Security situation awareness method and system based on smart city

Abstract

The invention relates to the technical field of smart city safety, and discloses a security situation awareness method and system based on a smart city, and the system comprises a data collection unit, a feature extraction unit, a situation analysis unit, and an early warning display unit. According to the invention, various data such as network traffic, logs, Internet of Things equipment operation states, urban infrastructure monitoring and the like can be acquired from multiple data sources, and a rich data foundation is laid for security situation analysis; detailed extraction modes are designed for different data, feature vector sets in the aspects of network traffic, logs, Internet of Things equipment, infrastructures and the like are obtained respectively, and safety related information can be deeply mined; the characteristic index value of each set is determined through comparison with a preset threshold value, and an overall security situation value is calculated by combining a weight coefficient, so that objective and accurate quantitative evaluation is realized; and according to comparison between the security situation value and the preset threshold value, different levels of early warning signals are generated or the security situation is judged to be normal, so that targeted measures are conveniently taken, and stable and safe operation of the smart city is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of smart city security technology, and in particular to a security situation awareness method and system based on a smart city. Background Art

[0002] In today's era, the deep integration of urbanization and information technology has given rise to smart cities. It integrates a variety of information and communication technologies, involving urban networks, information systems, Internet of Things devices, and urban infrastructure. Power facilities, water supply facilities, etc. are important components of urban infrastructure, and their normal operation is crucial to urban development.

[0003] However, smart cities face severe security challenges. In urban networks, the network architecture is complex and the traffic is huge. Malicious attack traffic such as DDoS attacks may be hidden in them at any time, destroying network services. Information systems contain a large amount of sensitive information. Once they are invaded by means such as phishing, the leakage of account passwords will lead to data theft, which will seriously damage the city's image and the rights of residents. Although IoT devices are spread all over the city, they are convenient for management and services, but they are easy to be controlled due to loopholes such as default passwords that have not been changed, resulting in data tampering or becoming an entry point for invading other systems. In terms of urban infrastructure, attacks on power facilities will cause large-scale power outages, and problems with water supply facilities will affect residential and industrial water use, thereby disrupting social order.

[0004] Traditional security measures are difficult to deal with. They are mostly scattered and isolated. Network security protection focuses on border defense but not internal traffic detection. Information system security focuses on its own vulnerabilities and access control, and lacks linkage with other aspects. IoT device security management is weak, making it difficult to monitor and evaluate a large number of devices as a whole. Urban infrastructure security focuses on physical protection and ignores the risks of digital monitoring systems.

[0005] In view of this, there is an urgent need for an innovative and comprehensive security situation awareness system to fill the gap in the field of overall security situation awareness and early warning technology for smart cities and to safeguard the healthy development of smart cities. Summary of the invention

[0006] The purpose of the present invention is to provide a security situation awareness method and system based on a smart city, which solves the technical problems raised in the background technology.

[0007] The purpose of the present invention can be achieved through the following technical solutions: A security situation awareness system based on smart city, comprising: A data collection unit, used for collecting target data from multiple data sources; A feature extraction unit is used to perform feature extraction processing on target data collected from multiple data sources and obtain corresponding feature vectors; The situation analysis unit is used to perform situation assessment based on the corresponding feature vector obtained by the feature extraction unit, and to determine whether the smart city security situation generates a warning signal based on the situation assessment result, and to determine the level of the warning signal; The warning display unit is used to broadcast warning signals of corresponding levels.

[0008] As a further solution of the present invention: target data includes but is not limited to: Network traffic data in the city network; Log data of various information systems; Operational status data of IoT devices; Monitoring data of urban infrastructure, including urban infrastructure such as power facilities and water supply facilities.

[0009] As a further solution of the present invention: for network flow data, flow collection equipment is deployed at key nodes of the urban network to collect relevant information of network data packets at specified time intervals, such as source IP address, destination IP address, port number, protocol type, data packet size, etc., and store them as a network flow data set N={n i1}, and i1=1, 2, ... k1, where n i1 represents the i1th network flow data record, k1 represents the number of network flow data records; For the log data of the information system, log information is collected from each information system server through log collection tools, including user login information and system operation records. The user login information includes user name, login time, login IP, etc., and the system operation records include file access, data modification, etc., and are stored as a log data set R = {r i2}, and i2=1, 2, ... k2, where r i2 represents the i2th log data record, and k2 represents the number of log data records; For the operation status data of IoT devices, the interface provided by the IoT device management platform is used to obtain the device status information. The device status information includes whether the device is online and the operation parameters corresponding to each attribute in the device. Among them, each attribute includes temperature, humidity, power, etc., and it is stored as the IoT device data set U={u i3}, and i3=1, 2, ... k3, where u i3 represents the i3th IoT device data record, and k3 represents the number of IoT device data records; For urban infrastructure monitoring data, data is collected from the corresponding monitoring system, which includes voltage, current, and power data in the power system, water pressure and flow data in the water supply system, etc., and stored as the infrastructure data set F = {f i4}, and i4=1, 2, ... k4, where f i4 represents the i4th infrastructure data record, and k4 represents the number of infrastructure data records.

[0010] As a further solution of the present invention: the feature extraction processing method is as follows: StepA1. In the network traffic data set: StepA1.1. Extract the size of the data packet in k1 network traffic data records and mark it as NB i1 ; Then pass: Calculate the total network traffic NBZ; Also through: Calculate the average flow rate NBP of network traffic; StepA1.2. Count the number of connections between different source IP addresses and destination IP addresses and record it as C num ; It traverses k1 network traffic data records, and whenever a new source-destination IP pair is found, the number of connections is increased by 1; StepA1.3. Extract the number of network traffic data records of different protocol types and mark them as NX p1 , p1=1, 2, ... v1, v1 represents the number of different protocol types; Then through: Calculate the proportion of different protocol types in network traffic BX p1 ; Among them, different protocol types include TCP, UDP, ICMP, etc. StepA1.4, the total network traffic NBZ, the average network traffic speed NBP, the number of connections C num , the proportion of different protocol types in network traffic BX p , combined into a network traffic feature vector set Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ]; StepA2, in the log data collection: StepA2.1. Count the number of logins and operations of different users in a unit time, and mark them as U1 p2 and U2 p2, p2=1, 2, ... v2, v2 represents the number of different users; The number of logins is calculated by traversing k1 log data records, and when a new user login record is found, the number of logins of the corresponding user is increased by 1; the number of operations is calculated by traversing k1 log data records, and when a user operation record is found, the number of operations of the corresponding user is increased by 1; At the same time, count the number of failed logins for different users and mark it as F1 p2 ; Then pass: Calculate the login failure rate UF of different users per unit time p2 ; StepA2.2. Count the number of occurrences of different system error codes in the log and mark them as F2 p3 , p3=1, 2, ... v3, v3 represents the number of different system error codes; Then pass: Calculate the frequency of occurrence of different system error codes CF p3 ; StepA2.3, the number of login times of different users U1 p2 And the number of operations U2 p2 、Login failure rate of different users UF p2 , Frequency of occurrence of different system error codes CF p3 , combined into a log feature vector set Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ]; StepA3, in the IoT device data set: StepA3.1. Count the total offline time of each IoT device and the total monitoring time of each IoT device, and record them as SJ1 p4 and SJ0 p4 , p4=1, 2, …, v4, v4 represents the number of IoT devices; Then through: Calculate the device offline rate LS of each IoT device p4 ; StepA3.2, extract the total number of collection times of the operating parameters corresponding to each attribute in the IoT device within a unit time, and mark it as JC0 p5 , p5=1, 2, …, v5, v5 represents the number of each attribute in the IoT device; At the same time, the number of abnormalities of the operating parameters corresponding to each attribute in the IoT device is extracted and marked as JC1 p5 ; Among them, the number of abnormalities of the operating parameters corresponding to the corresponding attributes is determined according to the preset operating parameter range of the corresponding attributes, and the operating parameters corresponding to each attribute in the IoT device are traversed. Whenever it is found that the operating parameter corresponding to an attribute is not within the operating parameter range of the corresponding attribute, the number of abnormalities of the operating parameter corresponding to the corresponding attribute is increased by 1; Then through: Calculate the abnormal change rate YJ of parameters of each IoT device p5 ; StepA3.3: Set the device offline rate LS of each IoT device p4 and the abnormal change rate of parameters of each IoT device YJ p5 , combined into the IoT device feature vector set Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5 ]; StepA4. In the infrastructure data set: StepA4.1. Extract the operating parameters corresponding to each attribute of the infrastructure in unit time and mark them as SY p6，p7 ; p6=1, 2, ... v6, v6 represents the number of each attribute of the infrastructure; p7=1, 2, ... v7, v7 represents the number of an attribute collected per unit time; Among them, the operating parameters corresponding to each attribute are the voltage value, current value, and power value in the power system, and the water pressure value and flow value in the water supply system; Then pass: Calculate the average value SYP of various attributes corresponding to the operating parameters in unit time p7 ; StepA4.2. Collect the operating parameters corresponding to various attributes in unit time, extract the maximum and minimum values ​​of the operating parameters corresponding to each attribute, and mark them as SYmax p7 and SYmin p7 ; Afterwards via: Calculate the fluctuation coefficient BSY corresponding to each attribute of the infrastructure p7 ; StepA4.3, the average value SYP of various attributes corresponding to the operating parameters p7 The fluctuation coefficient BSY corresponding to each attribute p7 , combined into the infrastructure feature vector set Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ].

[0011] As a further solution of the present invention: the situation assessment method is as follows: StepB1, in the network traffic feature vector set Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ]middle: Then Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ] are compared with the corresponding preset upper and lower safety thresholds: If Z N If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; Then extract Z N The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the network traffic feature vector set Z NThe characteristic index value is marked as Z0 N ; Step B2, in the log feature vector set Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ]middle: Then Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ] are compared with the corresponding preset upper and lower safety thresholds: If Z R If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; Then extract Z R Assign the index values ​​of all feature vectors in and add the index values ​​of all feature vectors to get the log feature vector set Z R The characteristic index value is marked as Z0 R ; Step B3, in the IoT device feature vector set Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5]middle: Then Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5 ] are compared with the corresponding preset upper and lower safety thresholds: If Z U If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; Then extract Z U The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the feature vector set Z of IoT devices U The characteristic index value is marked as Z0 U ; Step B4: In the infrastructure feature vector set Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ]middle: Then Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ] are compared with the corresponding preset upper and lower safety thresholds: If Z F If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; Then extract Z F The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the infrastructure feature vector set Z F The characteristic index value is marked as Z0 F ; Step B5, through: Calculate the overall security situation value ZM0 of the smart city; In the formula, β N , β R , β U , β F is the preset weight coefficient; Step B6, compare the security situation value ZM0 with the preset security situation threshold ZMy: If ZM0 ≥ 1.2 × ZMy, an advanced warning signal is generated; Advanced warning signals indicate that smart cities face serious security threats, including large-scale cyber attacks and failures of critical infrastructure. If ZMy≤ZM0<1.2×ZMy, an intermediate warning signal is generated; Intermediate warning signals indicate that there are many security risks in the smart city, such as local network anomalies, many erroneous operations in some information systems, or frequent failures of IoT devices. If 0.8×ZMy≤ZM0<ZMy, a low-level warning signal is generated; Low-level warning signals indicate that the smart city mainly has some minor abnormalities, such as individual network connection abnormalities, a small number of log errors, or fluctuations in parameters of individual IoT devices; If ZM0<0.8×ZMy, no corresponding warning signal is generated, which indicates that the security situation of the smart city is normal.

[0012] A security situation awareness method based on smart city, the method is implemented by the security situation awareness system based on smart city, and the method comprises the following steps: Step 1: Collect data: Collect target data from multiple data sources; Step 2: Extract features: Perform feature extraction on target data collected from multiple data sources and obtain corresponding feature vectors; Step 3: Analyze the situation: According to the feature extraction unit, a corresponding feature vector is obtained to perform situation assessment, and according to the situation assessment result, it is determined whether the smart city security situation generates a warning signal, and the level of the warning signal is determined; Step 4: Early warning broadcast: The warning signals of corresponding levels will be broadcast as warnings.

[0013] Beneficial effects of the present invention: Comprehensive data collection and integration: It can collect target data from multiple data sources, including network traffic data in the city network, log data of various information systems, operating status data of IoT devices, and monitoring data of urban infrastructure. By collecting these different types of data from a wide range of sources, we can fully understand the various aspects of smart city operation, providing a rich data foundation for subsequent accurate security situation analysis.

[0014] Fine feature extraction: Detailed feature extraction processing methods are designed for different types of data. For example, in terms of network traffic data, the total amount of network traffic, average flow rate, number of connections, proportion of different protocol types and other features can be extracted to form a set of network traffic feature vectors; for log data, the login and operation-related features of different users, login failure rate, frequency of occurrence of system error codes, etc. can be extracted to form a set of log feature vectors; similar fine extraction is also done on IoT device data and infrastructure data to obtain corresponding feature vector sets. This fine feature extraction helps to dig deeper into the security-related information hidden in the data, thereby more accurately assessing the security situation.

[0015] Scientific situation assessment: By comparing each feature vector set with the corresponding preset upper and lower limits of the security threshold, the characteristic index value of each set is determined based on the comparison results, and then the overall security situation value of the smart city is calculated through the preset weight coefficient. This scientific assessment method can comprehensively consider various factors and give a relatively objective and accurate quantitative assessment result of the security situation of the smart city.

[0016] Reasonable early warning classification: By comparing the calculated security situation value with the preset security situation threshold, different levels of early warning signals can be generated, including high-level, medium-level, and low-level early warning signals, as well as the situation where no early warning signal is generated when the security situation is normal. This reasonable early warning classification mechanism allows relevant personnel to clearly understand the severity of the security threats faced by smart cities, so that targeted response measures can be taken, effectively improving the ability of smart cities to respond to security risks and ensuring their stable and safe operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention will be further described below in conjunction with the accompanying drawings.

[0018] Figure 1 It is a system block diagram of a security situation awareness system based on a smart city in the present invention.

[0019] Figure 2 It is a flow chart of a security situation awareness method based on smart city in the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Embodiment 1 See also Figure 1 and Figure 2 As shown, the present invention is a security situation awareness system based on smart city, comprising: A data collection unit, used for collecting target data from multiple data sources; Target data includes but is not limited to: Network traffic data in the city network; Log data of various information systems; Operational status data of IoT devices; Monitoring data of urban infrastructure, including urban infrastructure such as power facilities and water supply facilities; In this embodiment, these data sources cover all key aspects of smart city operations and can provide a comprehensive information foundation for security situation awareness; For network traffic data, traffic collection equipment is deployed at key nodes of the urban network to collect relevant information of network data packets at specified time intervals, such as source IP address, destination IP address, port number, protocol type, packet size, etc., and store them as a network traffic data set N={n i1}, and i1=1, 2, ... k1, where n i1 represents the i1th network flow data record, k1 represents the number of network flow data records; For the log data of the information system, log information is collected from each information system server through log collection tools, including user login information and system operation records. The user login information includes user name, login time, login IP, etc., and the system operation records include file access, data modification, etc., and are stored as a log data set R = {r i2}, and i2=1, 2, ... k2, where r i2 represents the i2th log data record, and k2 represents the number of log data records; For the operation status data of IoT devices, the interface provided by the IoT device management platform is used to obtain the device status information. The device status information includes whether the device is online and the operation parameters corresponding to each attribute in the device. Among them, each attribute includes temperature, humidity, power, etc., and it is stored as the IoT device data set U={u i3}, and i3=1, 2, ... k3, where u i3 represents the i3th IoT device data record, and k3 represents the number of IoT device data records; For urban infrastructure monitoring data, data is collected from the corresponding monitoring system, which includes voltage, current, and power data in the power system, water pressure and flow data in the water supply system, etc., and stored as the infrastructure data set F = {f i4}, and i4=1, 2, ... k4, where f i4 represents the i4th infrastructure data record, k4 represents the number of infrastructure data records; The infrastructure data set F is a container for storing raw data obtained from the urban infrastructure monitoring system. These data cover information such as voltage, current, and power of the power system and water pressure and flow of the water supply system. In this embodiment, when i4=1, f i4 Represents the voltage data in the power system. When i4=2, f i4 Represents the current data in the power system. When i4=3, f i4 Represents the power data in the power system. When i4=4, f i4 Represents the water pressure data in the power system. When i4=5, f i4 Represents flow data in the power system; A feature extraction unit is used to perform feature extraction processing on target data collected from multiple data sources and obtain corresponding feature vectors; The specific method is as follows: StepA1. In the network traffic data set: StepA1.1. Extract the size of the data packet in k1 network traffic data records and mark it as NB i1 ; Then pass: Calculate the total network traffic NBZ; Also through: Calculate the average flow rate NBP of network traffic; StepA1.2. Count the number of connections between different source IP addresses and destination IP addresses and record it as Cnum ; It traverses k1 network traffic data records, and whenever a new source-destination IP pair is found, the number of connections is increased by 1; StepA1.3. Extract the number of network traffic data records of different protocol types and mark them as NX p1 , p1=1, 2, ... v1, v1 represents the number of different protocol types; Then through: Calculate the proportion of different protocol types in network traffic BX p1 ; Among them, different protocol types include TCP, UDP, ICMP, etc. StepA1.4, the total network traffic NBZ, the average network traffic speed NBP, the number of connections C num , the proportion of different protocol types in network traffic BX p , combined into a network traffic feature vector set Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ]; StepA2, in the log data collection: StepA2.1. Count the number of logins and operations of different users in a unit time, and mark them as U1 p2 and U2 p2 , p2=1, 2, ... v2, v2 represents the number of different users; The number of logins is calculated by traversing k1 log data records, and when a new user login record is found, the number of logins of the corresponding user is increased by 1; the number of operations is calculated by traversing k1 log data records, and when a user operation record is found, the number of operations of the corresponding user is increased by 1; At the same time, count the number of failed logins for different users and mark it as F1 p2 ; Then pass: Calculate the login failure rate UF of different users per unit time p2 ; StepA2.2. Count the number of occurrences of different system error codes in the log and mark them as F2 p3 , p3=1, 2, ... v3, v3 represents the number of different system error codes; Then pass: Calculate the frequency of occurrence of different system error codes CF p3 ; StepA2.3, the number of login times of different users U1 p2 And the number of operations U2 p2 、Login failure rate of different users UF p2 , Frequency of occurrence of different system error codes CF p3 , combined into a log feature vector set Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ]; StepA3, in the IoT device data set: StepA3.1. Count the total offline time of each IoT device and the total monitoring time of each IoT device, and record them as SJ1 p4 and SJ0 p4 , p4=1, 2, …, v4, v4 represents the number of IoT devices; Then through: Calculate the device offline rate LS of each IoT device p4 ; StepA3.2, extract the total number of collection times of the operating parameters corresponding to each attribute in the IoT device within a unit time, and mark it as JC0 p5 , p5=1, 2, …, v5, v5 represents the number of each attribute in the IoT device; At the same time, the number of abnormalities of the operating parameters corresponding to each attribute in the IoT device is extracted and marked as JC1 p5 ; Among them, the number of abnormalities of the operating parameters corresponding to the corresponding attributes is determined according to the preset operating parameter range of the corresponding attributes, and the operating parameters corresponding to each attribute in the IoT device are traversed. Whenever it is found that the operating parameter corresponding to an attribute is not within the operating parameter range of the corresponding attribute, the number of abnormalities of the operating parameter corresponding to the corresponding attribute is increased by 1; Then through: Calculate the abnormal change rate YJ of parameters of each IoT device p5 ; StepA3.3: Set the device offline rate LS of each IoT device p4 and the abnormal change rate of parameters of each IoT device YJ p5 , combined into the IoT device feature vector set Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5 ]; StepA4. In the infrastructure data set: StepA4.1. Extract the operating parameters corresponding to each attribute of the infrastructure in unit time and mark them as SY p6，p7 ; p6=1, 2, ... v6, v6 represents the number of each attribute of the infrastructure; p7=1, 2, ... v7, v7 represents the number of an attribute collected per unit time; Among them, the operating parameters corresponding to each attribute are the voltage value, current value, and power value in the power system, and the water pressure value and flow value in the water supply system; Then pass: Calculate the average value SYP of various attributes corresponding to the operating parameters in unit time p7 ; StepA4.2. Collect the operating parameters corresponding to various attributes in unit time, extract the maximum and minimum values ​​of the operating parameters corresponding to each attribute, and mark them as SYmax p7 and SYmin p7 ; Afterwards via: Calculate the fluctuation coefficient BSY corresponding to each attribute of the infrastructure p7 ; StepA4.3, the average value SYP of various attributes corresponding to the operating parameters p7 The fluctuation coefficient BSY corresponding to each attribute p7 , combined into the infrastructure feature vector set Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ].

[0022] This embodiment builds a comprehensive data collection system, covering multiple data sources such as urban networks, information systems, IoT devices, and urban infrastructure, which can provide a rich and diverse and critical information foundation for subsequent security situation awareness, so that the system has a comprehensive data grasp of the operation status of the smart city. A sophisticated feature extraction method is designed for different types of data, which can extract representative and security-related feature vectors from each data set, which helps to deeply mine security-related information in the data and lay the foundation for accurate assessment of security situation.

[0023] Embodiment 2 As the second embodiment of the present invention, when the present application is implemented, compared with the first embodiment, the technical solution of the present embodiment is different from that of the first embodiment only in that the present embodiment further includes: A situation analysis unit, used for performing situation assessment based on the corresponding feature vector obtained by the feature extraction unit; The specific method is as follows: StepB1, in the network traffic feature vector set Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ]middle: Then Z N =[NBZ, NBP, C num , BX 1 , BX 2 ,...BX v1 ] are compared with the corresponding preset upper and lower safety thresholds: If Z N If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; In this embodiment, it is assumed that: the total amount of network traffic corresponds to the preset upper and lower limits of the security threshold, NBZmax and NBZmin respectively; When NBZ>NBZmax, the indicator value of total network traffic is assigned to "1"; When NBZ<NBZmin, the indicator value of total network traffic is assigned to “-1”; When NBZmin≤NBZ≤NBZmax, the indicator value of total network traffic is assigned to "0"; Then extract Z N The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the network traffic feature vector set Z N The characteristic index value is marked as Z0 N ; Step B2, in the log feature vector set Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ]middle: Then Z R =[U1 1 、U1 2 , ...U1 v2 、U2 1 、U2 2 , ...U2 v2 、UF 1 、UF 2 、……UF v2 CF 1 CF 2 , ……CF v3 ] are compared with the corresponding preset upper and lower safety thresholds: If Z R If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; In this embodiment, it is assumed that: the user login failure rate UF 1 The corresponding preset upper and lower limits of the safety threshold are UFmax and UFmin respectively; When UF 1 >UFmax, the total network traffic index is assigned a value of "1"; When UF 1<UFmin, the total network traffic index is assigned a value of “-1”; When UFmin≤UF 1 ≤UFmax, the total network traffic index is assigned a value of "0"; Then extract Z R Assign the index values ​​of all feature vectors in and add the index values ​​of all feature vectors to get the log feature vector set Z R The characteristic index value is marked as Z0 R ; Step B3, in the IoT device feature vector set Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5 ]middle: Then Z U =[LS 1 LS 2 , ...LS v4 , YJ 1 , YJ 2 , ...YJ v5 ] are compared with the corresponding preset upper and lower safety thresholds: If Z U If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; In this embodiment, it is assumed that: the device offline rate LS 1 The corresponding preset upper and lower limits of the safety threshold are LSmax and LSmin respectively; When LS 1 >LSmax, the total network traffic index is assigned a value of "1"; When LS 1 <LSmin, the total network traffic index is assigned a value of "-1"; When LSmin≤LS 1 ≤LSmax, the total network traffic index is assigned a value of "0"; Then extract Z UThe index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the feature vector set Z of IoT devices U The characteristic index value is marked as Z0 U ; Step B4: In the infrastructure feature vector set Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ]middle: Then Z F =[SYP 1 SYP 2 , SYP v7 ,BSY 1 ,BSY 2 ,...BSY v7 ] are compared with the corresponding preset upper and lower safety thresholds: If Z F If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; In this embodiment, it is assumed that the fluctuation coefficient BSY corresponding to an attribute of the infrastructure is 1 The corresponding preset upper and lower limits of the safety threshold are BSYmax and BSYmin respectively; When BSY 1 >BSYmax, the total network traffic index is assigned a value of "1"; When BSY 1 <BSYmin, the total network traffic index is assigned a value of "-1"; When BSYmin≤BSY 1 ≤BSYmax, the total network traffic index is assigned a value of "0"; Then extract Z F The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the infrastructure feature vector set Z F The characteristic index value is marked as Z0 F ; Step B5, through: Calculate the overall security situation value ZM0 of the smart city; In the formula, β N , β R , β U , β F is the preset weight coefficient; Step B6, compare the security situation value ZM0 with the preset security situation threshold ZMy: If ZM0 ≥ 1.2 × ZMy, an advanced warning signal is generated; Advanced warning signals indicate that smart cities face serious security threats, including large-scale cyber attacks and failures of critical infrastructure. If ZMy≤ZM0<1.2×ZMy, an intermediate warning signal is generated; Intermediate warning signals indicate that there are many security risks in the smart city, such as local network anomalies, many erroneous operations in some information systems, or frequent failures of IoT devices. If 0.8×ZMy≤ZM0<ZMy, a low-level warning signal is generated; Low-level warning signals indicate that the smart city mainly has some minor abnormalities, such as individual network connection abnormalities, a small number of log errors, or fluctuations in parameters of individual IoT devices; If ZM0<0.8×ZMy, no corresponding warning signal is generated, which indicates that the security situation of the smart city is normal.

[0024] This embodiment sets up a situation analysis unit, which scientifically determines the characteristic index value by comparing each feature vector set with the preset upper and lower limits of the security threshold, and then calculates the overall security situation value of the smart city in combination with the weight coefficient, thereby realizing a quantitative assessment of the security situation and enabling the security situation to be intuitively presented and accurately judged. By comparing the security situation value with the preset threshold, different levels of early warning signals can be generated, which can effectively distinguish the degree of security threats, provide a basis for the formulation of subsequent targeted response measures, and improve the efficiency and accuracy of security management.

[0025] Embodiment 3 As the third embodiment of the present invention, when the present application is implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments, and the difference between the technical solution of this embodiment and the first and second embodiments is that this embodiment also includes: The warning display unit is used to broadcast the warning signals of corresponding levels; In this example: For advanced warnings: emergency alerts are sent to the smart city security management center, and warning information is pushed to the mobile terminals of heads of departments at all levels in the city, including detailed abnormal feature data, such as the source IP address of abnormal network traffic, frequently occurring error codes in logs, the location and type of faulty IoT devices, abnormal parameters of infrastructure, etc., as well as possible response suggestions, such as disconnecting suspicious network connections, starting information system backups, and urgently repairing IoT devices or infrastructure. Warning notices are issued on urban public information platforms, such as smart city apps and official websites, to inform citizens of the possible impact range and recommended preventive measures. For example, some areas may experience power outages and water outages, and citizens are advised to reserve domestic water and emergency lighting equipment in advance. For intermediate warnings: send warning emails to the security management center and relevant information system administrators, and IoT equipment operation and maintenance personnel. The email content contains abnormal feature data and preliminary troubleshooting suggestions; highlight the warning information on the security management center's monitoring screen so that staff can pay attention and handle it in a timely manner.

[0026] For low-level warnings: record warning information in the internal system of the security management center, notify relevant on-duty personnel to pay attention and further monitor, regularly summarize warning information and analyze its development trends to promptly discover potential escalation of security risks.

[0027] This embodiment is equipped with an early warning display unit, and has formulated corresponding broadcast and notification mechanisms for different levels of early warning. In the case of high-level early warning, detailed information and response suggestions can be delivered to multiple departments and citizens in a timely manner, protecting the right of all parties to know and facilitating coordinated response; intermediate early warning can ensure that relevant professionals receive early warnings and investigation suggestions in a timely manner, facilitating rapid processing; low-level early warning can enable on-duty personnel to pay attention and monitor to prevent risk escalation, and overall improve the smart city's response capabilities and prevention effects in response to security incidents.

[0028] Embodiment 4 As the fourth embodiment of the present invention, when the present application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine and implement the solutions of the above-mentioned first, second and third embodiments.

[0029] This embodiment integrates all the beneficial effects of embodiments one, two, and three to form a complete security situation awareness system based on smart cities. It operates collaboratively throughout the entire process from data collection, feature extraction, situation assessment to early warning display, comprehensively ensuring the safe and stable operation of smart cities, effectively preventing and responding to various security risks, improving the overall security and reliability of smart cities, and providing solid security support for the intelligent development of cities.

[0030] The present invention also provides a security situation awareness method based on a smart city, which is implemented by a security situation awareness system based on a smart city. The method comprises the following steps: Step 1: Collect data: Collect target data from multiple data sources; Step 2: Extract features: Perform feature extraction on target data collected from multiple data sources and obtain corresponding feature vectors; Step 3: Analyze the situation: According to the feature extraction unit, a corresponding feature vector is obtained to perform situation assessment, and according to the situation assessment result, it is determined whether the smart city security situation generates a warning signal, and the level of the warning signal is determined; Step 4: Early warning broadcast: The warning signals of corresponding levels will be broadcast as warnings.

[0031] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0032] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security situation awareness system based on smart city, characterized in that: include: A data collection unit, used for collecting target data from multiple data sources; A feature extraction unit is used to perform feature extraction processing on target data collected from multiple data sources and obtain corresponding feature vectors; The situation analysis unit is used to perform situation assessment based on the corresponding feature vector obtained by the feature extraction unit, and to determine whether the smart city security situation generates a warning signal based on the situation assessment result, and to determine the level of the warning signal; The warning display unit is used to broadcast warning signals of corresponding levels.

2. According to the security situation awareness system based on smart city in claim 1, it is characterized in that: Target data includes but is not limited to: Network traffic data in the city network; it deploys traffic collection equipment at key nodes of the city network, collects relevant information of network data packets at specified time intervals, including source IP address, destination IP address, port number, protocol type, and data packet size, and stores it as a network traffic data set N={n i1 }, and i1=1, 2, ... k1, where n i1 represents the i1th network flow data record, k1 represents the number of network flow data records; Log data of various information systems; log information is collected from various information system servers through log collection tools, including user login information and system operation records, and user login information includes user name, login time, login IP, and system operation records include file access and data modification, and stored as log data set R = {r i2 }, and i2=1, 2, ... k2, where r i2 represents the i2th log data record, and k2 represents the number of log data records; The operating status data of IoT devices; it uses the interface provided by the IoT device management platform to obtain the device status information, which includes whether the device is online and the operating parameters corresponding to each attribute in the device, where each attribute includes temperature, humidity, and power, and stores it as the IoT device data set U={u i3 }, and i3=1, 2, ... k3, where u i3 represents the i3th IoT device data record, and k3 represents the number of IoT device data records; Monitoring data of urban infrastructure: For urban infrastructure monitoring data, data is collected from the corresponding monitoring system, which includes voltage, current, and power data in the power system, and water pressure and flow data in the water supply system, and stored as the infrastructure data set F = {f i4 }, and i4=1, 2, ... k4, where f i4 represents the i4th infrastructure data record, and k4 represents the number of infrastructure data records.

3. A security situation awareness system based on smart city according to claim 2, characterized in that: The feature extraction process for the network traffic data set is as follows: StepA1.

1. Extract the size of the data packet in k1 network traffic data records and mark it as NB i1 ; Then pass: ； Calculate the total network traffic NBZ; Also through: ； Calculate the average flow rate NBP of network traffic; StepA1.

2. Count the number of connections between different source IP addresses and destination IP addresses and record it as C num ; It traverses k1 network traffic data records, and whenever a new source-destination IP pair is found, the number of connections is increased by 1; StepA1.

3. Extract the number of network traffic data records of different protocol types and mark them as NX p1 , p1=1, 2, ... v1, v1 represents the number of different protocol types; Then through: ； Calculate the proportion of different protocol types in network traffic BX p1 ; Among them, different protocol types include TCP, UDP, and ICMP; StepA1.4, the total network traffic NBZ, the average network traffic speed NBP, the number of connections C num , the proportion of different protocol types in network traffic BX p , combined into a network traffic feature vector set Z N =[NBZ, NBP, C num , BX1, BX2, ... BX v1 ].

4. The security situation awareness system based on smart city according to claim 3 is characterized in that: The feature extraction process for the log data set is as follows: StepA2.

1. Count the number of logins and operations of different users in a unit time, and mark them as U1 p2 and U2 p2 , p2=1, 2, ... v2, v2 represents the number of different users; The number of logins is calculated by traversing k1 log data records, and when a new user login record is found, the number of logins of the corresponding user is increased by 1; the number of operations is calculated by traversing k1 log data records, and when a user operation record is found, the number of operations of the corresponding user is increased by 1; At the same time, count the number of failed logins for different users and mark it as F1 p2 ; Then pass: ； Calculate the login failure rate UF of different users per unit time p2 ; StepA2.

2. Count the number of occurrences of different system error codes in the log and mark them as F2 p3 , p3=1, 2, ... v3, v3 represents the number of different system error codes; Then pass: ； Calculate the frequency of occurrence of different system error codes CF p3 ; StepA2.3, the number of login times of different users U1 p2 And the number of operations U2 p2 、Login failure rate of different users UF p2 , Frequency of occurrence of different system error codes CF p3 , combined into a log feature vector set Z R =[U11, U12, ... U1 v2 、U21、U22、……U2 v2 、UF1、UF2、……UF v2 , CF1, CF2, ... CF v3 ].

5. A security situation awareness system based on smart city according to claim 4, characterized in that: The feature extraction process for IoT device data sets is as follows: StepA3.

1. Count the total offline time of each IoT device and the total monitoring time of each IoT device, and record them as SJ1 p4 and SJ0 p4 , p4=1, 2, …, v4, v4 represents the number of IoT devices; Then through: ; Calculate the device offline rate LS of each IoT device p4 ; StepA3.2, extract the total number of collection times of operating parameters corresponding to each attribute in the IoT device within a unit time, and mark it as JC0 p5 , p5=1, 2, …, v5, v5 represents the number of each attribute in the IoT device; At the same time, the number of abnormalities of the operating parameters corresponding to each attribute in the IoT device is extracted and marked as JC1 p5 ; Among them, the number of abnormalities of the operating parameters corresponding to the corresponding attributes is determined according to the preset operating parameter range of the corresponding attributes, and the operating parameters corresponding to each attribute in the IoT device are traversed. Whenever it is found that the operating parameter corresponding to an attribute is not within the operating parameter range of the corresponding attribute, the number of abnormalities of the operating parameter corresponding to the corresponding attribute is increased by 1; Then through: ; Calculate the abnormal change rate YJ of parameters of each IoT device p5 ; StepA3.3: Set the device offline rate LS of each IoT device p4 and the abnormal change rate of parameters of each IoT device YJ p5 , combined into the IoT device feature vector set Z U =[LS1, LS2, ...LS v4 、YJ1、YJ2、……YJ v5 ].

6. A security situation awareness system based on smart city according to claim 5, characterized in that: The feature extraction process for the infrastructure data set is as follows: StepA4.

1. Extract the operating parameters corresponding to each attribute of the infrastructure in unit time and mark them as SY p6，p7 ; p6=1, 2, ... v6, v6 represents the number of each attribute of the infrastructure; p7=1, 2, ... v7, v7 represents the number of an attribute collected per unit time; Among them, the operating parameters corresponding to each attribute are the voltage value, current value, and power value in the power system, and the water pressure value and flow value in the water supply system; Then pass: ； Calculate the average value SYP of various attributes corresponding to the operating parameters in unit time p7 ; StepA4.

2. Collect the operating parameters corresponding to various attributes in unit time, extract the maximum and minimum values ​​of the operating parameters corresponding to each attribute, and mark them as SYmax p7 and SYmin p7 ; Afterwards via: ； Calculate the fluctuation coefficient BSY corresponding to each attribute of the infrastructure p7 ; StepA4.3, the average value SYP of various attributes corresponding to the operating parameters p7 The fluctuation coefficient BSY corresponding to each attribute p7 , combined into the infrastructure feature vector set Z F =[SYP1, SYP2, ...SYP v7 、BSY1、BSY2、……BSY v7 ].

7. A security situation awareness system based on smart city according to claim 6, characterized in that: The situation assessment method is as follows: StepB1, in the network traffic feature vector set Z N =[NBZ, NBP, C num , BX1, BX2, ... BX v1 ]middle: Then Z N =[NBZ, NBP, C num , BX1, BX2, ... BX v1 ] are compared with the corresponding preset upper and lower limits of the security threshold, and the network traffic feature vector set Z is determined based on the comparison results. N The index assignment of each eigenvector in ; Then extract Z N The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the network traffic feature vector set Z N The characteristic index value is marked as Z0 N ; Step B2, in the log feature vector set Z R =[U11, U12, ... U1 v2 、U21、U22、……U2 v2 、UF1、UF2、……UF v2 , CF1, CF2, ... CF v3 ]middle: Then Z R =[U11, U12, ... U1 v2 、U21、U22、……U2 v2 、UF1、UF2、……UF v2 , CF1, CF2, ... CF v3 ] are compared with the corresponding preset upper and lower limits of the safety threshold, and the log feature vector set Z is determined based on the comparison results. R The index assignment of each eigenvector in ; Then extract Z R Assign the index values ​​of all feature vectors in and add the index values ​​of all feature vectors to get the log feature vector set Z R The characteristic index value is marked as Z0 R ; Step B3, in the IoT device feature vector set Z U =[LS1, LS2, ...LS v4 、YJ1、YJ2、……YJ v5 ]middle: Then Z U =[LS1, LS2, ...LS v4 、YJ1、YJ2、……YJ v5 ] are compared with the corresponding preset upper and lower limits of the security threshold, and the characteristic vector set Z of the IoT device is determined based on the comparison results. U The index assignment of each eigenvector in ; Then extract Z U The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the feature vector set Z of IoT devices U The characteristic index value is marked as Z0 U ; Step B4: In the infrastructure feature vector set Z F =[SYP1, SYP2, ...SYP v7 、BSY1、BSY2、……BSY v7 ]middle: Then Z F =[SYP1, SYP2, ...SYP v7 、BSY1、BSY2、……BSY v7 ] are compared with the corresponding preset upper and lower limits of the safety threshold, and the infrastructure feature vector set Z is determined based on the comparison results. R The index assignment of each eigenvector in ; Then extract Z F The index values ​​of all feature vectors in are assigned, and the index values ​​of all feature vectors are added together to obtain the infrastructure feature vector set Z F The characteristic index value is marked as Z0 F ; Step B5, through: ； Calculate the overall security situation value ZM0 of the smart city; In the formula, β N , β R , β U , β F is the preset weight coefficient; Step B6: Compare the security situation value ZM0 with the preset security situation threshold ZMy, and then determine whether to generate a warning signal of a corresponding level based on the comparison result.

8. The security situation awareness system based on smart city according to claim 7 is characterized in that: The indicator values ​​are determined as follows: If Z N If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z N If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z R If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z U If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is less than the lower limit of the safety threshold, "-1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is greater than the upper limit of the safety threshold, "1" is assigned as the index value of the feature vector; If Z F If the corresponding feature vector in is between the upper limit of the safety threshold and the lower limit of the safety threshold, "0" is assigned as the indicator value of the feature vector.

9. The security situation awareness system based on smart city according to claim 7 is characterized in that: In StepB6, the comparison is as follows: If ZM0 ≥ 1.2 × ZMy, an advanced warning signal is generated; If ZMy≤ZM0<1.2×ZMy, an intermediate warning signal is generated; If 0.8×ZMy≤ZM0<ZMy, a low-level warning signal is generated; If ZM0<0.8×ZMy, no corresponding warning signal will be generated.

10. A security situation awareness method based on smart city, characterized in that: The method is implemented by a smart city-based security situation awareness system as described in any one of claims 1-9.

Images