DCS security enhancement and early warning method based on multi-source data integration

Abstract

The invention discloses a DCS (Distributed Control System) security enhancement and early warning method based on multi-source data integration. The method comprises the following steps: collecting and integrating data of an upper computer and a lower computer of a DCS; merging the data through a streaming data processing platform to obtain a unified data set; performing data processing and feature extraction, and constructing a new data feature set through variable combination and an exponentially weighted moving average time window method; integrating a plurality of machine learning algorithms to construct a security enhancement model, training and optimizing the model, and selecting a prediction or classification result of the model through an integration strategy; a trusted computing technology is utilized to deploy a security enhancement model, the security of a data transmission process is ensured through a zero-knowledge proof encryption method, and a trusted hardware module is utilized to enable data processing and model execution to be in a trusted environment; and regularly carrying out data monitoring and safety early warning, and when the safety enhancement model detects abnormity or threat, executing preset response measures. According to the invention, the safety of the DCS can be comprehensively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of DCS (Distributed Control System) security monitoring and early warning, and in particular relates to a DCS security enhancement and early warning method based on multi-source data integration. Background Art

[0002] In the field of modern industrial automation, the security of distributed control systems has become a key technical issue. As the complexity of industrial systems increases, traditional monitoring and security strategies have gradually shown their limitations. Especially when processing large amounts of data from multiple sources, such as operational data, sensor data, system events, and alarms, traditional systems often have difficulty coping with modern threats and demands due to challenges such as data silos, processing delays, data security, and privacy issues.

[0003] Traditional DCS often has data silos, that is, data between different systems and different devices is difficult to share and integrate, resulting in inefficient monitoring and security management. Data silos limit the ability of comprehensive monitoring and real-time analysis, increasing security risks. At the same time, with the surge in data volume, traditional systems may experience delays due to insufficient processing capacity, affecting real-time response speed. Processing delays may cause security incidents to fail to be discovered and handled in a timely manner, increasing system risks. In addition, DCS involves a large amount of sensitive data, such as operating data, sensor data, etc., and the security and privacy protection of this data are crucial. Data leakage or illegal access may lead to serious consequences such as production safety accidents and economic losses. The structure of DCS is complex, and with the development of Industry 4.0 and intelligent manufacturing, the system openness increases and is vulnerable to cyber attacks.

[0004] The security of DCS is a complex and severe challenge. These challenges can be effectively addressed and the safe and stable operation of DCS can be ensured by strengthening data integration and sharing, improving data processing capabilities, strengthening data security and privacy protection, improving safety management systems, introducing intelligent monitoring and early warning systems, and strengthening system redundancy and fault tolerance. Summary of the invention

[0005] The purpose of the present invention is to provide a DCS security enhancement and early warning method based on multi-source data integration to address the above-mentioned problems in the prior art, and to comprehensively improve the DCS security by integrating multiple data processing links.

[0006] In the first aspect, a DCS security enhancement and early warning method based on multi-source data integration is provided, comprising: Collect and integrate key data of DCS upper and lower computers; The collected and integrated data is merged through the stream data processing platform to obtain a unified data set; Perform data processing and feature extraction on the unified data set, and construct a new data feature set through variable combination and exponentially weighted moving average time window method; Integrate multiple machine learning algorithms to build a security enhancement model, use new data feature sets to train and optimize the constructed security enhancement model, and select the prediction or classification results of the security enhancement model through integration strategies; According to the prediction or classification results of the security enhancement model, the security enhancement model is deployed using trusted computing technology, the security of the data transmission process is ensured through zero-knowledge proof encryption, and trusted hardware modules are used to enable data processing and model execution in a trusted environment; Conduct data monitoring and security warnings regularly, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

[0007] As a preferred solution, in the step of collecting and integrating the key data of the DCS upper and lower computers, a real-time data stream processing platform is introduced to collect and integrate the data. The key data of the DCS upper and lower computers include: (a) Operation data of each node of the host computer; (b) Sensor data in the DCS; (c) System events, errors, alarms and other log information of each process of each node of the host computer; (d) Historical alarms of the alarm program and system alarm records; (e) Network traffic data in the DCS; (f) Equipment status and maintenance records.

[0008] As a preferred solution, the real-time data stream processing platform adopts an open source distributed stream processing framework, and collects and integrates data through the stream processing system entrance of the distributed stream processing framework; The method of merging the collected and integrated data through the stream data processing platform to obtain a unified data set includes: using the key function interface of the distributed stream processing framework to process the received data and then merge it. The data processing process includes data cleaning, format conversion, normalization and error filtering.

[0009] As a preferred solution, the data processing and feature extraction of the unified data set includes: The unified data set is modified and the relationship between different data is determined using the conditional mutual information correlation analysis method; The key features that affect DCS safety are determined using information gain-based feature selection methods or model-based feature selection methods.

[0010] As a preferred scheme, in the step of correcting the unified data set and using the conditional mutual information correlation analysis method to determine the relationship between different data, the unified data set is corrected based on the autoencoder to map the data to a unified low-dimensional representation, and the density clustering algorithm of the multidimensional data processing tree space index structure is used to identify abnormal features in the data.

[0011] As a preferred solution, the feature selection method based on information gain is implemented by using an algorithm that can calculate the change of feature information gain; The model-based feature selection method is implemented using a graph neural network model, which learns the relationship between nodes by building a graph structure of data nodes and connections, thereby selecting key features that affect the security of DCS.

[0012] As a preferred solution, the step of integrating multiple machine learning algorithms to build a security enhancement model includes: Random forest, support vector machine SVM or neural network model is used to complete classification or regression tasks; isolation forest, one-class support vector machine One-Class SVM or autoencoder neural network model is used for anomaly detection; differential autoregressive moving average model, long short-term memory network LSTM or gated recurrent unit network model is used for time series prediction; thus, a security enhancement model is constructed.

[0013] As a preferred solution, when the prediction or classification results of the security enhancement model are selected through an integration strategy, the integration strategy is to use the prediction results of the security enhancement model as input features again, and then use a meta-model to learn to combine these prediction results to obtain the final output.

[0014] As a preferred solution, the DCS safety enhancement and early warning method based on multi-source data integration also includes a step in which a monitoring process outside the entire system monitors the performance of the safety enhancement model and the accuracy of prediction in real time, and dynamically adjusts and optimizes the parameters of the safety enhancement model according to the monitoring results; the performance and prediction accuracy of the safety enhancement model are evaluated by accuracy, recall and F1 score (F1 Score, also known as balanced F score, is an indicator used in statistics to measure the accuracy of binary classification models. It takes into account both the accuracy and recall of the classification model and is the harmonic mean of these two indicators; the F1 score ranges from 0 to 1, and the closer the value is to 1, the better the model performance. When the F1 score is 1, it means that the model predicts perfectly, and when it is 0, it means that the model prediction performance is the worst.) and the stability of the safety enhancement model under different conditions is monitored using a time series analysis method.

[0015] Second, a DCS safety enhancement and early warning system based on multi-source data integration is provided, including: Data acquisition module, used to collect and integrate key data of DCS upper and lower computers; The data merging module is used to merge the collected and integrated data through the stream data processing platform to obtain a unified data set; The data feature extraction module is used to process and extract features from a unified data set, and to construct a new data feature set through variable combination and exponentially weighted moving average time window method; The model building and optimization module is used to integrate multiple machine learning algorithms to build a security enhancement model, train and optimize the constructed security enhancement model using a new data feature set, and select the prediction or classification results of the security enhancement model through an integrated strategy; The model trusted deployment module is used to deploy the security enhancement model using trusted computing technology according to the prediction or classification results of the security enhancement model, ensure the security of the data transmission process through zero-knowledge proof encryption, and use trusted hardware modules to enable data processing and model execution in a trusted environment; The monitoring and early warning module is used to perform regular data monitoring and security early warning, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

[0016] Compared with the prior art, the present invention has at least the following beneficial effects: By collecting and integrating the key data of DCS upper and lower computers, and merging the data from these different sources into a unified data set, the unified data set is processed and feature extracted to determine the relationship between different data and the key features that affect the security of DCS, and then a new data feature set is constructed through variable combination and exponential weighted moving average time window method. The present invention integrates multiple machine learning algorithms to build a security enhancement model to complete tasks such as anomaly detection, time series prediction, classification or regression, and trains and optimizes the constructed security enhancement model to improve the stability and accuracy of each model. The present invention uses trusted computing technology to deploy security enhancement models to ensure the security of data and models, uses zero-knowledge proof encryption to ensure the security of the data transmission process, and uses trusted hardware modules to enable data processing and model execution in a trusted environment. Finally, the model is deployed in an actual DCS environment, and data monitoring and security warnings are performed regularly. When the model detects anomalies or threats, pre-set response measures are executed. The DCS security enhancement and early warning method based on multi-source data integration of the present invention can solve the limitations of traditional monitoring and security strategies, is more suitable for processing large amounts of multi-source data tasks, and more effectively responds to security challenges in modern industrial environments, providing a comprehensive and secure solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 Flowchart of a DCS security enhancement and early warning method based on multi-source data integration in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, ordinary technicians in this field can also obtain other embodiments without making creative work.

[0020] See also Figure 1 The DCS security enhancement and early warning method based on multi-source data integration in the embodiment of the present invention mainly includes: S101. Collect and integrate key data of DCS upper and lower computers; S102, merging the collected and integrated data through the stream data processing platform to obtain a unified data set; S103, performing data processing and feature extraction on the unified data set, and constructing a new data feature set through variable combination and exponentially weighted moving average time window method; S104. Integrate multiple machine learning algorithms to build a security enhancement model, use a new data feature set to train and optimize the constructed security enhancement model, and select the prediction or classification results of the security enhancement model through an integrated strategy; S105. Deploy the security enhancement model using trusted computing technology according to the prediction or classification results of the security enhancement model, ensure the security of the data transmission process through zero-knowledge proof encryption, and use trusted hardware modules to enable data processing and model execution in a trusted environment; S106. Perform data monitoring and security warnings regularly, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

[0021] In a possible implementation, in the step of collecting and integrating the key data of the DCS upper and lower computers, a real-time data stream processing platform is introduced to collect and integrate the data, and the key data of the DCS upper and lower computers include: (a) Operation data of each node of the host computer; (b) Sensor data in the DCS; (c) System events, errors, alarms and other log information of each process of each node of the host computer; (d) Historical alarms of the alarm program and system alarm records; (e) Network traffic data in the DCS; (f) Equipment status and maintenance records.

[0022] Furthermore, the operation data of each node of the host computer includes variable adjustment, system command execution status and user operation behavior data; Historical alarms and system alarm records refer to records of equipment failures, parameter exceeding limits, or other system problems; The network traffic data in DCS refers to the data transmission records in the system's internal network, including data packet size, sending and receiving time, and network delay.

[0023] In a possible implementation, the real-time data stream processing platform uses the open source distributed stream processing framework Apache Flink, and collects and integrates data through the stream processing system entry SourceFunction of the distributed stream processing framework Apache Flink; The merging of the collected and integrated data through the stream data processing platform to obtain a unified data set includes: using the key function interface Process Function of the distributed stream processing framework Apache Flink to process and merge the received data, and the data processing process includes data cleaning, format conversion, normalization and error filtering.

[0024] The distributed stream processing framework Apache Flink is a distributed stream processing framework that can process unbounded and bounded data streams. It aims to provide high-throughput, low-latency data processing capabilities. Its core is a distributed data stream engine. The distributed stream processing framework Apache Flink can process unbounded streaming data and bounded data sets in a unified way, allowing developers to write code once while supporting real-time processing and batch processing jobs. It provides an efficient state management mechanism that supports very large application states, and its asynchronous and incremental checkpoint algorithm has minimal impact on processing delays while ensuring the consistency of exactly once state. It supports event time processing and can provide accurate time semantics when data arrives out of order. It supports high-availability configuration and ensures the stability and reliability of the system by requesting new resources to replace failed containers.

[0025] The source function, the entry point of the stream processing system, plays a vital role in the distributed stream processing framework Apache Flink. It is the entry point of the entire stream processing system and is used to read data from external data sources and provide it as a stream to the Apache Flink application.

[0026] The key function interface Process Function is a key function interface provided by the distributed stream processing framework Apache Flink, which is used to process each input event in the event stream and generate output results. Through the key function interface Process Function, developers can access the timestamp, metadata, registered timers, etc. of the event to achieve more flexible and complex event processing logic.

[0027] In a possible implementation, the data processing and feature extraction of the unified data set includes: Modify the data set and use the conditional mutual information correlation analysis method to determine the relationship between different data; Information gain-based or model-based feature selection methods are used to identify key features that affect DCS safety.

[0028] Furthermore, in the step of correcting the data set and using the conditional mutual information correlation analysis method to determine the relationship between different data, the data correction is based on the autoencoder to map the data to a unified low-dimensional representation, and the OPTICS algorithm (Ordering Points To Identify the Clustering Structure, a density-based clustering algorithm) of the KD tree (K-Dimensional Tree, K-dimensional data processing tree) spatial index structure is used to identify abnormal features in the data.

[0029] Furthermore, the feature selection method based on information gain is implemented using an algorithm that can calculate the change of feature information gain; The model-based feature selection method is implemented using a graph neural network model, which learns the relationship between nodes by building a graph structure of data nodes and connections, thereby selecting the most useful features for the prediction task.

[0030] The KD tree described in the embodiment of the present invention is a tree data structure that stores instance points in a k-dimensional space for rapid retrieval. The KD tree is a high-dimensional index tree data structure, which is particularly suitable for processing tasks such as high-dimensional image feature vector matching in image retrieval. Furthermore, each node of the KD tree is a k-dimensional point, and the non-leaf node represents a super-rectangular area. By selecting a dimension and a cut value, the data set is divided into two subsets, the left subtree contains data less than or equal to the cut value, and the right subtree contains data greater than the cut value. As the depth of the tree increases, the coordinate axis is cyclically selected as the normal vector of the segmentation hyperplane. The construction of the KD tree is a recursive process, which is divided by continuously selecting the dimension with the largest variance until only one data point is left in the data set. One of the main applications of the KD tree is to solve the nearest neighbor search problem. When performing the nearest neighbor search in the KD tree, first start from the root node, and select the left subtree or the right subtree for search according to the relationship between the target point and the segmentation hyperplane represented by the current node. Then recursively continue to search downward along the selected search direction until the leaf node is reached. During the search process, pruning is performed based on the distance between the target point and the current nearest neighbor point to improve the search efficiency. In addition to nearest neighbor search, KD tree can also be used in scenarios such as range query.

[0031] The OPTICS algorithm identifies clustering structures in a dataset by constructing a reachability graph. The OPTICS clustering algorithm relies on two main parameters: ε (the maximum value of the neighborhood radius) and MinPts (the number of points required to form a cluster). However, a notable feature of the OPTICS clustering algorithm is that it relaxes the restrictions on the ε parameter, treating it as a range rather than a single value, allowing for more flexible processing of datasets.

[0032] For a given ε and MinPts, the minimum neighborhood radius that makes a point a core point is called the core distance of the point. This is a key concept in the OPTICS clustering algorithm and is used to determine the density of points.

[0033] Assuming q is a core point, the reachable distance of p is the larger value between the core distance of p and the actual distance from p to q. This distance measures the difficulty of reaching p from q and is an important basis for the OPTICS clustering algorithm to perform clustering division.

[0034] The OPTICS clustering algorithm records the reachability distance information of each point by constructing a reachability graph. This graph is an ordered list of objects that contains the reachability distance and sorting properties of all points in the dataset.

[0035] In a possible implementation, the step of integrating multiple machine learning algorithms to build a security enhancement model includes: Random forest, SVM (Support Vector Machine) or neural network models are used to complete classification or regression tasks. Isolation forest, one-class support vector machine or autoencoder neural network models are used for anomaly detection. Differential autoregressive moving average model, LSTM (Long Short-Term Memory) or gated recurrent unit network model is used for time series prediction.

[0036] SVM is a powerful supervised learning algorithm mainly used for classification and regression analysis. The goal of SVM is to find a hyperplane (a line in two-dimensional space, a plane in three-dimensional space, and so on) that can classify the samples in the data set into different categories while maximizing the interval between different categories.

[0037] The basic principle of SVM can be summarized as the "maximum margin" idea. In the training data set, SVM looks for a hyperplane that can correctly classify the data and maximizes the distance (i.e., margin) between the points closest to the hyperplane. These closest points are called support vectors because they are crucial to defining the position of the hyperplane.

[0038] The core idea of ​​the One-Class SVM is to model by using only normal data and construct a hyperplane (decision boundary) so that normal data points can be surrounded by the hyperplane, while abnormal data points are outside the hyperplane. This hyperplane is obtained by dividing the distribution of normal data points to maximize the interval, thereby ensuring that normal data points are as far away from the hyperplane as possible, while abnormal data points are as close to or outside the hyperplane as possible.

[0039] Unlike traditional SVM, One-Class SVM only needs normal data for training, and does not require labels or category information of abnormal data. One-Class SVM uses kernel functions to map data into a high-dimensional feature space in order to better find a hyperplane that can distinguish normal data from abnormal data. Common kernel functions include linear kernels, polynomial kernels, and Gaussian kernels. One-Class SVM finds the optimal hyperplane by solving a convex optimization problem. This problem usually involves minimizing a function that includes a regularization term and a kernel function, as well as some constraints. The performance of One-Class SVM is affected by parameter settings, such as nu (a parameter that controls the proportion of outliers), kernel (kernel function type), gamma (kernel function parameter), etc.

[0040] LSTM is a special recurrent neural network (RNN) architecture that aims to solve the gradient vanishing or gradient exploding problems that traditional RNNs are prone to when processing long sequence data. LSTM retains long-term dependencies by introducing three "gate" control structures (forget gate, input gate, and output gate), thereby enhancing RNN's ability to learn and remember sequence data.

[0041] GRU (Gated Recurrent Unit) is a variant developed on the basis of RNN, which is particularly suitable for processing sequence data. GRU was proposed after LSTM, aiming to simplify the structure of LSTM while maintaining its ability to process long sequence data. GRU effectively reduces the complexity and overfitting problems of the network by introducing a gating mechanism to control the flow of information. Its core idea is to use the update gate and reset gate to control the retention and forgetting of information, thereby realizing the modeling of sequence data. The basic structure of the GRU model includes an input layer, a hidden layer (including an update gate and a reset gate), and an output layer. At each time step, GRU receives the current input and the hidden state of the previous time step, and updates its hidden state.

[0042] In one possible implementation, the trusted computing technology is used to deploy the security enhancement model, the security of the data transmission process is ensured by zero-knowledge proof encryption, and trusted hardware modules are used to enable data processing and model execution in a trusted environment. The main trusted computing technologies used include trusted hardware security modules for generating, storing and protecting encryption keys; trusted platform modules for storing encryption keys, digital certificates and sensitive data; zero-knowledge proof encryption algorithms; and establishing a secure area that allows models and processes to execute code when the system is attacked.

[0043] In a possible implementation, when the prediction or classification result of the security enhancement model is selected through an integration strategy, the integration strategy is to use the prediction results of multiple models as input features again, and then use a meta-model to learn to combine these prediction results to obtain the final output.

[0044] In a possible implementation, the embodiment of the present invention further includes a step of having a monitoring process outside the entire system monitor the performance of the model and the accuracy of prediction in real time, and dynamically adjusting and optimizing the parameters of the model based on the monitoring results.

[0045] Furthermore, the performance of the model and the accuracy of predictions were evaluated by precision, recall and F1 score, and the stability of the model under different conditions was monitored using time series analysis methods.

[0046] Another embodiment of the present invention further proposes a DCS safety enhancement and early warning system based on multi-source data integration, comprising: Data acquisition module, used to collect and integrate key data of DCS upper and lower computers; The data merging module is used to merge the collected and integrated data through the stream data processing platform to obtain a unified data set; The data feature extraction module is used to process and extract features from a unified data set, and to construct a new data feature set through variable combination and exponentially weighted moving average time window method; The model building and optimization module is used to integrate multiple machine learning algorithms to build a security enhancement model, train and optimize the constructed security enhancement model using a new data feature set, and select the prediction or classification results of the security enhancement model through an integrated strategy; The model trusted deployment module is used to deploy the security enhancement model using trusted computing technology according to the prediction or classification results of the security enhancement model, ensure the security of the data transmission process through zero-knowledge proof encryption, and use trusted hardware modules to enable data processing and model execution in a trusted environment; The monitoring and early warning module is used to perform regular data monitoring and security early warning, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

[0047] Another embodiment of the present invention further provides an electronic device, comprising: A memory storing at least one instruction; and a processor, which executes the instructions stored in the memory to implement the DCS safety enhancement and early warning method based on multi-source data integration.

[0048] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the DCS safety enhancement and early warning method based on multi-source data integration is implemented.

[0049] Exemplarily, the instructions stored in the memory may be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to complete the DCS safety enhancement and early warning method based on multi-source data integration of the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the server.

[0050] The electronic device may be a computing device such as a smart phone, a notebook, a PDA, and a cloud server. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the electronic device may also include more or fewer components, or a combination of certain components, or different components, for example, the electronic device may also include an input / output device, a network access device, a bus, etc.

[0051] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0052] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is to be output.

[0053] It should be noted that the information interaction, execution process and other contents between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0054] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0055] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0056] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0057] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A DCS security enhancement and early warning method based on multi-source data integration, characterized in that: include: Collect and integrate key data of DCS upper and lower computers; The collected and integrated data is merged through the stream data processing platform to obtain a unified data set; Perform data processing and feature extraction on the unified data set, and construct a new data feature set through variable combination and exponentially weighted moving average time window method; Integrate multiple machine learning algorithms to build a security enhancement model, use new data feature sets to train and optimize the constructed security enhancement model, and select the prediction or classification results of the security enhancement model through integration strategies; According to the prediction or classification results of the security enhancement model, the security enhancement model is deployed using trusted computing technology, the security of the data transmission process is ensured through zero-knowledge proof encryption, and trusted hardware modules are used to enable data processing and model execution in a trusted environment; Conduct data monitoring and security warnings regularly, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

2. The DCS security enhancement and early warning method based on multi-source data integration according to claim 1 is characterized in that: In the step of collecting and integrating the key data of the DCS upper and lower computers, a real-time data stream processing platform is introduced to collect and integrate the data. The key data of the DCS upper and lower computers include: (a) Operation data of each node of the host computer; (b) Sensor data in the DCS; (c) System events, errors, alarms and other log information of each process of each node of the host computer; (d) Historical alarms of the alarm program and system alarm records; (e) Network traffic data in the DCS; (f) Equipment status and maintenance records.

3. The DCS security enhancement and early warning method based on multi-source data integration according to claim 2 is characterized in that: The real-time data stream processing platform adopts an open source distributed stream processing framework, and collects and integrates data through the stream processing system entrance of the distributed stream processing framework; The method of merging the collected and integrated data through the stream data processing platform to obtain a unified data set includes: using the key function interface of the distributed stream processing framework to process the received data and then merge it. The data processing process includes data cleaning, format conversion, normalization and error filtering.

4. The DCS security enhancement and early warning method based on multi-source data integration according to claim 1 is characterized in that: The data processing and feature extraction of the unified data set includes: The unified data set is modified and the relationship between different data is determined using the conditional mutual information correlation analysis method; The key features that affect DCS safety are determined using information gain-based feature selection methods or model-based feature selection methods.

5. The DCS security enhancement and early warning method based on multi-source data integration according to claim 4 is characterized in that: In the step of correcting the unified data set and using the conditional mutual information correlation analysis method to determine the relationship between different data, the unified data set is corrected based on the autoencoder to map the data to a unified low-dimensional representation, and a density clustering algorithm of a multidimensional data processing tree space index structure is used to identify abnormal features in the data.

6. The DCS security enhancement and early warning method based on multi-source data integration according to claim 4 is characterized in that: The feature selection method based on information gain is implemented by using an algorithm that can calculate the change of feature information gain; The model-based feature selection method is implemented using a graph neural network model, which learns the relationship between nodes by building a graph structure of data nodes and connections, thereby selecting key features that affect the security of DCS.

7. The DCS security enhancement and early warning method based on multi-source data integration according to claim 1 is characterized in that: The steps of integrating multiple machine learning algorithms to build a security enhancement model include: Random forest, support vector machine SVM or neural network model is used to complete classification or regression tasks; isolation forest, one-class support vector machine One-Class SVM or autoencoder neural network model is used for anomaly detection; differential autoregressive moving average model, long short-term memory network LSTM or gated recurrent unit network model is used for time series prediction; thus, a security enhancement model is constructed.

8. The DCS security enhancement and early warning method based on multi-source data integration according to claim 7 is characterized in that: When the prediction or classification result of the security enhancement model is selected through the integration strategy, the integration strategy is to use the prediction result of the security enhancement model as an input feature again, and then use a meta-model to learn to combine these prediction results to obtain the final output.

9. The DCS security enhancement and early warning method based on multi-source data integration according to claim 1 is characterized in that: The method further includes a step of having a monitoring process outside the entire system monitor the performance and prediction accuracy of the safety enhancement model in real time, and dynamically adjusting and optimizing the parameters of the safety enhancement model based on the monitoring results; The performance of the safety enhancement model and the accuracy of prediction are evaluated by precision, recall and F1 score, and the stability of the safety enhancement model under different conditions is monitored by time series analysis method.

10. A DCS safety enhancement and early warning system based on multi-source data integration, characterized in that: include: Data acquisition module, used to collect and integrate key data of DCS upper and lower computers; The data merging module is used to merge the collected and integrated data through the stream data processing platform to obtain a unified data set; The data feature extraction module is used to process and extract features from a unified data set, and to construct a new data feature set through variable combination and exponentially weighted moving average time window method; The model building and optimization module is used to integrate multiple machine learning algorithms to build a security enhancement model, train and optimize the constructed security enhancement model using a new data feature set, and select the prediction or classification results of the security enhancement model through an integrated strategy; The model trusted deployment module is used to deploy the security enhancement model using trusted computing technology according to the prediction or classification results of the security enhancement model, ensure the security of the data transmission process through zero-knowledge proof encryption, and use trusted hardware modules to enable data processing and model execution in a trusted environment; The monitoring and early warning module is used to perform regular data monitoring and security early warning, and execute pre-set response measures when the security enhancement model detects anomalies or threats.

Images