Industrial internet security monitoring system based on big data

Abstract

The invention provides an industrial internet security monitoring system based on big data. The industrial internet security monitoring system comprises a data monitoring module and a security management module, the data monitoring module is used for collecting, processing and analyzing industrial equipment data and industrial internet flow data; the security management module comprises a user management module, the user management module is used for managing system users, including authentication management of the user logging in the system, and when the user logs in the system, intranet login and extranet login are included. According to the industrial internet security monitoring system based on the big data, the use security of the system is improved by setting the intranet and the extranet, and multiple authentication is needed when the extranet is used for logging in, so that the system can be conveniently logged in for operation under emergency and other conditions, and meanwhile, the security when the extranet is logged in is ensured.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security monitoring, and in particular to an industrial Internet security monitoring system based on big data. Background Art

[0002] The Industrial Internet connects the equipment, systems, personnel and other elements in industrial production through technologies such as industrial networks, industrial software and industrial cloud platforms, and realizes the comprehensive perception, real-time transmission, rapid processing and intelligent application of industrial data, thereby improving the efficiency, quality and flexibility of industrial production and promoting industrial transformation and upgrading. The security of the Industrial Internet is particularly important. The establishment of an industrial Internet security monitoring system based on big data combines security monitoring solutions of industrial Internet and big data technologies, improves the security of equipment and networks in industrial environments, and prevents potential network attacks and data leaks. The system deploys collectors at key nodes of the industrial network to comprehensively collect operating data of various equipment and systems, and uses big data storage technology to store massive data in an orderly manner. With the help of machine learning algorithms, it can deeply mine the data and accurately identify abnormal behavior.

[0003] At the same time, users need to log in and authenticate when logging into Industrial Internet-related systems such as industrial control systems and industrial Internet platforms. The current login authentication method usually involves entering an account number and password. The authentication method is relatively simple and there is still room for improvement in security.

[0004] Therefore, it is necessary to provide an industrial Internet security monitoring system based on big data to solve the above technical problems. Summary of the invention

[0005] The present invention provides an industrial Internet security monitoring system based on big data, which solves the problem that the login authentication method for industrial Internet related systems in the prior art is relatively single and there is still room for improvement in security.

[0006] In order to solve the above technical problems, the present invention provides an industrial Internet security monitoring system based on big data, including: a data monitoring module and a security management module; The data monitoring module is used to collect, process and analyze industrial equipment data and industrial Internet traffic data; A security management module, the security management module includes a user management module, the user management module is used to manage system users, including authentication management of users logging into the system; Among them, when the user logs in to the system, including using intranet login and extranet login, when using intranet login, the user enters the account and password on the login page to complete the system login. When using extranet login, the user first enters the exclusive personal identity information on the login page. When the system recognizes the personal identity information correctly, the user enters the corresponding account and password. When the exclusive personal identity information, account and password entered by the user are all correct, the user completes the system login.

[0007] Preferably, the data monitoring module includes a data acquisition module, a data processing module and a data analysis module. The data acquisition module includes an equipment data acquisition module and a network data acquisition module. The equipment data acquisition module is used to collect operating data of industrial equipment in real time, and the network data acquisition module is used to collect network traffic data; the data processing module is used to clean, convert, normalize and store the collected data; the data analysis module analyzes the data processed by the data processing module to identify potential security threats and abnormal behaviors.

[0008] Preferably, the construction of the data analysis module specifically includes the following steps: S1. Annotate the data processed by the data processing module to distinguish normal behavior data from known abnormal behavior data; S2, select a data analysis algorithm to build a normal behavior model; S3, using the labeled data to train the selected normal behavior model; S4. Determine the feature space and boundary of normal behavior through the trained normal behavior model; S5. Use the trained model as a baseline model of normal behavior for subsequent real-time monitoring and anomaly detection.

[0009] Preferably, the data analysis module includes an anomaly detection analysis module and an association analysis module. The anomaly detection analysis module analyzes the data processed by the data processing module to identify abnormal data points or data sequences that do not conform to normal behavior patterns. The association analysis module performs association analysis on data from different sources to find the correlation between abnormal behaviors.

[0010] Preferably, the construction of the anomaly detection and analysis module includes the following steps: c1. Random subsampling: randomly extract subsamples from the dataset to build a single isolation tree; c2. Recursive partitioning: For each subsample, randomly select features and partitioning values, and recursively partition the data into left and right subtrees until all samples are isolated or the maximum depth of the tree is reached; c3. Path length calculation: Count the path length from the root node to the isolated leaf node of each sample. The shorter the path, the higher the anomaly score. c4. Anomaly score normalization: The path lengths of multiple trees are combined to calculate the normalized anomaly score.

[0011] Preferably, the construction of the association analysis module includes the following steps: d1. Transaction data construction: convert each abnormal event into transaction data; d2. Minimum support screening: Set the minimum support, count the occurrence frequency of all item sets, and retain the candidate item sets that meet the threshold; d3. Frequent item set generation: Generate frequent item sets by connecting layer by layer; d4. Association rule extraction: extract rules from frequent item sets, calculate confidence and lift, and retain high-confidence rules.

[0012] Preferably, the big data-based industrial Internet security monitoring system also includes a protection module, which includes a network protection module, and the network protection module is used to block network connections from intrusion sources, detect and filter abnormal traffic, and isolate network areas affected by the intrusion from other normal areas.

[0013] Preferably, the protection module also includes a data protection module, and the data protection module is used to regularly back up system data.

[0014] Preferably, the big data-based industrial Internet security monitoring system also includes a report management module, which includes a data visualization module and a security situation display module. The data visualization module displays the data collected and analyzed in the data monitoring module in the form of a chart, and the security situation display module presents the overall security situation of the industrial Internet in a visual manner, and uses a topology map to display the architecture of the industrial Internet and the distribution of security threats.

[0015] Preferably, the equipment data acquisition module includes a sensor and a monitoring device, and the sensor and the monitoring device are used to monitor the operating status of the equipment. When the sensor detects that the equipment has an operating abnormality, the monitoring area of ​​the monitoring device is adjusted to face the abnormal equipment.

[0016] Compared with related technologies, the industrial Internet security monitoring system based on big data provided by the present invention has the following beneficial effects: The present invention provides an industrial Internet security monitoring system based on big data. By collecting data such as various types of equipment, network traffic, and user operations in the industrial system, the system can monitor various activities in real time. By using data analysis algorithms, the collected data is subsequently used to establish a normal behavior model. When a behavior pattern that does not conform to the normal model is found, such as abnormal login attempts, abnormal data access frequency, etc., the system can promptly identify possible security risks, achieve early warning of potential threats, and improve the security of the industrial Internet and various types of equipment in use. For the user's login authentication of each system of the Industrial Internet, it is divided into intranet and extranet login. The intranet refers to the local area network used in the work area, that is, the internal network of the work area. Since users in the work area can log in using their account and password, when outside the work area, that is, when using the external network to log in to the system, the user needs to first enter the exclusive personal identity information on the login page, and when the identity information is correct, enter the corresponding account and password. Only when all three are correct can they enter the system. The security of system use is improved by setting up the intranet and extranet, and when using the extranet login, multiple authentications are required, which is convenient for logging into the system for operation in emergency situations, while ensuring the security of logging in to the extranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A structural block diagram of the industrial Internet security monitoring system based on big data provided by the present invention; Figure 2 A functional block diagram of the security management module provided by the present invention; Figure 3 The principle block diagram of the data monitoring module provided by the present invention; Figure 4 The principle block diagram of the data acquisition module provided by the present invention; Figure 5 A flowchart of the user login authentication provided by the present invention; Figure 6 A flowchart of the steps for constructing the data analysis module provided by the present invention; Figure 7 A principle block diagram of the data analysis module provided by the present invention; Figure 8 A block diagram of the steps for constructing the anomaly detection and analysis module provided by the present invention; Fig. 9 A flowchart of the steps for constructing the association analysis module provided by the present invention; Fig.10 A principle block diagram of the protection module provided by the present invention; Fig.11 A functional block diagram of the report management module provided by the present invention; Fig.12A schematic diagram of the structure of the monitoring device provided by the present invention; Fig.13 A side schematic diagram of the monitoring device provided by the present invention; Fig.14 A schematic diagram of the structure of the rotary installation assembly, the mounting seat and the adjustment assembly provided by the present invention; Fig.15 A schematic diagram of the position states of the skateboard and rollers provided by the present invention, wherein: Fig.15 (a) is a schematic diagram of the state where the skateboard is separated from the roller and the monitoring device is in the initial monitoring direction. Fig.15 (b) is a schematic diagram of the state in which the monitoring device rotates counterclockwise to make the slide plate contact the roller. Fig.15 (c) is a schematic diagram showing that the monitoring device rotates clockwise to the initial monitoring direction and the slide plate and the roller are still in contact.

[0018] Numbers in the figure: 1. Sliding rack; 2. Mounting seat; 3. Rotating mounting assembly; 31. Rotating motor; 32. Driving shaft; 33. Support plate; 331. Positioning shaft; 4. Pitch adjustment assembly; 41. Fixing seat; 42. Pitch motor; 43. Rotating shaft; 44. Nut; 411. Positioning hole; 5. Monitoring device; 6. driving assembly; 61. driving arm; 62. telescopic rod; 63. sliding sleeve; 7. Skateboard; 8. Roller. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The present invention provides an industrial Internet security monitoring system based on big data.

[0021] Please refer to Figure 1 and Figure 2 ,In one embodiment of the present invention, the industrial Internet security monitoring system based on big data includes: a data monitoring module and a security management module; The data monitoring module is used to collect, process and analyze industrial equipment data and industrial Internet traffic data; A security management module, the security management module includes a user management module, the user management module is used to manage system users, including authentication management of users logging into the system; Among them, when the user logs in to the system, including using the intranet login and the extranet login, when using the intranet login, the user enters the account number and password on the login page to complete the system login, and when using the extranet login, the user first enters the exclusive personal identity information on the login page. When the system recognizes the personal identity information correctly, the user enters the corresponding account number and password. When the exclusive personal identity information, account number and password entered by the user are all correct, the user completes the system login; See also Figure 5 ,For the user's login authentication of each system of the Industrial Internet, it is divided into intranet and extranet login. The intranet refers to the local area network used in the work area, that is, the internal network of the work area. Since users in the work area can log in using their account and password, when outside the work area, that is, when using the external network to log in to the system, the user needs to first enter the exclusive personal identity information on the login page. When the identity information is correct, enter the corresponding account and password. Only when all three are correct can they enter the system. The security of system use is improved by setting up the intranet and extranet, and when using the extranet login, multiple authentications are required, which is convenient for logging in to the system for operation in emergency situations, while ensuring the security of logging in to the extranet.

[0022] Among them, the password settings include the public password set by the company and the personal password set by the individual. When the company authorizes a staff member to register an account, the staff member first needs to enter the public password and then set a personal password when registering an account; that is, when logging in through the external network, the individual's identity information, account number and personal password must all correspond.

[0023] Among them, personal identity information includes ID card information or driver’s license information (mainly digital information, such as ID card number, driver’s license file number, etc.).

[0024] See also Figure 3 and Figure 4 The data monitoring module includes a data acquisition module, a data processing module and a data analysis module. The data acquisition module includes an equipment data acquisition module and a network data acquisition module. The equipment data acquisition module is used to collect the operation data of industrial equipment in real time, and the network data acquisition module is used to collect network traffic data. The data processing module is used to clean, convert, normalize and store the collected data; The data analysis module analyzes the data processed by the data processing module to identify potential security threats and abnormal behaviors; By collecting data on various devices, network traffic, user operations, etc. in the industrial system, it is possible to monitor various activities in the system in real time, use data analysis algorithms, and subsequently use the collected data to establish a normal behavior model. When a behavior pattern that does not conform to the normal model is found, such as abnormal login attempts, abnormal data access frequency, etc., it can promptly identify possible security risks, achieve early warning of potential threats, and improve the security of the industrial Internet and various types of equipment in use; Among them, the data collection of equipment is done through various sensors, protocol converters, monitoring equipment, etc., to collect the operating status data of various equipment on the industrial site, such as physical quantity data such as temperature, pressure, speed, as well as the equipment's working mode, fault code and other status information; The network data collection uses network probes, traffic monitoring tools, etc. to capture data packets in the industrial network and collect network traffic data, including source IP address, destination IP address, port number, data transmission volume, transmission time, etc.; At the same time, log data generated by industrial control systems, network equipment, servers, etc. can be collected, such as operation logs, access logs, security logs, etc. These logs record various events and operational behaviors that occur in the system.

[0025] Data cleaning includes removing noise, duplicate data and erroneous data from the collected data to improve data quality. Data cleaning specifically includes the following steps: a1. Remove noise: Use Kalman filtering to process time series data, eliminate noise in real time, and use low-pass filtering for high-frequency signals; judge abnormal values ​​in combination with the equipment operation status (such as normal / fault mode). For example, a sensor reading of zero when the equipment is down may be reasonable, not noise; use time window statistics (such as sliding window mean) to distinguish between instantaneous noise and real faults. Deploy noise filtering algorithms (such as FPGA-based real-time filtering) in edge computing devices to reduce data noise transmitted to the cloud; a2. Remove duplicate data: Use the stream processing framework to remove duplicate data in real time, and remove duplicate data packets based on the unique identifier of the data (such as timestamp plus device ID); for high-frequency sampled time series data, use the revolving door algorithm or piecewise linear approximation (PLA) to compress redundant data and retain key change points; aggregate the original data at the edge gateway (such as taking the average per second) to reduce the amount of data transmitted to the cloud; a3. Remove erroneous data, verify data logic through the physical relationship of the equipment, remove or mark contradictory data (such as motor current and speed must satisfy the physical law of P=IV), use NTP protocol to synchronize device clock, and use Kalman filtering based on physical model to predict missing values ​​for missing data caused by sensor disconnection. For out-of-range data, determine whether it is a transient error based on the historical status of the equipment (such as recovery after restart).

[0026] Convert the collected data in different formats and encodings into a unified format and encoding for subsequent processing. The specific conversion of data format and encoding includes the following steps: b1. Format conversion: Preliminarily determine the format by the file name suffix, and parse the file header features to confirm the true format; Use pandas / json library to parse structured data such as CSV / JSON / XML, define field mapping rules (such as unifying "user_id" to "userID"); use regular expression matching pattern to extract key information from unstructured log text; build JSON Schema as a format verification template to ensure field type consistency (such as converting all date fields to ISO8601 format); b2. Encoding conversion: Use the chardet library to automatically detect the original data encoding; use Python's codecs library to implement encoding conversion; keep the original encoding of binary files (such as pictures) but add metadata to record the original format; b3. Data cleaning pipeline: Use Apache NiFi to visualize and configure data flow; convert data into Parquet column storage; verify the format of mobile phone numbers through regular expressions, and use the pytz library to unify time zone conversion; b4. Exception handling: record error logs and skip fields that cannot be parsed; design priority rules for conflicting data; keep a copy of the original data and generate a difference report before and after the conversion; b5. Output in a format that meets the requirements of the target system.

[0027] Normalize the data and map it to a specific interval or scale to eliminate dimensional differences between the data, which facilitates data analysis and model calculation.

[0028] In this embodiment, the data normalization process uses the Z-score normalization method to convert the data into a distribution with a mean of 0 and a standard deviation of 1. The formula is: z=(x−μ) / σ, where x is the original data, μ is the mean of the data set, σ is the standard deviation of the data set, and z is the normalized data.

[0029] See also Figure 6 , the construction of the data analysis module specifically includes the following steps: S1. Labeling the data processed by the data processing module to distinguish normal behavior data from known abnormal behavior data; the labeled data can be used to train the supervised learning algorithm to help the algorithm learn the characteristics of normal and abnormal behaviors; S2, select a data analysis algorithm to build a normal behavior model; S3, using the labeled data to train the selected normal behavior model; S4. Determine the feature space and boundary of normal behavior through the trained normal behavior model; S5. The trained model is used as a baseline model of normal behavior for subsequent real-time monitoring and anomaly detection. In actual applications, the baseline model can be regularly updated and optimized according to the system operation and data changes to adapt to the new normal behavior pattern.

[0030] In this embodiment, the model in S2 uses the Transformer model; the data used in model training is the data of the data acquisition module.

[0031] The specific training steps include: S21. Feature encoding: Numerical features (such as temperature and pressure) are normalized; categorical features (such as protocol type and device ID) are embedded as 16-dimensional vectors; text features (such as log messages) use pre-trained word vectors (such as Word2Vec) or BERT to extract semantic features, and temporal features are added with position encoding, and sine / cosine encoding is used to inject time order; S22. The model structure includes: input layer: input dimension: [batch_size, seq_len, feature_dim] (such as [32, 100, 512]); where batch_size: the number of samples input for a single training, seq_len: the time step of the input sequence; feature_dim: the feature dimension of each time step (sequence position); position encoding: use the sine / cosine encoding formula to enhance time series perception.

[0032] The Transformer encoder layer (4 layers) includes: Multi-head attention (8 heads): The dimension of each head is: d_k = d_v = d_model / h = 512 / 8 = 64. The attention weights of each head are calculated and concatenated. Among them, d_k: the dimension of query and key in a single attention head, d_v: the dimension of value in a single attention head; d_model: the hidden layer dimension of the model; h: the number of attention heads.

[0033] Feedforward Network (FFN): Fully connected layer dimension: d_ff = 4 * d_model = 2048, where d_ff: the intermediate layer dimension of the feedforward network, d_model: the hidden layer dimension of the model.

[0034] Activation function: Use ReLU or GELU function.

[0035] Residual connection and layer normalization: Residual connection and layer normalization are applied after each sub-layer.

[0036] The output layer includes: binary classification task: fully connected layer + Sigmoid, output anomaly probability; multi-classification task: fully connected layer + Softmax, output attack type probability.

[0037] Parameter initialization: Weight: use Xavier initialization or He initialization to balance gradient propagation; Bias: initialized to 0; Position encoding: pre-calculated and fixed, not involved in training.

[0038] S23. Use Focal Loss function for abnormal samples: L = −α(1 − p t ) γ log(p t ); Among them, L: loss value, α: category balance parameter, p t : predicted probability of the target category, γ: modulation parameter; (α=0.25, γ=2), alleviates category imbalance; adversarial samples (such as perturbed network traffic) can be injected to improve model robustness.

[0039] S24. Indicator evaluation: General indicators: evaluated by accuracy, recall, etc. Industrial indicators include: false alarm rate: avoid frequent false alarms that interfere with production; average detection time: critical attacks require a response in seconds; explainability: locate attack features through attention weights.

[0040] S25. Deployment plan: Lightweight edge: Model pruning and quantization to reduce computing overhead. Use TensorRT or ONNX Runtime to accelerate reasoning.

[0041] S26, cloud real-time detection: Deploy microservices (such as Flask API) to receive edge data and return detection results.

[0042] Monitoring and feedback: record false positive samples and regularly iterate and optimize the model.

[0043] In the industrial Internet scenario, by using Transformer model training, a closed loop from attack detection, root cause analysis to automatic blocking can be achieved, thereby improving the active defense capabilities of the industrial Internet.

[0044] See also Figure 4 The data collection module also includes a system log collection module, which is used to collect and record various events and operation behaviors occurring in industrial control systems and industrial equipment.

[0045] Log data includes operation logs, access logs, security logs, etc., which record various events and operation behaviors that occur in the system. Therefore, when a security accident or illegal operation occurs, log records can help staff restore the entire process of the incident and find out security vulnerabilities and causes of the accident from multiple aspects such as the source of operation and data flow.

[0046] See also Figure 7 The data analysis module includes an anomaly detection analysis module and an association analysis module. The anomaly detection analysis module analyzes the data processed by the data processing module to identify abnormal data points or data sequences that do not conform to normal behavior patterns. The association analysis module performs association analysis on data from different sources to find the correlation between abnormal behaviors.

[0047] The correlation analysis module performs correlation analysis on data from different sources (such as associating network traffic data with device operation logs) to find the correlation between abnormal behaviors, making it easier to determine whether there is an attack chain or complex security incident. The construction of the anomaly detection and analysis module includes the following steps: c1. Random subsampling: randomly extract subsamples from the data set to build a single isolation tree, reducing computational complexity and overfitting risk; c2. Recursive partitioning: For each subsample, randomly select features and partitioning values, and recursively partition the data into left and right subtrees until all samples are isolated or the maximum depth of the tree is reached; c3. Path length calculation: Count the path length (i.e., number of splits) of each sample from the root node to the isolated leaf node. The shorter the path, the higher the anomaly score. c4. Anomaly score normalization: The path lengths of multiple trees are combined to calculate the normalized anomaly score (range 0~1). A score close to 1 indicates a high degree of anomaly.

[0048] The construction of the association analysis module includes the following steps: d1. Transaction data construction: convert each abnormal event into transaction data (Transaction); d2. Minimum support screening: Set the minimum support (such as 0.1), count the occurrence frequencies of all item sets, and retain the candidate item sets that meet the threshold; d3. Frequent item set generation: Generate higher-order frequent item sets by connecting layer by layer (such as single item to two-item set to three-item set); d4. Association rule extraction: Extract rules from frequent item sets, calculate confidence (P(B|A)) and lift (P(B|A) / P(B)), and retain high-confidence rules.

[0049] When the anomaly detection and analysis module is used, the preprocessed time series data (such as device sensor readings) is input and the abnormal time point and corresponding features (such as "timestamp t, temperature abnormality") are output; When the association analysis module is used, a set of multi-source abnormal events (such as abnormal temperature of device A and abnormal current of device B) is input; and association rules (such as "abnormal temperature of device A causes abnormal current of device B, with a confidence level of 85%) are output.

[0050] See also Fig.10 The big data-based industrial Internet security monitoring system also includes a protection module, which includes a network protection module. The network protection module is used to block network connections from intrusion sources, detect and filter abnormal traffic, and isolate network areas affected by the intrusion from other normal areas.

[0051] The network protection module can block network connections from intrusion sources through firewalls and other devices to prevent attackers from further infiltration. You can set an access control list (ACL) on the firewall based on the source IP address, port number and other information of the intrusion to prohibit related traffic from entering or leaving the network; Traffic cleaning technology is used to detect and filter abnormal traffic, separate normal traffic from malicious traffic, ensure that normal business traffic can pass normally, and malicious traffic is intercepted or cleaned.

[0052] To detect, filter and separate abnormal traffic, the following steps are included: e1. Traffic collection and mirroring: Obtain real-time traffic data for analysis, such as configuring port mirroring (SPAN) on the core switch to copy the ingress traffic and send it to the detection server; e2. Abnormal traffic detection: deploy a traffic detection engine (Suricata) and configure a rule base (such as the EmergingThreats rule set); conduct behavioral analysis, including: using a log parsing tool (Logstash) to parse the logs of the traffic detection engine (Suricata) and store them in a distributed storage engine (Elasticsearch); create a dashboard in a data visualization tool (Kibana), monitor traffic indicators, and set alarm conditions; e3. Traffic filtering and cleaning: Dynamically update the IP blacklist; configure Nginx to limit the request rate of a single IP; modify DNS resolution to point the domain name to Cloudflare's protection IP; force verification code to challenge suspicious traffic; e4. Traffic separation and injection: Ensure that normal traffic reaches the business server and malicious traffic is intercepted; build cloud cleaning services, attack traffic is automatically diverted to the cloud for cleaning, and normal traffic is injected back to the source station; use FastNetMon to implement local traffic cleaning; e5. Perform verification and optimization.

[0053] By isolating the network area affected by the intrusion from other normal areas, the intrusion is prevented from spreading to other network areas, protecting the security of core business systems and data.

[0054] Please refer again Fig.10 The protection module also includes a system protection module, which scans the vulnerabilities of the invaded system, installs corresponding patches, monitors the running status of processes in the system in real time, and terminates abnormal processes.

[0055] The system protection module performs a comprehensive vulnerability scan on the invaded system to find system vulnerabilities and software vulnerabilities that may be exploited, and installs corresponding patches to repair the vulnerabilities to prevent attackers from exploiting the same vulnerabilities to invade again.

[0056] Preferably, according to security policies and best practices, the system security configuration is reinforced, such as limiting user permissions, shutting down unnecessary services and ports, etc., to improve the overall security of the system and reduce the risk of intrusion.

[0057] Please refer again Fig.10 The protection module also includes a data protection module, and the data protection module is used to regularly back up system data.

[0058] By regularly backing up important data in the industrial Internet system and storing the backup data in encrypted form, once a data leak or data corruption occurs, the data can be restored from the backup in a timely manner, reducing the losses caused by data loss.

[0059] When sharing data or providing data services externally, sensitive data can be desensitized and sensitive information can be replaced with fictitious or transformed data to ensure that real sensitive information is not leaked during data use.

[0060] Sensitive data here refers to data that has adverse effects on individuals, organizations or society and involves aspects such as privacy, security or commercial interests.

[0061] Preferably, a complete data audit system can be established to record and audit data access, operation and other behaviors in detail. By analyzing the audit log, the attacker's data operation trajectory can be tracked to understand whether the data has been stolen or tampered with, providing evidence for subsequent investigation and processing.

[0062] See also Fig.11, the industrial Internet security monitoring system based on big data also includes a report management module, the report management module includes a data visualization module and a security situation display module, and the data visualization module displays the data collected and analyzed in the data monitoring module in the form of charts; The report management module also includes a security situation display module, which presents the overall security situation of the industrial Internet in a visual manner and uses a topology map to display the architecture of the industrial Internet and the distribution of security threats.

[0063] Display the collected and analyzed data in intuitive charts and graphs, such as bar charts and line charts to show the changing trend of network traffic, and maps to show the geographical distribution and status of devices; Visualize the overall security situation of the industrial Internet, such as displaying the number and severity of security incidents through a security dashboard; use topology maps to display the architecture of the industrial network and the distribution of security threats; When the system detects a security threat, it will promptly issue an alarm message through the visual interface, reminding security managers with eye-catching colors and sounds, and display detailed alarm information such as threat type, occurrence time, and impact scope.

[0064] See also Figure 2 The security management module also includes an event record management module. When an abnormal security event occurs, the event record management module starts the event response process and coordinates relevant personnel and resources to carry out emergency disposal.

[0065] Among them, the security management module also includes a policy management module, which is used to formulate and manage policies and rules for industrial Internet security monitoring, including data collection strategies, analysis rules, alarm thresholds, etc., and timely adjust and optimize strategies according to actual needs and security situations.

[0066] The equipment data acquisition module includes a sensor and a monitoring device, wherein the sensor and the monitoring device are used to monitor the operating status of the equipment. When the sensor detects that the equipment has an abnormal operation, the monitoring area of ​​the monitoring device is adjusted to face the abnormal equipment.

[0067] If the monitoring area is facing the abnormal device, there is no need to adjust the monitoring device. When the sensor detects the abnormality of the device, the monitoring device automatically adjusts the monitoring area to the abnormal device and collects the video image of the abnormal device. In this way, the staff can remotely observe the actual status of the abnormal device through the background and understand the abnormal situation in time.

[0068] The sensors are set according to the detection items. For example, when detecting temperature, pressure, rotation speed, etc., temperature sensors, pressure sensors, rotation speed sensors, etc. are set accordingly.

[0069] See also Figures 12 to 15 , the monitoring device comprises a sliding frame 1, a mounting seat 2, a rotating mounting assembly 3, a pitch adjustment assembly 4 and a monitoring device 5; The mounting seat 2 is slidably mounted on the sliding frame 1, and the rotating mounting assembly 3 includes a rotating motor 31 and a supporting plate 33. The rotating motor 31 is mounted on the mounting seat 2, and a driving shaft 32 of the rotating motor 31 passes through the mounting seat 2. The supporting plate 33 is sleeved on the driving shaft 32, and a positioning shaft 331 is mounted on the supporting plate 33, wherein a thread is provided on the top end of the driving shaft 32; The pitch adjustment assembly 4 is used to adjust the pitch angle of the monitoring device 5. The pitch adjustment assembly 4 includes a fixing seat 41, a rotating shaft 43, a pitch motor 42 and a nut 44. The nut 44 is embedded and installed on the fixing seat 41. The fixing seat 41 is threadedly connected to the driving shaft 32 through the nut 44 and is located on the supporting plate 33. A positioning hole 411 is opened on the fixing seat 41. The fixing seat 41 is sleeved on the positioning shaft 331 through the positioning hole 411. The pitch motor 42 is installed on the fixing seat 41. One end of the rotating shaft 43 is installed on the output end of the pitch motor 42, and the other end is rotatably installed on the fixing seat 41. The monitoring device 5 is mounted on the rotating shaft 43 .

[0070] By setting the rotating installation component 3 and the pitch adjustment component 4, the horizontal direction and the pitch orientation of the monitoring device 5 can be adjusted, so that the monitoring orientation of the monitoring device 5 can be adjusted according to the situation so that it faces the abnormal equipment, thereby facilitating the observation of the status of the abnormal equipment.

[0071] The screw thread is set on the driving shaft 32, and the nut 44 is embedded on the fixing seat 41. Therefore, when installing the monitoring device 5, it is only necessary to make the nut 44 on the fixing seat 41 in the pitch adjustment assembly 4 at the bottom of the monitoring device 5 abut against the driving shaft 32 of the rotating motor 31, and at this time, the bottom end of the positioning hole 411 is sleeved on the positioning shaft 331, and the positioning shaft 331 can limit the axial position of the fixing seat 41, start the rotating motor 31, and the driving shaft 32 of the rotating motor 31 rotates. The nut 44 on the fixing seat 41 is connected with the top thread of the driving shaft 32, and the fixing seat 41 moves downward along the driving shaft 32, so that the fixing seat 41 abuts against the supporting plate 33, and the supporting plate 33 supports the fixing seat 41; therefore, when the rotating motor 31 rotates again, the fixing seat 41 can be driven to rotate by the supporting plate 33 and the positioning shaft 331, so that the horizontal angle of the monitoring device 5 can be adjusted. The rotating motor 31 is used to automatically complete the installation of the monitoring device 5, thereby simplifying the installation operation.

[0072] Preferably, when the fixing seat 41 is in contact with the support plate 33, the nut 44 is separated from the threads on the drive shaft 32, and a gap is left, so as to better ensure that when the drive shaft 32 of the subsequent rotating motor 31 rotates, the nut 44 will not interact with the threads on the drive shaft 32. When the nut 44 is separated from the threads on the drive shaft 32, the monitoring device 5 can be manually pressed down to make the fixing seat 41 contact with the support plate 33, and a gap is left between the nut 44 and the threads on the drive shaft 32.

[0073] The sliding frame 1 is mounted on the installation position of the equipment or building according to the installation position of the monitoring device 5. The sliding frame 1 includes a plurality of sliding arms and two mounting frames, the plurality of sliding arms are mounted between the two mounting frames, and the mounting seat 2 is sleeved on the sliding arms to form a sliding assembly.

[0074] Please refer again Fig.12 , Fig.13 and Fig.14 The monitoring device also includes a driving component 6, a slide plate 7 and a roller 8. The two ends of the slide plate 7 are slidably mounted on the two ends of the sliding frame 1 and penetrate the mounting seat 2. The roller 8 is mounted on the driving shaft 32 and staggered with the slide plate 7. The driving assembly 6 includes a driving arm 61, a telescopic rod 62 and a sliding sleeve 63. The driving arm 61 is installed on one end of the rotating shaft 43 away from the pitch motor 42. The sliding sleeve 63 is sleeved on the slide plate 7. One end of the telescopic rod 62 is rotatably installed on the driving arm 61, and the other end is rotatably installed on the sliding sleeve 63.

[0075] Among them, two fixing ears are symmetrically arranged on the mounting frames at both ends of the sliding frame 1, a sliding rod is installed between the two fixing ears, the two ends of the sliding plate 7 are correspondingly sleeved on the sliding rod, and a rubber sleeve is sleeved on the sliding rod. The sliding plate 7 and the rubber sleeve are interference fit, so that the sliding plate 7 will not move along the sliding rod when no external force is applied.

[0076] By arranging the roller 8 in conjunction with the slide plate 7, the position of the monitoring device 5 can be adjusted within a certain range, thereby increasing the monitoring range of the monitoring device 5. When an abnormal situation occurs in the device, the position of the monitoring device 5 can be further adjusted so that the video image of the abnormal device can be better collected. When the position of the monitoring device 5 needs to be adjusted, please refer to Fig.15 , the pitch motor 42 drives the rotating shaft 43 to drive the driving arm 61 to pitch upward, and the driving arm 61 drives the telescopic rod 62 to extend and retract to the maximum stroke. When the telescopic rod 62 is pulled up, the telescopic rod 62 drives the slide plate 7 to move up and contact the roller 8 through the sliding sleeve 63, and then the pitch motor 42 can rotate clockwise so that the monitoring device 5 can be restored to the original angle. At this time, the driving arm 61 drives the telescopic rod 62 to extend and retract, and the subsequent rotating motor 31 drives the driving shaft 32 to rotate, driving the roller 8 to rotate and act on the slide plate 7, so as to drive the monitoring device 5 to move and adjust its position without the need for additional driving equipment; Subsequently, the pitch motor 42 continues to rotate clockwise, driving the arm 61 to drive the telescopic rod 62 to extend and retract to the minimum stroke, and the rotating shaft 43 continues to rotate clockwise, and the telescopic rod 62 pushes the slide plate 7 to move downward and separate from the roller 8 through the sliding sleeve 63.

[0077] The pitch motor 42 can adjust the angle of the monitoring device 5 within a certain pitch range within the telescopic stroke of the telescopic rod 62, and will not drive the slide plate 7 to move.

[0078] Among them, the roller 8 is preferably covered with a rubber sleeve to increase friction, so that it can interact with the slide plate 7 more stably during operation; the inner wall of the sliding sleeve 63 is provided with a pulley to abut against the slide plate 7, so as to facilitate sliding relative to the slide plate 7.

[0079] Preferably, a partial square portion is provided on the driving shaft 32, and the other portion is a cylindrical portion. A square hole is provided at the center of the support disk 33 and sleeved on the square portion. A connecting arm is installed on the sliding sleeve 63, and an annular sliding groove is provided on the support disk 33. One end of the connecting arm is slidably assembled with the annular sliding groove (not shown).

[0080] When the sliding sleeve 63 drives the sliding plate 7 to move upward and act on the roller 8, the supporting plate 33 can be driven upward at the same time through the connecting arm. The supporting plate 33 and the square part of the driving shaft 32 are separated and sleeved on the cylindrical part. At this time, the nut 44 and the thread at the top of the driving shaft 32 are not in contact. Therefore, when the rotating motor 31 drives the roller 8 to rotate, the supporting plate 33 will not rotate with it, that is, the positioning shaft 331 will not rotate, thereby not driving the monitoring device 5 to rotate with it.

[0081] The number of revolutions driven by the rotary motor 31 each time to rotate the roller 8 is an integral multiple of a quarter revolution of the roller 8 , so that the edges of the square portion are aligned with the edges of the square hole in the center of the support plate 33 , which is convenient for subsequent reassembly.

[0082] Among them, the system page of the industrial Internet security monitoring system based on big data is provided with control management projects, parameter setting projects, industrial control projects, management report projects, security monitoring projects, Internet data projects, login projects, system repair projects, etc.; among them, click the control management project to enter the function page of the security management module; after clicking the parameter setting project, you can set the parameters of the equipment, etc.; after clicking the industrial control project, you can understand and adjust the working parameters, working status, operator information, etc. of the equipment; after clicking the management report project, you can enter the function page of the report management module; through the security monitoring project, you can enter the data analysis module page to understand the data monitoring situation; the Internet data project can understand the collection of Internet data, such as the category of collected data, the storage size and time of each category of data, etc., and the system repair project can push patches and perform system updates when there are vulnerabilities in the system.

[0083] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An industrial Internet security monitoring system based on big data, characterized in that: include: Data monitoring module and security management module; The data monitoring module is used to collect, process and analyze industrial equipment data and industrial Internet traffic data; A security management module, the security management module includes a user management module, the user management module is used to manage system users, including authentication management of users logging into the system; Among them, when the user logs in to the system, including using intranet login and extranet login, when using intranet login, the user enters the account and password on the login page to complete the system login. When using extranet login, the user first enters the exclusive personal identity information on the login page. When the system recognizes the personal identity information correctly, the user enters the corresponding account and password. When the exclusive personal identity information, account and password entered by the user are all correct, the user completes the system login.

2. The industrial Internet security monitoring system based on big data according to claim 1 is characterized in that: The data monitoring module includes a data acquisition module, a data processing module and a data analysis module. The data acquisition module includes an equipment data acquisition module and a network data acquisition module. The equipment data acquisition module is used to collect the operation data of industrial equipment in real time, and the network data acquisition module is used to collect network traffic data; the data processing module is used to clean, convert, normalize and store the collected data; the data analysis module analyzes the data processed by the data processing module to identify potential security threats and abnormal behaviors.

3. The industrial Internet security monitoring system based on big data according to claim 2 is characterized in that: The construction of the data analysis module specifically includes the following steps: S1. Annotate the data processed by the data processing module to distinguish normal behavior data from known abnormal behavior data; S2, select a data analysis algorithm to build a normal behavior model; S3, using the labeled data to train the selected normal behavior model; S4. Determine the feature space and boundary of normal behavior through the trained normal behavior model; S5. Use the trained model as a baseline model of normal behavior for subsequent real-time monitoring and anomaly detection.

4. The industrial Internet security monitoring system based on big data according to claim 2 is characterized in that: The data analysis module includes an anomaly detection analysis module and an association analysis module. The anomaly detection analysis module analyzes the data processed by the data processing module to identify abnormal data points or data sequences that do not conform to normal behavior patterns. The association analysis module performs association analysis on data from different sources to find the correlation between abnormal behaviors.

5. The industrial Internet security monitoring system based on big data according to claim 4 is characterized in that: The construction of the anomaly detection and analysis module includes the following steps: c1. Random subsampling: randomly extract subsamples from the dataset to build a single isolation tree; c2. Recursive partitioning: For each subsample, randomly select features and partitioning values, and recursively partition the data into left and right subtrees until all samples are isolated or the maximum depth of the tree is reached; c3. Path length calculation: Count the path length from the root node to the isolated leaf node of each sample. The shorter the path, the higher the anomaly score. c4. Anomaly score normalization: The path lengths of multiple trees are integrated to calculate the normalized anomaly score.

6. The industrial Internet security monitoring system based on big data according to claim 4 is characterized in that: The construction of the association analysis module includes the following steps: d1. Transaction data construction: convert each abnormal event into transaction data; d2. Minimum support screening: Set the minimum support, count the occurrence frequency of all item sets, and retain the candidate item sets that meet the threshold; d3. Frequent item set generation: Generate frequent item sets by connecting layer by layer; d4. Association rule extraction: extract rules from frequent item sets, calculate confidence and lift, and retain high-confidence rules.

7. The industrial Internet security monitoring system based on big data according to claim 1 is characterized in that: The big data-based industrial Internet security monitoring system also includes a protection module, which includes a network protection module. The network protection module is used to block network connections from intrusion sources, detect and filter abnormal traffic, and isolate network areas affected by the intrusion from other normal areas.

8. The industrial Internet security monitoring system based on big data according to claim 7 is characterized in that: The protection module also includes a data protection module, and the data protection module is used to regularly back up system data.

9. The industrial Internet security monitoring system based on big data according to claim 7 is characterized in that: The big data-based industrial Internet security monitoring system also includes a report management module, which includes a data visualization module and a security situation display module. The data visualization module displays the data collected and analyzed in the data monitoring module in the form of a chart, and the security situation display module presents the overall security situation of the industrial Internet in a visual manner, and uses a topology map to display the architecture of the industrial Internet and the distribution of security threats.

10. The industrial Internet security monitoring system based on big data according to claim 1 is characterized in that: The equipment data acquisition module includes a sensor and a monitoring device, wherein the sensor and the monitoring device are used to monitor the operating status of the equipment. When the sensor detects that the equipment has an abnormal operation, the monitoring area of ​​the monitoring device is adjusted to face the abnormal equipment.

Images