitoring ensures dynamic security management of device operations, and timely action can be taken before potential threats break out. Finally, through real-time analysis of data traffic changes, not only the normal behavior of the device can be detected, but also abnormal traffic patterns can be identified. For example, when a device's access behavior exceeds its normal data flow range, it will quickly determine that its behavior is abnormal and take interruption measures. This mechanism uses historical data flow as a reference standard, and with the help of big data and behavioral analysis technology, it can identify potential attacks or data leakage behaviors through traffic fluctuations. This precise traffic analysis and instant response mechanism effectively improves dynamic defense capabilities and enhances overall security.

[0090] It can be seen that by comparing the permission level of access information with the access permission level, the access permission of the device is strictly limited to ensure that only devices that meet security requirements can perform specific operations. This level-based access verification mechanism can effectively prevent permission-crossing access, reduce the risk of sensitive data being accessed by unauthorized devices, and improve overall security and reliability. Secondly, after the access permission is verified, real-time network data will be further obtained to monitor the access behavior of the device. If the current data traffic of the device exceeds the historical data traffic, it may indicate that the device is abnormal or has potential threats. At this time, the access operation of the device will be interrupted in time. Such a real-time dynamic monitoring mechanism allows adjustments to be made according to changes in device behavior, improving the response speed to malicious activities or abnormal behaviors. Finally, through data traffic analysis, not only can abnormal access behavior be identified, but also the stability of the entire network can be effectively avoided due to abnormal access of individual devices (such as ultra-high traffic requests). For example, if the access traffic of a device increases abnormally, it may cause excessive network resource usage and affect the use of other normal devices.

[0091] In the above embodiment, dynamic management of device access rights is achieved through comprehensive analysis of access information and network information. Traditional network security protection strategies usually rely on fixed access control rules and firewall strategies, which are difficult to adapt to the diversity of devices in industrial environments and the dynamic changes of network behavior. However, this method can accurately identify the access requirements and network behaviors of devices by obtaining key information such as access operations, data to be accessed, network locations, and communication devices, providing a more comprehensive basis for subsequent permission management. Secondly, by adopting a permission level division mechanism, the accuracy and security of access control are ensured. There may be differences in the operating permissions of different devices. For example, the access permissions of ordinary sensors and core control devices should be strictly distinguished. By dividing the access information into permission levels, this method can effectively verify permissions before access, avoid unauthorized access behavior, and thus reduce potential security risks. Finally, by introducing a dynamic adjustment mechanism based on real-time network data, the ability to identify and respond to abnormal behavior is enhanced. In traditional protection mechanisms, once access permissions are granted, they are often not adjusted with changes in the network environment, which easily leads to attackers using the permissions they have obtained to further penetrate. This method can continuously obtain the real-time network data of the device during the access process, monitor its communication behavior, dynamically adjust access rights according to abnormal situations, and even interrupt suspicious operations when necessary, further improving the security and response capabilities of network security defense.

[0092] In another preferred embodiment based on the above embodiment, Figure 2 As shown, this embodiment provides a network security defense system for an industrial environment, including:

[0093] The acquisition module is configured to acquire access information and network information of the device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication equipment and network behavior data.

[0094] The permission analysis module is electrically connected to the acquisition module, and is configured to determine the permission level of the access information according to the access operation and the data to be accessed. The permission analysis module is also configured to initialize the access rights of the device to be accessed and adjust the access rights of the device to be accessed according to the network information.

[0095] The central control module is electrically connected to the acquisition module and the permission analysis module respectively. The central control module is configured to verify the access permission according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result. If the device to be accessed is allowed to execute the access information, the central control module obtains the real-time network data of the device to be accessed, and determines whether to interrupt the access operation of the device to be accessed according to the real-time network data.

[0096] It can be understood that the network security defense method and system for an industrial environment in the above-mentioned embodiments of the present invention have the same beneficial effects and will not be described in detail.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network security defense method for an industrial environment, characterized in that: include: Obtain access information and network information of the device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication equipment, and network behavior data; Determine the permission level for accessing information based on the access operation and the data to be accessed; Initialize access rights of the device to be accessed, and adjust access rights of the device to be accessed according to network information; Verify the access rights according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result; If the device to be accessed is allowed to execute the access information, the real-time network data of the device to be accessed is obtained, and according to the real-time network data, it is determined whether to interrupt the access operation of the device to be accessed.

2. The network security defense method for industrial environment according to claim 1, characterized in that: When determining the level of access permissions based on the access operation and the data to be accessed, this includes: Get each data byte in the data to be accessed, and determine the sensitivity score of the data to be accessed based on each data byte: ； Where T is the sensitivity score of the data to be accessed, S(di) is the sensitivity score of the di-th single byte, W(di) is the weight of the di-th data byte, f(di) is the data pattern confidence of the di-th data byte, and n is the total number of data bytes; The permission level for accessing the information is determined based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score.

3. The network security defense method for industrial environment according to claim 2, characterized in that: When getting the sensitivity score for a data byte, include: S(di)=z1·C+z2·b+z3·V; Among them, C is the character category of the data byte, b is the encryption level of the data character, V is the context relevance of the data character, z1, z2 and z3 are weight coefficients, and z1, z2 and z3 are not zero.

4. The network security defense method for industrial environment according to claim 2, characterized in that: When determining the permission level for accessing information based on the relationship between the sensitivity score of the data to be accessed and the configured preset sensitivity score, it includes: Obtain the configured first preset sensitivity score and second preset sensitivity score, and determine the initial permission level for accessing the information according to the relationship between the sensitivity score of the data to be accessed and the first preset sensitivity score and the second preset sensitivity score: When the sensitivity score is lower than the first preset sensitivity score, the initial permission level for accessing the information is determined to be a low level; When the sensitivity score is higher than or equal to the first preset sensitivity score, and the sensitivity score is lower than the first preset sensitivity score, the initial permission level for accessing the information is determined to be a medium level; When the sensitivity score is higher than or equal to the second preset sensitivity score, the initial permission level for accessing the information is determined to be a high level; Among them, the first preset sensitivity score is lower than the second preset sensitivity score, and the initial permission levels are arranged from large to small as high level, medium level and low level.

5. The network security defense method for industrial environment according to claim 4, characterized in that: When determining the initial level of access to information, include: Matching an access operation with a configured preset operation method, wherein the access operation includes data transmission and control signals; Obtain the preset operation plan that matches the access operation and the corresponding operation permission level; Determine the permission level for accessing information based on the relationship between the operation permission level and the initial permission level: When the operation authority level is greater than the initial authority level, the operation authority level is determined as the authority level for accessing information; When the operation authority level is less than or equal to the initial authority level, the initial authority level is determined as the authority level for accessing information.

6. The network security defense method for industrial environment according to claim 1, characterized in that: Initializing the access rights of the device to be accessed and adjusting the access rights of the device to be accessed according to the network information, including: Based on the network behavior, determine the risk score of the network behavior of the device to be accessed: ； Among them, Rs is the network behavior risk score, Fi is the ith network behavior, and the network behavior includes abnormal data traffic, connection to suspicious IP, and frequent reconnection. αi is the weight coefficient of the ith network behavior. is the adjustment function of the ith network behavior, β is the global adjustment coefficient of the environmental threat impact, Ej is the jth environmental threat behavior, γj is the weight coefficient of the jth environmental threat behavior, Nt is the total number of communication sessions of the device to be accessed, is the smoothing parameter, n is the total number of network behaviors, and m is the total number of environmental threat behaviors; Adjust access permissions for devices to be accessed based on network behavior risk scores, network location, and communication patterns.

7. The network security defense method for industrial environment according to claim 6, characterized in that: Based on the network behavior risk score, network location and communication pattern, the access rights of the accessed device are adjusted, including: Pre-configure a preset risk score, and obtain the score difference between the network behavior risk score and the preset risk score; Determining an adjustment level when adjusting the access rights of the device to be accessed according to a relationship between the score difference and a pre-configured first preset score difference and a second preset score difference; When the score difference is lower than the first preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 0, and the operation permission of the device to be accessed is a low level; When the score difference is higher than or equal to the first preset score difference, and the score difference is lower than the second preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 1 level, and the access permission of the device to be accessed is medium level; When the score difference is higher than or equal to the second preset score difference, it is determined that the adjustment level of the access permission of the device to be accessed is 2 levels, and the access permission of the device to be accessed is a high level; Among them, the first preset score difference is smaller than the second preset score difference.

8. The network security defense method for industrial environment according to claim 7, characterized in that: When determining the adjustment level of the access permission of the to-be-accessed device when adjusting the access permission according to the relationship between the score difference and the pre-configured first preset score difference and second preset score difference, the method includes: Determine whether the adjustment operation when adjusting the access rights of the device to be accessed is effective based on the network location and communication mode and the pre-configured preset network location and preset communication mode: When the network location is consistent with the preset network location, and the communication mode is consistent with the preset communication mode, it is determined that the adjustment operation of the access permission of the device to be accessed is valid, and the access permission of the device to be accessed is adjusted according to the adjustment level; When the network location is inconsistent with the preset network location, and / or the communication mode is inconsistent with the preset communication mode, it is determined that the adjustment operation for adjusting the access rights of the device to be accessed is invalid, and the access rights of the device to be accessed are not adjusted.

9. The network security defense method for industrial environment according to claim 1, characterized in that: Determine whether to interrupt access to the device to be accessed based on real-time network data, including: Determine whether to interrupt access to the device to be accessed based on the relationship between the data traffic in the real-time network data and the historical data traffic: When the data flow is lower than or equal to the historical data flow, it is determined not to interrupt the access operation of the device to be accessed; When the data flow is higher than the historical data flow, the access operation of the device to be accessed is interrupted.

10. A network security defense system for an industrial environment, using a network security defense method for an industrial environment as claimed in any one of claims 1 to 9, characterized in that: include: An acquisition module is configured to acquire access information and network information of a device to be accessed, wherein the access information includes the data to be accessed and the access operation, and the network information includes the network location, communication device, and network behavior data; A permission analysis module is electrically connected to the acquisition module, and is configured to determine the permission level of the access information according to the access operation and the data to be accessed; the permission analysis module is also configured to initialize the access permission of the device to be accessed, and adjust the access permission of the device to be accessed according to the network information; The central control module is electrically connected to the acquisition module and the permission analysis module respectively. The central control module is configured to verify the access permission according to the permission level of the access information, and determine whether to allow the device to be accessed to execute the access information according to the verification result; wherein, if the device to be accessed is allowed to execute the access information, the central control module obtains the real-time network data of the device to be accessed, and determines whether to interrupt the access operation of the device to be accessed according to the real-time network data.

Images