Safety monitoring method for intelligent manufacturing system

Abstract

The invention provides an intelligent manufacturing system security monitoring method, which comprises the steps of determining a historical monitoring time period of each node in an intelligent manufacturing system according to a monitoring period; acquiring historical security monitoring parameters of each node in a historical monitoring time period; determining the monitoring cardinal number of each node according to the layer to which each node belongs and the historical security monitoring parameters; and performing safety monitoring on the intelligent manufacturing system according to the monitoring cardinal number and the current safety monitoring parameter of each node in the current monitoring period. According to the method, the historical monitoring time period is determined for each node, the monitoring cardinal number conforming to the characteristics of each node is determined for each node according to the historical safety monitoring parameters in the historical monitoring time period, and then safety monitoring is performed on the intelligent manufacturing system based on the monitoring cardinal number and the current safety monitoring parameters of each node in the current monitoring period. Accurate monitoring of the intelligent manufacturing system is realized.

Description

Technical Field

[0001] The present application relates to the field of intelligent manufacturing technology, and in particular to a method for security monitoring of an intelligent manufacturing system. Background Art

[0002] Intelligent Manufacturing (IM) system is a human-machine integrated intelligent system composed of intelligent machines and human experts. It can perform intelligent activities such as analysis, reasoning, judgment, conception and decision-making in the manufacturing process. Through the cooperation between people and intelligent machines, it expands, extends and partially replaces the mental labor of human experts in the manufacturing process. It updates the concept of manufacturing automation and expands it to flexibility, intelligence and high integration.

[0003] The intelligent manufacturing system mainly consists of the following parts:

[0004] Perception layer: responsible for collecting various data and information at the production site, including environmental parameters such as temperature, humidity, and pressure, as well as production information such as equipment status and production progress. These data are transmitted to the control system through sensors and actuators to achieve real-time monitoring and control of the production process.

[0005] Control layer: Located between the perception layer and the decision layer, it is mainly responsible for receiving the data transmitted by the perception layer, performing preliminary processing and analysis, and issuing control instructions based on the analysis results. The control layer implements manufacturing data management, planning and scheduling, production scheduling and other functions through computer software modules to ensure the smooth progress of the production process.

[0006] Application layer: This is the highest layer of the intelligent manufacturing system, responsible for receiving the processing results of the control layer and conducting higher-level analysis and decision-making. The application layer includes enterprise management and support systems, enterprise computing and data centers, etc., providing enterprises with computing resources, data services and specific application functions required to realize intelligent manufacturing, and has a visual application interface.

[0007] Since the intelligent manufacturing system can perform certain intelligent activities, once there is a security problem in the intelligent manufacturing system, it is likely to cause abnormal intelligent activities, affecting the operation quality of the intelligent manufacturing system, and will also affect the upstream and downstream of the intelligent manufacturing system. Therefore, it is very important to carry out security monitoring of the intelligent manufacturing system. Summary of the invention

[0008] In order to solve one of the above technical defects, the present application provides a method for security monitoring of an intelligent manufacturing system, the method comprising:

[0009] According to the monitoring cycle, determine the historical monitoring time period of each node in the intelligent manufacturing system;

[0010] Obtain the historical security monitoring parameters of each node within the historical monitoring time period;

[0011] Determine the monitoring base of each node based on the layer to which each node belongs and historical security monitoring parameters;

[0012] The intelligent manufacturing system is monitored for security based on the monitoring base and the current security monitoring parameters of each node during the current monitoring cycle.

[0013] Optionally, according to the monitoring cycle, a historical monitoring time period of each node in the intelligent manufacturing system is determined, including:

[0014] For any node, determine its historical monitoring time period through the following steps:

[0015] Determine the monitoring period involved in any node from the first startup to the current time, and form a monitoring period sequence of any node; wherein the elements in the monitoring period sequence are arranged from far to near according to time;

[0016] Determine the attribute value of each element in the monitoring cycle sequence of any node; wherein the attribute value of any element is the number of times the node to which it belongs is powered on from the first power-on to the time corresponding to any element;

[0017] Clustering is performed according to the attribute values ​​of each element in the monitoring period sequence;

[0018] Determine the number of choices in each class based on the number of elements in each class; where the number of choices in any class i is the node identifier, j is the class identifier, is the number of elements in class j of node i, ne i is the total number of elements in the monitoring cycle sequence of node i, is a floor function, β1 is a preset first ratio, and β2 is a preset second ratio;

[0019] Based on the number of selections from all classes, the historical monitoring period for any node is determined.

[0020] Optionally, a historical monitoring time period for any node is determined based on the number of selections of all classes, including:

[0021] like The time period corresponding to the selected number of elements in each category that are the most recent and the last element in the non-monitoring cycle sequence is determined as the historical monitoring time period of any node. At the same time, the last element in the monitoring cycle sequence is The time period corresponding to the last element in the unselected and non-monitoring period sequence is determined as the historical monitoring time period of any node; where α min is the minimum number corresponding to the layer to which any node belongs;

[0022] like Then select the number of elements that are the closest in time and the last element in the non-monitoring period sequence in each category; from the selected elements, remove them according to the attribute value from small to large and the time corresponding to the elements from far to near elements; the time period corresponding to the selected elements after elimination is determined as the historical monitoring time period of any node; where α max is the maximum number corresponding to the layer to which any node belongs.

[0023] Optionally, any layer corresponding to Among them, Δt is the monitoring period, t min is the average of the shortest startup time of all nodes in any layer, is the ceiling function.

[0024] Optionally, the monitoring base of each node is determined according to the layer to which each node belongs and historical security monitoring parameters, including:

[0025] For any node, determine its monitoring cardinality through the following steps:

[0026] Arrange all historical safety monitoring parameters from far to near according to the collection time of the safety monitoring parameters to form a historical safety monitoring parameter sequence;

[0027] Determine the change value of each element in the historical safety monitoring parameter sequence; where, u is the element identifier of the historical safety monitoring parameter sequence, i is the node identifier, is the historical safety monitoring parameter value of the u-th element of the historical safety monitoring parameter sequence of node i, is the historical security monitoring parameter value of the u-1th element of the historical security monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameters of the u-th element of the historical safety monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameter of the u-1th element of the historical safety monitoring parameter sequence of the i-th node;

[0028] Determine the adjustment coefficient according to the layer to which any node belongs;

[0029] The monitoring base of any node is determined according to the adjustment coefficient and the change value of each element in the historical safety monitoring parameter sequence.

[0030] Optionally, the adjustment coefficient is determined according to the layer to which any node belongs, including:

[0031] If any node belongs to the perception layer, the adjustment coefficient is determined as

[0032] Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, and softmax{} is the normalization function.

[0033] Optionally, the adjustment coefficient is determined according to the layer to which any node belongs, including:

[0034] If any node belongs to the control layer, the adjustment coefficient is determined as

[0035] Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv C (avg) is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all nodes in the control layer, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all application layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv A (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, and softmax{} is the normalization function.

[0036] Optionally, the adjustment coefficient is determined according to the layer to which any node belongs, including:

[0037] If any node belongs to the application layer, the adjustment coefficient is determined as

[0038] Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv A (avg) is the average of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all control layer nodes that have communication connection with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv C(avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the control layer, and softmax{} is the normalization function.

[0039] Optionally, the monitoring cardinality of any node is determined according to the adjustment coefficient and the change value of each element in the historical security monitoring parameter sequence, including:

[0040] Determine the mean of all historical safety monitoring parameters;

[0041] Determine the comparison value of historical safety monitoring parameters Among them, cv i (max) is the maximum value of the change value of each element in the historical safety monitoring parameter sequence of node i, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv i (min) is the minimum value of the change value of each element in the historical security monitoring parameter sequence of node i;

[0042] Determine the monitoring base of any node based on the adjustment coefficient, mean and comparison value.

[0043] Optionally, the monitoring base of any node is determined according to the adjustment coefficient, the mean value and the comparison value, including:

[0044] Determine the monitoring base of any node

[0045] Among them, G1 i is the mean of the i-node, G2 i is the comparison value of node i, Ad i is the adjustment coefficient of the i-node.

[0046] The present application provides a method for security monitoring of an intelligent manufacturing system, the method comprising: determining the historical monitoring time period of each node in the intelligent manufacturing system according to the monitoring cycle; obtaining the historical security monitoring parameters of each node in the historical monitoring time period; determining the monitoring cardinality of each node according to the layer to which each node belongs and the historical security monitoring parameters; and performing security monitoring of the intelligent manufacturing system according to the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle. The method of the present application will determine the historical monitoring time period for each node, determine the monitoring cardinality that meets its characteristics for each node according to the historical security monitoring parameters in the historical monitoring time period, and then perform security monitoring of the intelligent manufacturing system based on the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle, thereby achieving accurate monitoring of the intelligent manufacturing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0048] Figure 1 A schematic diagram of a topological diagram of an intelligent manufacturing system provided in an embodiment of the present application;

[0049] Figure 2 A flowchart of a method for security monitoring of an intelligent manufacturing system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the technical solutions and advantages in the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0051] In the process of implementing this application, the inventors discovered that since the intelligent manufacturing system can perform certain intelligent activities, once there is a security problem in the intelligent manufacturing system, it is likely to cause abnormal intelligent activities and affect the operation quality of the intelligent manufacturing system. It will also affect the upstream and downstream of the intelligent manufacturing system. Therefore, it is very important to conduct security monitoring of the intelligent manufacturing system.

[0052] In response to the above problems, an embodiment of the present application provides a method for security monitoring of an intelligent manufacturing system, the method comprising: determining the historical monitoring time period of each node in the intelligent manufacturing system according to the monitoring cycle; obtaining the historical security monitoring parameters of each node in the historical monitoring time period; determining the monitoring cardinality of each node according to the layer to which each node belongs and the historical security monitoring parameters; and performing security monitoring of the intelligent manufacturing system according to the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle. The method of the present application will determine the historical monitoring time period for each node, determine the monitoring cardinality that meets its characteristics for each node according to the historical security monitoring parameters in the historical monitoring time period, and then perform security monitoring of the intelligent manufacturing system based on the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle, thereby achieving accurate monitoring of the intelligent manufacturing system.

[0053] This embodiment provides a method for security monitoring of an intelligent manufacturing system, which is used to perform security monitoring on an intelligent manufacturing system. The intelligent manufacturing system consists of a perception layer, a control layer, and an application layer, and each layer may include multiple devices (e.g., the perception layer includes a temperature acquisition device, a humidity acquisition device, a high-definition image acquisition device, etc.). In the topology diagram of the intelligent manufacturing system, each device is a node, such as Figure 1As shown, nodes in each layer will establish communication connections with one or more nodes in other layers to achieve data interaction, such as nodes in the perception layer (such as Figure 1 The nodes 11 shown in FIG. 1 and the nodes of the control layer (such as Figure 1 The nodes 21 shown in the figure are connected, and then the collected temperature is sent to the nodes of the control layer to realize the intelligence of the intelligent manufacturing system. If there is a communication connection between two nodes, there is an edge between the corresponding two nodes in the topological diagram formed by the intelligent manufacturing system.

[0054] In addition, the security monitoring parameters of each node in the intelligent manufacturing system are periodically collected, such as bandwidth, traffic data, attack data, CPU utilization, etc. In addition, the security monitoring parameters of different nodes can be the same or different. For example, the security monitoring parameters of the temperature acquisition device also include monitoring sensitivity, monitoring accuracy, etc. The security monitoring parameters of a node in the control layer do not include monitoring sensitivity and monitoring accuracy, but include processing accuracy, etc. The security monitoring parameters use existing parameters, and this embodiment does not limit the specific content of the security monitoring parameters.

[0055] In addition, the intelligent manufacturing system security monitoring method provided in this embodiment is also executed periodically to monitor the intelligent manufacturing system.

[0056] Among them, the collection period of the security monitoring parameters is much shorter than the period of executing the security monitoring method of the intelligent manufacturing system. For the convenience of description, the collection period of the security monitoring parameters is named as the collection period, and its duration is T1, and the period of executing the security monitoring method of the intelligent manufacturing system is named as the monitoring period, and its duration is T2, then T1 is much shorter than T2. ​​For example, T1 is 1 minute, T2 is half a year, etc. This embodiment does not limit the duration of the monitoring period and the collection period.

[0057] See also Figure 1 The implementation process of the intelligent manufacturing system security monitoring method provided in this embodiment is as follows:

[0058] 101. According to the monitoring cycle, determine the historical monitoring time period of each node in the intelligent manufacturing system.

[0059] Each node in the intelligent manufacturing system will collect its security monitoring parameters in a collection cycle of T1, and the intelligent manufacturing system will execute the intelligent manufacturing system security monitoring method provided in this embodiment every monitoring cycle of T2. Each time the intelligent manufacturing system security monitoring method provided in this embodiment is executed, the security monitoring parameters collected by each node within the most recent T2 duration will be obtained, and each T2 duration is a monitoring cycle. Therefore, the security monitoring parameters collected by each node will be divided into security monitoring parameters of different monitoring cycles according to the T2 duration.

[0060] For example, any node has experienced 5 monitoring cycles since its first boot-up, as shown in Table 1 below:

[0061] Table 1

[0062]

[0063] Among them, T0 is the current time, and T1 is the first boot-up time.

[0064] In addition, node i can experience multiple shutdowns and reboots since its first boot-up. In this embodiment, only the first boot-up is counted.

[0065] Step 101 determines the historical monitoring time period of each node according to the monitoring cycle situation of each node, making the historical monitoring time period related to the total running time of the node, avoiding the situation where the historical monitoring time period does not match the node running time caused by each node adopting a fixed historical monitoring time period. This will cause inaccurate acquisition of subsequent historical security monitoring parameters, and thus result in poor security monitoring results of the intelligent manufacturing system.

[0066] In step 101, for any node (such as node i, where i is the node identifier), the process of determining the historical monitoring time period of node i in the intelligent manufacturing system according to the monitoring cycle is as follows:

[0067] 101-1, Determine the monitoring cycles involved from the first boot-up of any node to the current time, forming a monitoring cycle sequence of any node.

[0068] Among them, the elements in the monitoring cycle sequence are arranged in the order from far to near in time.

[0069] Taking the monitoring cycles involved from the first boot-up of node i to the current time as shown in Table 1 as an example, the monitoring cycle sequence of node i is monitoring cycle 1, monitoring cycle 2, monitoring cycle 3, monitoring cycle 4, and monitoring cycle 5.

[0070] 101-2, Determine the attribute value of each element in the monitoring cycle sequence of any node.

[0071] Among them, the attribute value of any element is the number of boot-ups of its所属 node from the first boot-up to the time corresponding to any element.

[0072] For example, after the first boot-up of node i, it was restarted once at time T2, where T0 - 3×T2 < T2 < T0 - 2×T2. Then, after monitoring cycle 3 and later, since the number of boot-ups has become 2, the corresponding attribute value is also 2. Table 2 shows the attribute values:

[0073] Table 2

[0074]

[0075] 101-3, clustering is performed according to the attribute value of each element in the monitoring period sequence.

[0076] For example, according to Figure 2 After clustering, the attribute values ​​shown are clustered into two categories, one category includes monitoring period 1 and monitoring period 2, and the other category includes monitoring period 3, monitoring period 4 and monitoring period 5. After clustering, the continuous monitoring periods within each power-on duration can be clustered into one category.

[0077] 101-4, determine the number of selections in each class based on the number of elements in each class.

[0078] The number of choices in any category i is the node identifier, j is the class identifier, is the number of elements in class j of node i, ne i is the total number of elements in the monitoring cycle sequence of node i, is a floor function, β1 is a preset first ratio, and β2 is a preset second ratio.

[0079] When determining the number of selections, a certain ratio can be set first, that is, the first ratio β1, 0<β1≤1, the first ratio β1 represents the ratio of the number of selections to increase by one unit, that is, for any class j, if the number of elements in class j accounts for the ratio of the total number of elements in the monitoring cycle sequence of node i (i.e. ), each time β1 is reached, the number of choices in class j will increase by one unit. Then for class j, the final number of units is

[0080] In addition, the number of choices in a unit can also be preset, such as β3 choices. In this way, for class j, the final number of choices is

[0081] In specific implementation, β3 can be determined as a certain proportion of the total number of elements in the monitoring period sequence. For example, the proportion is set to the second proportion β2, 0<β2≤1, then β3=(ne i -1)×β2. Because, ne i The last element of is the current safety monitoring parameter in the current monitoring cycle. This element is used to perform safety monitoring of the intelligent manufacturing system in step 104 and cannot be used as a basis for determining the monitoring base. Therefore, the total number of selectable elements will be determined by ne i Become ne i -1, then β3≠ne i × β2, but β3=(ne i -1)×β2.

[0082] In summary, for class j, the final number of choices is

[0083] Still taking Table 2 as an example, the class 1 of the i node (such as j=1) includes monitoring period 1 and monitoring period 2, and the class 2 of the i node (such as j=2) includes monitoring period 3, monitoring period 4 and monitoring period 5. The number of elements in class 1 is 2 (i.e. ), the number of elements in the second category is 3 (i.e. The total number of elements in the monitoring period sequence is 5 (i.e., ne i =5). If β1 = β2 = 0.25, then the number of choices in category 1 Number of choices in 2 categories

[0084] 101-5, determine the historical monitoring time period of any node based on the number of selections of all classes.

[0085] Before executing this step, the minimum total number of selections (i.e. the minimum number α) is determined for each layer of nodes according to the characteristics of each layer of nodes. min ) and the maximum total number of choices (i.e. the maximum number α max ). Minimum number α mim The main purpose is to ensure that there is enough historical monitoring time period to ensure the accuracy of the final monitoring base. max The main purpose is to process the amount of data and ensure the execution efficiency of the intelligent manufacturing system security monitoring method provided in this embodiment. Therefore, by determining the minimum total selection number (i.e., the minimum number α) for each layer of nodes min ) and the maximum total number of choices (i.e. the maximum number α max ) can ensure that the historical monitoring time period is a small amount of data that meets the accuracy requirements of the monitoring base, thereby ensuring the execution efficiency of the intelligent manufacturing system security monitoring method provided in this embodiment.

[0086] Because each layer of nodes has its own characteristics, the α of each layer min and α max There is some difference.

[0087] For example, the perception layer is mainly used to collect various data and information on the production site. It has a large amount of data, but the data does not change much (such as the temperature collection node, which always collects temperature data and does not change much). Adding a historical monitoring period will increase a lot of data, but the added data cannot represent the new features of the node because of the small change, and the additional value for determining the monitoring base is not great. In other words, the characteristics of the node can be analyzed through several historical monitoring periods to obtain the monitoring base. Therefore, the α of the perception layer max and the α of the perception layermin can be small, for example, the α of the perception layer max =5, α of the perception layer min =3, that is, the node of the perception layer is sufficient to accurately analyze the monitoring base of the node through 3-5 historical monitoring time periods.

[0088] The control layer is mainly responsible for receiving data transmitted by the perception layer, and performing preliminary processing and analysis. Its data volume is also large, but it has certain analysis capabilities. Different monitoring time periods will cause changes in the characteristics of all monitoring parameters due to different analysis contents. Therefore, it has the characteristics of large data volume but small data changes. Adding a historical monitoring time period will increase a lot of data. It is also possible that the added data will bring new features to characterize the node, thereby generating additional value for determining the monitoring base. In other words, the accurate characteristics of the node cannot be analyzed through a few historical monitoring time periods. More historical monitoring time periods are needed to obtain accurate characteristics and then obtain the monitoring base. Therefore, the α of the control layer max Compared with the perceptual layer α max Large, control layer α min Compared with the perceptual layer α min Large, for example, the α of the control layer max =9, α of the control layer min =4, that is, the monitoring base of the node is analyzed through 4-9 historical monitoring time periods.

[0089] The application layer is mainly responsible for higher-level analysis and decision-making, and the characteristics of its monitoring parameters change flexibly. Therefore, it has the characteristic of large data changes. Adding a historical monitoring period will bring new features to characterize the node due to the added data, which will generate additional value for determining the monitoring base. In other words, more historical monitoring periods are needed to find the characteristic rules of security monitoring parameters and then obtain the monitoring base. Therefore, the α of the application layer max Compared with the control layer's α max Large, application layer α min Compared with the control layer's α min Large, for example, the α of the application layer max =10, α of the application layer min =7, that is, the monitoring base of the node is analyzed through 7-10 historical monitoring time periods.

[0090] It should be noted that the α max and α min The specific values ​​are only examples. This embodiment does not apply to the α values ​​of each layer. max and α min The specific value is limited.

[0091] However, in order to ensure that each node has at least one node in its monitoring cycle sequence that satisfies its layer max elements, so the α of each layer max Cannot be more than the number of elements in the monitoring cycle sequence of the minimum element of this layer (the number is ), that is, any layer corresponds to Among them, Δt is the monitoring period, t min is the average of the shortest startup time of all nodes in any layer, is the ceiling function.

[0092] It should be noted that this is not selected But choose This is because the last element in the monitoring cycle sequence is the current safety monitoring parameter in the current monitoring cycle. This element is used to perform safety monitoring of the intelligent manufacturing system in step 104 and cannot be used as a basis for determining the monitoring base. Therefore, the total number of selectable elements will be becomes

[0093] Therefore, although this embodiment does not max and α min The specific value is limited, but it needs to meet the corresponding constraints.

[0094] This step can be based on the sum of the number of selections of all classes and the α of the layer where the node is located. max and α min The relationship determines the historical monitoring period.

[0095] For example, for any node i, if Among them, α min is the minimum number corresponding to the layer to which any node belongs, then the sum of the number of selections of all classes of node i is less than the minimum number corresponding to the layer to which node i belongs, that is, the number of selections of node i obtained in step 101-4 is insufficient, then the historical monitoring time period will be determined according to the number of selections of node i obtained in step 101-4, and a certain number of historical monitoring time periods will be supplemented. That is, the time period corresponding to the number of selections of the last element in the non-monitoring cycle sequence in each class is determined as the historical monitoring time period of any node, and at the same time, the last element in the monitoring cycle sequence is supplemented. The time period corresponding to the last element of the unselected and non-monitoring period sequence is determined as the historical monitoring time period of any node.

[0096] That is to say, the historical monitoring time period must not be the last element in the monitoring cycle sequence. This is because the last element in the monitoring cycle sequence is the current safety monitoring parameter in the current monitoring cycle. This element is used to perform safety monitoring of the intelligent manufacturing system in step 104 and cannot be used as a basis for determining the monitoring base.

[0097] Still taking Table 2 as an example, if it is determined in step 101-4 If the minimum number α corresponding to the layer to which the i node belongs min =4, Then, the time period corresponding to one element (i.e., monitoring period 2) that is the most recent and the last element in the non-monitoring period sequence in category 1 (i.e., (T0-4×T2, T0-3×T2]) and the time period corresponding to two elements (i.e., monitoring period 3 and monitoring period 4) that are the most recent and the last element in the non-monitoring period sequence (i.e., non-monitoring period 5) in category 2 (i.e., (T0-3×T2, T0-2×T2] and (T0-2×T2, T0-T2]) are determined as the historical monitoring time period of node i. At this time, the selection of each monitoring period in the monitoring period sequence is shown in Table 3.

[0098] Table 3

[0099]

[0100] At the same time, the last The time period corresponding to the last element (ie, non-monitoring period 5) of the unselected and non-monitoring period sequence (ie, monitoring period 1) (ie, (T1, T0-4×T2]) is determined as the historical monitoring time period of the i node.

[0101] Therefore, the historical monitoring period of the node is (T1, T0-T2].

[0102] For any node i, if Among them, α max is the maximum number corresponding to the layer to which any node belongs, then the sum of the number of selections of all classes of the i-node is greater than the maximum number corresponding to the layer to which the i-node belongs, that is, the number of selections of the i-node obtained in step 101-4 can be reduced a little without affecting the accurate determination of the monitoring base. Then, according to the historical monitoring time period corresponding to the number of selections of the i-node obtained in step 101-4, the number of selections of the i-node is reduced. The final historical monitoring time period is obtained. That is, the number of elements selected from the last element in the non-monitoring period sequence in each category are selected. From the selected elements, the time corresponding to the elements is removed from the smallest to the largest according to the attribute value. The time period corresponding to the selected elements after elimination is determined as the historical monitoring time period of any node.

[0103] That is to say, the historical monitoring time period must not be the last element in the monitoring cycle sequence. This is because the last element in the monitoring cycle sequence is the current safety monitoring parameter in the current monitoring cycle. This element is used to perform safety monitoring of the intelligent manufacturing system in step 104 and cannot be used as a basis for determining the monitoring base.

[0104] Still taking Table 2 as an example, if it is determined in step 101-4 If the maximum number of layers to which node i belongs is α max =2, Then, select the number of elements in category 1 that are the closest in time and the last element in the non-monitoring cycle sequence (i.e. monitoring cycle 2), and the number of elements in category 2 that are the closest in time and the last element in the non-monitoring cycle sequence (i.e. monitoring cycle 3 and monitoring cycle 4). From the selected elements (i.e. from monitoring cycle 2, monitoring cycle 3, and monitoring cycle 4), remove the elements according to the attribute value from small to large and the time corresponding to the elements from far to near. elements, (e.g., the elements selected according to the attribute value arrangement from small to large are monitoring period 2, monitoring period 3, and monitoring period 4. Based on the above arrangement, the elements are arranged from far to near according to the time corresponding to them, and the resulting sequence is monitoring period 2, monitoring period 3, and monitoring period 4. From this sequence, remove an element with the smallest attribute value and the furthest corresponding time, i.e., monitoring period 2). The time periods corresponding to the selected elements after removal (i.e., monitoring period 3 and monitoring period 4) (i.e., (T0-3×T2, T0-2×T2] and (T0-2×T2, T0-T2]) are determined as the historical monitoring time period of node i (i.e., (T0-3×T2, T0-T2]).

[0105] Step 101-5 can ensure that the selected historical monitoring time period satisfies the α min and α max The restriction also ensures that the selected historical monitoring time period is the time period closest to the current time period, and ensures that the subsequent historical security monitoring parameters are closer parameters. The monitoring base obtained according to the historical security monitoring parameters can better meet the current characteristics of the node.

[0106] 102, obtaining historical security monitoring parameters of each node within a historical monitoring period.

[0107] Taking any node i as an example, step 101 determines that the historical monitoring time period of the i node is (T0-3×T2, T0-T2], then in step 102, the security monitoring parameters of the i node within (T0-3×T2, T0-T2] are determined, that is, all the security monitoring parameters obtained in monitoring period 3 and monitoring period 4 in Table 1.

[0108] For the convenience of explanation, in this embodiment, the security monitoring parameters of the most recent monitoring cycle are referred to as current security monitoring parameters, and the security monitoring parameters of a non-most recent monitoring cycle are referred to as historical security monitoring parameters. In other words, both historical security monitoring parameters and current security monitoring parameters are security monitoring parameters (i.e., the dimensions included in the security monitoring parameters are the same, but the specific values ​​are different), and the only difference is the data collection time.

[0109] 103. Determine the monitoring base of each node according to the layer to which each node belongs and the historical security monitoring parameters.

[0110] In step 103, the monitoring cardinality of each node is determined according to the layer to which each node belongs and the historical security monitoring parameters of each node. If there are multiple security monitoring parameters, such as full monitoring parameters including bandwidth, traffic data, attack data, CPU utilization, etc., then in step 103, the monitoring cardinality of each security monitoring parameter of each node is determined according to the layer to which each node belongs and the historical security monitoring parameters of each node. In other words, the monitoring cardinality corresponds to the security monitoring parameter-node, and there are as many monitoring cardins as there are security monitoring parameter-node combinations.

[0111] For any security monitoring parameter of any node, the process of determining the monitoring base is as follows:

[0112] 103-1, according to the collection time of the safety monitoring parameters, all historical safety monitoring parameters are arranged from far to near to form a historical safety monitoring parameter sequence.

[0113] Taking any node i as an example, all security monitoring parameters (i.e., historical security monitoring parameters) obtained in monitoring period 3 and monitoring period 4 are obtained in step 102. In step 103-1, all security monitoring parameters (i.e., historical security monitoring parameters) obtained in step 102 are arranged from far to near according to their acquisition time to form a historical security monitoring parameter sequence, such as the historical security monitoring parameter sequence is: security monitoring parameter 1, security monitoring parameter 2, security monitoring parameter 3, ..., security monitoring parameter n.

[0114] Taking bandwidth as an example of a security monitoring parameter, the historical security monitoring parameter sequence is: bandwidth 1, bandwidth 2, bandwidth 3, ..., bandwidth n.

[0115] 103-2, determine the change value of each element in the historical safety monitoring parameter sequence.

[0116] in, u is the element identifier of the historical safety monitoring parameter sequence, i is the node identifier, is the historical safety monitoring parameter value of the u-th element of the historical safety monitoring parameter sequence of node i, is the historical security monitoring parameter value of the u-1th element of the historical security monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameters of the u-th element of the historical safety monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameter of the u-1th element of the historical safety monitoring parameter sequence of the i-th node.

[0117] Except for the first element, the change value of each element is the ratio of the change in parameter value of the previous element to the change in duration, that is, the change in value per unit time.

[0118] Taking the historical security monitoring parameter sequence of: bandwidth 1, bandwidth 2, bandwidth 3, ..., bandwidth n as an example, if the values ​​and collection times of the historical security monitoring parameters are as shown in Table 4.

[0119] Table 4

[0120]

[0121] Among them, the change value of the first element (i.e., u=1) in the historical safety monitoring parameter sequence The change in the second element (i.e. u = 2) The change in the third element (i.e. u=3) ..., the change value of the nth element (i.e. u = n) The change values ​​of the elements shown in Table 5 are obtained.

[0122] Table 5

[0123]

[0124]

[0125] 103-3, determining the adjustment coefficient according to the layer to which any node belongs.

[0126] Regarding the security of the intelligent manufacturing system, there are influences between the nodes of the intelligent manufacturing system in the perception layer, the control layer, and the application layer. For example, if a security problem occurs at a node in the perception layer, such as the data collected by it is tampered with, then a node in the perception layer will send the tampered data to a node in the control layer. Then, a node in the control layer will be threatened due to the security problem of a node in the perception layer, that is, a node in the perception layer affects a node in the control layer, and the adjustment coefficient determined in step 103-3 represents this influence.

[0127] The implementation process of step 103-3 is as follows:

[0128] 1. If any node belongs to the perception layer, then the adjustment coefficient is determined as

[0129] Among them, cvi (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, and softmax{} is the normalization function.

[0130] cv i (avg) is the average change of the parameter value per unit time of the i node, cv P (avg) is the average change of the parameter value per unit time of the perception layer, is the degree of change of node i in the perception layer. As a perception layer node, because the function of each node is relatively simple, except for the different collection objects, the other factors of each node are not much different. That is to say, the change of the parameter value per unit time is taken as the normalized change degree, and the difference in the degree of change between the nodes is not large. Therefore The degree of change obtained is due to the influence of the intelligent manufacturing system, so As the adjustment coefficient of each node in the perception layer.

[0131] 2. If any node belongs to the control layer, then the adjustment coefficient is determined as

[0132] Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv C (avg) is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all nodes in the control layer, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all application layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv A (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, and softmax{} is the normalization function.

[0133] cv i (avg) is the average change of the parameter value per unit time of the i node, cv C (avg) is the average change of the parameter value per unit time of the control layer. However, the change degree of the i node in the control layer is closely related to the perception layer and application layer in addition to its own factors. Therefore, the change of the parameter value of the node is also related to the perception layer and application layer nodes connected to it. For example, if the i node is Figure 1If node 22 is in the control layer, then all application layer nodes that have communication connection with node i are node 31, and all perception layer nodes that have communication connection with node i are node 14 and node 15. The change of the parameter value of node 22 is also related to node 31, node 14 and node 15. Therefore, when calculating the control layer adjustment coefficient, use Characterize the impact of the perception layer and application layer nodes connected to the i-node on the i-node, using Characterize the impact of the perception layer and application layer on the control layer. The degree of change obtained reflects the influence of the i node and other nodes with which it has communication connections, so As the adjustment coefficient of each node in the control layer.

[0134] 3. If any node belongs to the application layer, then the adjustment coefficient is determined as

[0135] Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv A (avg) is the average of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all control layer nodes that have communication connection with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv C (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the control layer, and softmax{} is the normalization function.

[0136] cv i (avg) is the average change of the parameter value per unit time of the i node, cv A (avg) is the average of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer. However, the change degree of the i node in the application layer is closely related to the perception layer and the control layer in addition to its own factors. Therefore, the change of the parameter value of the node is also related to the perception layer and the control layer nodes connected to it. For example, if the i node is Figure 1Node 31 in the example, all application layer nodes that have communication connection with node i are node 31, all control layer nodes that have communication connection with node i are node 21, node 22 and node 23, all perception layer nodes that have communication connection with node i are node 11, node 12, node 13, node 14 and node 15, and the change of parameter value of node 22 is also related to node 11, node 12, node 13, node 14, node 15, node 21, node 22 and node 23. Therefore, when calculating the application layer adjustment coefficient, use Characterize the influence of the perception layer and control layer nodes connected to the i node on the i node, Characterize the impact of the perception layer and control layer on the application layer. The degree of change obtained reflects the influence of node i and other nodes with which it has communication connections, so As the adjustment coefficient of each node in the application layer.

[0137] 103-4, determine the monitoring base of any node according to the adjustment coefficient and the change value of each element in the historical safety monitoring parameter sequence.

[0138] The implementation process of step 103-4 is as follows:

[0139] 1. Determine the mean of all historical safety monitoring parameters.

[0140] Taking any node i as an example, if all its historical security monitoring parameters are as shown in Table 5, determine the mean of all historical security monitoring parameters

[0141] Mean G1 i Represents the average parameter value of the i-node.

[0142] 2. Determine the comparison value of historical safety monitoring parameters

[0143] Among them, cv i (max) is the maximum value of the change value of each element in the historical security monitoring parameter sequence of node i, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv i (min) is the minimum value of the change value of each element in the historical security monitoring parameter sequence of node i.

[0144] Taking any node i as an example, if all its historical security monitoring parameters are as shown in Table 5, then:

[0145]

[0146] Therefore, determine the comparison value of historical safety monitoring parameters

[0147] Mean G2 i It represents the average change of the parameter value per unit time of the i-node.

[0148] 3. Determine the monitoring base of any node based on the adjustment coefficient, mean and comparison value.

[0149] For example, determine the monitoring cardinality of any node as

[0150] Among them, G1 i is the mean of the i-node, G2 i is the comparison value of the i-node, Ad i is the adjustment coefficient of the i-node.

[0151] The monitoring base is actually used as a comparison object of the current security monitoring parameters in the current monitoring cycle in step 104. If the current security monitoring parameters in the current monitoring cycle are greater than the monitoring base, it means that the current security monitoring parameters in the current monitoring cycle are abnormal. It represents the average change of the historical value of any security monitoring parameter (such as bandwidth) of the i-node. This change is the normal value of any security monitoring parameter (such as bandwidth) of the i-node. On the basis of this normal value, the normal impact of the intelligent manufacturing system on any security monitoring parameter (such as bandwidth) of the i-node is superimposed (using Ad i Therefore, the impact of the intelligent manufacturing system on the node (i.e. Ad i ), the monitoring base will be Adjust upwards on that basis.

[0152] When adjusting upward, Ad i The smaller it is, the less the i-node is affected, and the monitoring base can have a larger adjustment space on the normal value. i The larger the value, the greater the impact on the i-node. If the monitoring base increases upward from the normal value with less adjustment space, it may be an abnormal phenomenon. Therefore, the upward increase value is related to Ad i Inversely proportional, that is, the increase is 1-Ad i , so the final monitoring base is determined as

[0153] 104 , security monitoring is performed on the intelligent manufacturing system according to the monitoring base and the current security monitoring parameters of each node in the current monitoring cycle.

[0154] In step 104, the monitoring base number is used as the object of comparison (ie, standard value) of the current security monitoring parameter in the current monitoring period for security monitoring.

[0155] The security monitoring process is implemented using existing solutions. For example, if a current security monitoring parameter of a node in the current monitoring cycle is larger than its corresponding monitoring base, it indicates an abnormality and a security warning is issued.

[0156] For another example, the difference between each current safety monitoring parameter in the current monitoring cycle of each node and its corresponding monitoring base is calculated, such as the difference between any current safety monitoring parameter in the current monitoring cycle of any node and its corresponding monitoring base is 1-any current safety monitoring parameter in the current monitoring cycle of any node / any current safety monitoring parameter in the current monitoring cycle of any node and its corresponding monitoring base. If the average difference is less than the preset difference threshold (such as 5%), it means that all current safety monitoring parameters of the abnormal intelligent manufacturing system are relatively close to the comparison object (i.e., the standard value), and it is likely that the intelligent manufacturing system as a whole is uncontrollable, and a safety warning is issued.

[0157] The above implementation process is only an example, and other solutions can be used to implement step 104. This step does not limit the implementation process of step 104. It only needs to perform security monitoring based on the current value and the standard value (ie, the monitoring base).

[0158] Since the monitoring base is flexibly determined according to the situation of the node and the different security monitoring parameters, it is ensured that the monitoring base is closely related to the node and the security monitoring parameters. This ensures the accurate evaluation of the current security monitoring parameters in the current monitoring cycle in step 104, thereby obtaining accurate security monitoring results.

[0159] This embodiment provides a method for security monitoring of an intelligent manufacturing system. According to the monitoring cycle, the historical monitoring time period of each node in the intelligent manufacturing system is determined; the historical security monitoring parameters of each node in the historical monitoring time period are obtained; the monitoring cardinality of each node is determined according to the layer to which each node belongs and the historical security monitoring parameters; and the intelligent manufacturing system is security monitored according to the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle. The method provided in this embodiment determines the historical monitoring time period for each node, determines the monitoring cardinality that meets the characteristics of each node according to the historical security monitoring parameters in the historical monitoring time period, and then performs security monitoring on the intelligent manufacturing system based on the monitoring cardinality and the current security monitoring parameters of each node in the current monitoring cycle, thereby achieving accurate monitoring of the intelligent manufacturing system.

[0160] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0162] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0164] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0165] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for security monitoring of an intelligent manufacturing system, characterized in that: The method comprises: According to the monitoring cycle, determine the historical monitoring time period of each node in the intelligent manufacturing system; Obtain the historical security monitoring parameters of each node within the historical monitoring time period; Determine the monitoring base of each node based on the layer to which each node belongs and historical security monitoring parameters; The intelligent manufacturing system is security monitored according to the monitoring base and the current security monitoring parameters of each node in the current monitoring cycle.

2. The method according to claim 1, characterized in that Determining the historical monitoring time period of each node in the intelligent manufacturing system according to the monitoring cycle includes: For any node, determine its historical monitoring time period through the following steps: Determine the monitoring period involved in any node from the first startup to the current time, and form a monitoring period sequence of any node; wherein the elements in the monitoring period sequence are arranged from far to near according to time; Determine the attribute value of each element in the monitoring cycle sequence of any node; wherein the attribute value of any element is the number of times the node to which it belongs is powered on from the first power-on to the time corresponding to any element; Clustering is performed based on the attribute values ​​of each element in the monitoring period sequence; Determine the number of choices in each class based on the number of elements in each class; where the number of choices in any class i is the node identifier, j is the class identifier, is the number of elements in class j of node i, ne i is the total number of elements in the monitoring cycle sequence of node i, is a floor function, β1 is a preset first ratio, and β2 is a preset second ratio; According to the selected quantities of all classes, a historical monitoring time period of any node is determined.

3. The method according to claim 2, characterized in that The determining of the historical monitoring time period of any node according to the number of selections of all classes includes: like The time period corresponding to the selected number of elements in each category that are the most recent and the last element in the non-monitoring cycle sequence is determined as the historical monitoring time period of any node. The time period corresponding to the last element of the unselected and non-monitoring period sequence is determined as the historical monitoring time period of any node; wherein, α min is the minimum number corresponding to the layer to which any node belongs; like Then select the number of elements that are the closest in time and the last element in the non-monitoring period sequence in each category; from the selected elements, remove them according to the attribute value from small to large and the time corresponding to the elements from far to near elements; the time period corresponding to the selected element after elimination is determined as the historical monitoring time period of any node; wherein, α max is the maximum number corresponding to the layer to which any node belongs.

4. The method according to claim 3, characterized in that Any layer corresponding to Among them, Δt is the monitoring period, t min is the average value of the shortest startup time of all nodes in any layer, is the ceiling function.

5. The method according to claim 1, characterized in that Determining the monitoring base of each node according to the layer to which each node belongs and the historical security monitoring parameters includes: For any node, determine its monitoring cardinality through the following steps: Arrange all historical safety monitoring parameters from far to near according to the collection time of the safety monitoring parameters to form a historical safety monitoring parameter sequence; Determine the change value of each element in the historical safety monitoring parameter sequence; wherein, u is the element identifier of the historical safety monitoring parameter sequence, i is the node identifier, is the historical safety monitoring parameter value of the u-th element of the historical safety monitoring parameter sequence of node i, is the historical security monitoring parameter value of the u-1th element of the historical security monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameters of the u-th element of the historical safety monitoring parameter sequence of node i, is the collection time of the historical safety monitoring parameter of the u-1th element of the historical safety monitoring parameter sequence of the i-th node; Determine an adjustment coefficient according to the layer to which any node belongs; The monitoring cardinality of any node is determined according to the adjustment coefficient and the change value of each element in the historical security monitoring parameter sequence.

6. The method according to claim 5, characterized in that The step of determining the adjustment coefficient according to the layer to which any node belongs includes: If any of the nodes belongs to the perception layer, the adjustment coefficient is determined as Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, and softmax{} is the normalization function.

7. The method according to claim 5, characterized in that The step of determining the adjustment coefficient according to the layer to which any node belongs includes: If any of the nodes belongs to the control layer, the adjustment coefficient is determined as Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv C (avg) is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all nodes in the control layer, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all application layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv A (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, and softmax{} is the normalization function.

8. The method according to claim 5, characterized in that The step of determining the adjustment coefficient according to the layer to which any node belongs includes: If any of the nodes belongs to the application layer, the adjustment coefficient is determined as Among them, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv A (avg) is the average of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the application layer, is the mean of the change values ​​of each element in the historical safety monitoring parameter sequence of all control layer nodes that have communication connection with node i, is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all perception layer nodes that have communication connections with node i, cv P (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the perception layer, cv C (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of all nodes in the control layer, and softmax{} is the normalization function.

9. The method according to claim 5, characterized in that The determining the monitoring cardinality of any node according to the adjustment coefficient and the change value of each element in the historical security monitoring parameter sequence includes: Determine the mean of all historical safety monitoring parameters; Determine the comparison value of historical safety monitoring parameters Among them, cv i (max) is the maximum value of the change value of each element in the historical safety monitoring parameter sequence of node i, cv i (avg) is the mean of the change values ​​of each element in the historical security monitoring parameter sequence of node i, cv i (min) is the minimum value of the change value of each element in the historical security monitoring parameter sequence of node i; The monitoring cardinality of any node is determined according to the adjustment coefficient, the mean value and the comparison value.

10. The method according to claim 9, characterized in that Determining the monitoring cardinality of any node according to the adjustment coefficient, the mean value and the comparison value includes: Determine the monitoring base of any node as Among them, G1 i is the mean of the i-node, G2 i is the comparison value of node i, Ad i is the adjustment coefficient of the i-node.

Images