Industrial Internet security supervision method and system

Abstract

The present invention relates to the field of data processing, and more specifically, to a method and system for industrial Internet security supervision, the method comprising: obtaining operating data of equipment in industrial Internet security supervision, setting an initial k value for each data point in the operating data, obtaining neighborhood data points of each data point, and calculating reference weights of the neighborhood data points based on the Euclidean distance of the neighborhood data points and the acquisition time sequence, calculating the density uniformity of each data point according to the reference weights, correcting the initial k value by the ratio between the density uniformity of the data point and a preset density threshold, and obtaining a significant k value; performing LOF anomaly detection on each data point using the significant k value to obtain the degree of anomaly of each data point, and detecting corresponding abnormal equipment in the industrial Internet. The present invention adaptively selects a suitable k value based on the actual distribution characteristics of the data points, thereby more accurately detecting abnormal data points and reducing false positives and false negatives.

Description

Technical Field

[0001] The present invention relates to the field of data processing. More specifically, the present invention relates to an industrial Internet security supervision method and system. Background Art

[0002] The Industrial Internet is gradually transforming towards intelligent and digital capabilities across various industries. Many sectors, such as manufacturing, energy, and transportation, are actively exploring and implementing effective security monitoring methods and systems. These methods and systems are rapidly evolving, but companies still face challenges in implementation and must find effective solutions to ensure system stability and security. Currently, the LOF algorithm is commonly used to detect anomalies in the operational data of various devices within the Industrial Internet, thereby identifying potential anomaly risk factors within the Industrial Internet.

[0003] The existing Chinese patent application document with publication number CN119356197A discloses a method and system for monitoring the operating status of industrial Internet equipment, including: a control terminal, which is the main control end of the system and is used to issue execution commands; a network distribution module, which is used to configure the local area network to serve all equipment in the system and area; an analysis module, which is used to analyze the operating parameters of the equipment; a monitoring module, which is used to monitor the operating parameters of the collection equipment in real time; and a judgment module, which is used to determine whether the equipment operating parameters obtained by the monitoring module are within the equipment safety operating parameter threshold range set by the setting unit of the lower sub-module of the analysis module.

[0004] The application document needs to collect the parameters of each device to set the device operation safety threshold range, and then obtain the working status of the device during operation to ensure that the device failure problem can be perceived in advance and discovered in time. At present, the LOF anomaly detection algorithm is usually used to detect anomalies in the operating data of industrial Internet devices. Since the equipment operation process corresponds to different operating states, a single The abnormal detection of values ​​is difficult to meet the data changes under different operating conditions. If the value is too large, the local reachable density of all data points will be relatively close, making it difficult to detect abnormal data points. If the value is too small, it will be sensitive to the local density of data points, resulting in some normal data points being misdetected as anomalies. Summary of the Invention

[0005] In order to solve the different operating states corresponding to the equipment operation process, a single The anomaly detection of values ​​is difficult to meet the data changes under different operating states, which reduces the accuracy of anomaly detection. The present invention provides solutions in the following aspects.

[0006] In the first aspect, an industrial Internet security supervision method includes: obtaining the operating data of the equipment in the industrial Internet security supervision, the operating data including: temperature, pressure, operating speed, equipment vibration frequency, ambient temperature and humidity data; setting an initial value for each data point in the operating data; value, obtain the neighborhood data points of each data point, and calculate the reference weight of the neighborhood data point based on the Euclidean distance of the neighborhood data point and the time series attenuation factor of the acquisition time series; take any data point as the marked data point, sort all the neighborhood data points of the marked data point, obtain the neighborhood sorting sequence, calculate the difference between any data of the marked data point and the average value of the corresponding item data of the neighborhood data point, and divide it by the range of any data in the neighborhood data of the marked data point, and then calculate the absolute value to obtain the relative position difference; calculate the difference between the item data of the marked data points corresponding to two adjacent data in the neighborhood sorting sequence of the marked data point, divide it by the average distribution density, and multiply it by the absolute value of the difference with 1 to obtain the relative deviation, sum the reference weight of the neighborhood data as the weight of the relative deviation, and multiply it by the product of the relative position difference to obtain the density uniformity of any data in the neighborhood data of the marked data point; take the average value of the sum of the density uniformity of each item of the marked data point as the density uniformity of the marked data point; compare the ratio between the density uniformity of the data point and the preset density threshold to the initial value. The value was corrected to obtain significant Value; use significant The LOF anomaly detection is performed on each data point to obtain the degree of anomaly of each data point, and the corresponding abnormal equipment in the industrial Internet is detected.

[0007] The effect is that by introducing Euclidean distance and collecting time series to calculate reference weights, the impact of neighboring data points on the current data point can be more accurately evaluated. This makes anomaly detection more refined and can better capture changes in local data. By dynamically adjusting The value can not only identify abnormal data points more accurately, thereby optimizing the allocation of monitoring resources, concentrating resources on more frequent monitoring of abnormal areas, and reducing resource waste in normal areas, but also more accurately identify abnormal data points, reducing false positives and missed positives, and improving monitoring efficiency and system reliability.

[0008] By analyzing the density uniformity of the marked data points, it is reflected that the higher the density uniformity, the more uniform the distribution of the data points in the feature space, and vice versa, the more uneven the distribution is, and there may be anomalies. By calculating the relative position difference and relative deviation, the relative position difference reflects the difference between the average value of the data point and its neighboring data points, and the relative deviation reflects the local changes between the neighboring data points, thereby improving the accuracy of anomaly detection.

[0009] Preferably, the reference weights include:

[0010] Take any data point as the marked data point and use the Euclidean distance to calculate the initial The number of neighborhood data points with the same value is obtained, the collection time series of the neighborhood data points is obtained, the Euclidean distance and the exponential decay term of the time series difference between the marked data point and each neighborhood data point are calculated respectively, and the original reference weight of the neighborhood data point corresponding to the marked data point is obtained by multiplying them. The original reference weights of all neighborhood data points are summed as the normalization factor, and the original reference weight of each neighborhood data point is divided by the normalization factor to obtain the reference weight of each neighborhood data point.

[0011] The effect is that by introducing the exponential decay terms of Euclidean distance and time series difference, it is possible to more accurately evaluate the impact of neighboring data points on the current data point, dynamically adjust the reference weight, and adapt to data changes under different operating conditions.

[0012] Preferably, the reference weight further includes:

[0013] Taking any data point as the marked data point, calculate the linear attenuation term of the time series difference between the acquisition index of the marked data point and the acquisition index of the neighboring data points, calculate the Euclidean distance between the marked data point and each neighboring data point, multiply the Euclidean distance by the linear attenuation term to obtain the original reference weight, and divide the original reference weight of each neighboring data point by the sum of the original reference weights of all neighboring data points to obtain the normalized reference weight.

[0014] The effect is that by introducing the similarity of data points in feature space and the correlation of data points in time to analyze the reference weights of marked data points, it is more conducive to capturing the changing trends of data points in time and space, thereby adapting to data changes in different operating states.

[0015] Preferably, the average distribution density is the ratio between the range of any data in the neighborhood data of the marked data point and the number of neighborhood data points.

[0016] Preferably, obtaining the abnormality degree of each data point includes:

[0017] Run data and significant Value input LOF algorithm, use significant The value determines the range of the neighborhood data points, calculates the local reachable distance between each data point and the neighborhood data points, calculates the local anomaly factor of each data according to the local reachable distance, and obtains the degree of anomaly of the running data.

[0018] In the second aspect, an industrial Internet security supervision system includes: a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the above-mentioned industrial Internet security supervision method is implemented.

[0019] The present invention has the following effects:

[0020] 1. The present invention calculates the density uniformity of each data point and dynamically adjusts the initial density uniformity according to the ratio of the density uniformity to the preset density threshold. value, which solves the single The value is difficult to adapt to different operating conditions, and the appropriate values, thereby more accurately detecting abnormal data points and reducing false positives and negatives. This significantly improves the adaptability and accuracy of anomaly detection, especially in industrial environments with complex and dynamically changing data distribution.

[0021] 2. The present invention adaptively obtains the LOF algorithm based on the uniformity of the density of other data points around each data point. The value is used to perform anomaly detection so that each data point can be detected by the appropriate The anomaly detection is performed on the value to obtain more accurate anomaly detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an illustrative and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0023] Figure 1 It is a method flow chart of steps S1 to S3 in an industrial Internet security supervision method in an embodiment of the present invention.

[0024] Figure 2 This is a structural block diagram of an industrial Internet security supervision system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work shall fall within the scope of protection of the present invention.

[0026] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0027] Reference Figure 1 , an industrial Internet security supervision method includes steps S1 to S3, which are as follows:

[0028] S1: Obtain the operating data of equipment in industrial Internet security supervision, including: temperature, pressure, operating speed, equipment vibration frequency, and ambient temperature and humidity data.

[0029] It should be noted that sensors are installed on the equipment to collect various operating data in real time. The first Item data is recorded as , the data of each device can be formed into a matrix, and a total of Devices, one device has Data items. Process the collected data, for example: data cleaning: denoising, filling missing values, correcting erroneous data; data dimensionality reduction: reducing data dimensions and computational complexity through principal component analysis.

[0030] S2: Set the initial value for each data point in the running data The neighborhood data points of each data point are obtained, and the reference weight of the neighborhood data point is calculated based on the Euclidean distance of the neighborhood data point and the time series attenuation factor of the acquisition time series. The density uniformity of each data point is calculated according to the reference weight, and the ratio between the density uniformity of the data point and the preset density threshold is compared with the initial The value was corrected to obtain significant value.

[0031] It should be noted that for the equipment's operating status data, if the data points are in a uniform density area, a smaller The value captures the local detail feature changes. For areas with low local density uniformity, a larger value to improve the fault tolerance for normal data.

[0032] Further analysis reveals that in the Industrial Internet, the time (timing) of data point collection is a critical factor. Neighboring data points with significantly different timings from the current data point have lower reference value, as they may not accurately reflect the current data point's state. For example, equipment may be in different operating states at different times, so earlier collected data may not be suitable for assessing the current state. To prevent data points with significantly different timings from misleading anomaly detection results, the weight of these data points in the density uniformity calculation needs to be appropriately reduced. This is achieved by introducing a timing decay factor (such as exponential or linear decay) to adjust the reference weight of these data points. This ensures that anomaly detection relies more heavily on neighboring data points with similar timings to the current data point, thereby improving detection accuracy and reliability.

[0033] The steps to obtain the reference weight are as follows:

[0034] Take any data point as the marked data point and use the Euclidean distance to calculate the initial The number of neighborhood data points with the same value is obtained, the collection time series of the neighborhood data points is obtained, the Euclidean distance and the exponential decay term of the time series difference between the marked data point and each neighborhood data point are calculated respectively, and the original reference weight of the neighborhood data point corresponding to the marked data point is obtained by multiplying them. The original reference weights of all neighborhood data points are summed as the normalization factor, and the original reference weight of each neighborhood data point is divided by the normalization factor to obtain the reference weight of each neighborhood data point.

[0035] In this embodiment, the initial The value is 17, and implementers can adjust it according to specific application scenarios.

[0036] Specifically, the reference weight satisfies the following relationship:

[0037] ;

[0038] Where, Indicates the The data point The reference weight of the neighborhood data points, Indicates the Data points and The Euclidean distance between neighboring data points, Indicates the collection index of the data point, Indicates the The data point The collection index of the neighborhood data points, Indicates the number of neighborhood data points.

[0039] That is to say, Reflects the Data points and The similarity of neighborhood data points in the feature space, the smaller the distance, the higher the similarity; Reflects the Data points and The temporal correlation of neighboring data points is measured. The smaller the time series difference, the stronger the correlation. Normalization is performed to ensure that the sum of the reference weights of all neighboring data points is 1, maintaining numerical stability and comparability. For any data point, the more evenly the distribution of various data points with its surrounding data points, the more evenly the density of data points around it is.

[0040] In addition, another embodiment further includes:

[0041] Taking any data point as the marked data point, calculate the linear attenuation term of the time series difference between the acquisition index of the marked data point and the acquisition index of the neighboring data points, calculate the Euclidean distance between the marked data point and each neighboring data point, multiply the Euclidean distance by the linear attenuation term to obtain the original reference weight, and divide the original reference weight of each neighboring data point by the sum of the original reference weights of all neighboring data points to obtain the normalized reference weight.

[0042] Specifically, the reference weight satisfies the following relationship:

[0043] ;

[0044] Where, Indicates the The data point The reference weight of the neighborhood data points, Indicates the Data points and The Euclidean distance between neighboring data points, Indicates the collection index of the data point, Indicates the The data point The collection index of the neighborhood data points, represents the number of neighborhood data points, Indicates the maximum value of the timing difference.

[0045] That is to say, Indicates the Data points and The time series difference between neighboring data points, that is, the distance between two data points in time, is normalized by the maximum value of all time series differences. The smaller the value, the closer the two data points are in time; the larger the value, the farther the two data points are in time.

[0046] when When (that is, the two data points are exactly the same in time), , the weight adjustment item is 1, indicating the maximum weight; when When (that is, the two data points are farthest in time), , the weight adjustment item is 0, indicating the minimum weight.

[0047] The steps to obtain density uniformity are as follows:

[0048] Take any data point as the marked data point, sort all the neighboring data points of the marked data point, and obtain the neighborhood sorting sequence. Calculate the difference between any data of the marked data point and the average value of the corresponding data of the neighboring data points, and divide it by the range of any data in the neighboring data of the marked data point. Then calculate the absolute value to obtain the relative position difference.

[0049] Calculate the relative deviation by dividing the difference between the item data of two adjacent data corresponding to the marked data point in the neighborhood sorting sequence of the marked data point by the average distribution density and adding the absolute value of the difference with 1. Take the reference weight of the neighborhood data as the weight of the relative deviation, sum it, and multiply it by the product of the relative position difference to obtain the density uniformity of any item in the neighborhood data of the marked data point.

[0050] The average value of the sum of the density uniformity of each data point is taken as the density uniformity of the marked data point.

[0051] Specifically, the density uniformity of each data item in the neighborhood data of the marked data point satisfies the following relationship:

[0052] ;

[0053] Where, Indicates the The neighborhood data of the data point The density uniformity of the data items, Indicates the The data point Item data, Indicates the The neighboring data point of the data point The average value of the data items, Indicates the The neighborhood data of the data point The extreme difference of the data, Indicates the The data point The reference weight of the neighborhood data, and Respectively represent The first in the neighborhood sorting sequence of data points The data Item data and The data Item data, Indicates the number of neighborhood data points.

[0054] That is to say, Reflects the The neighborhood data of the data point The range of the data item, that is, the difference between the maximum and minimum values, Reflects the neighborhood data points in The average distribution density of the data, ideally The first data The data item should be the first of other data points in its neighborhood. The middle position of the data item to indicate the There are other data points distributed in all directions, so All its neighbors The smaller the difference, the smaller the difference. The closer to the middle position, the more uniform the distribution is. The greater the average distribution density, the closer the neighborhood data points are to the first The distribution of the data in the item is relatively sparse; on the contrary, the smaller the average distribution density is, the closer the neighborhood data points are to the first The distribution of item data is relatively dense; Reflects the The data point The difference between the difference between the two adjacent data in the neighborhood sorting sequence and the average difference, the greater the difference, the better the data point. The more uneven the distribution of the neighborhood data is, the more the difference is multiplied by the reference weight to obtain the weighted difference degree to measure the uniformity of the distribution of the data of other data points around the data point; Reflects the The data point The first data point of the data and other data points in the neighborhood The relative position relationship of the data items, ideally, The first data The data item should be the first of other data points in its neighborhood. The middle position of the data item to indicate the There are other data points distributed in all directions, so All its neighbors The smaller the difference, the smaller the difference. The closer to the middle position, the more uniform the distribution can be considered.

[0055] Specifically, the density uniformity of the marked data points satisfies the following relationship:

[0056] ;

[0057] Where, Indicates the The density uniformity of the data points, Indicates the The number of data items per data point.

[0058] In addition, another embodiment further includes:

[0059] Taking any data point as a marked data point, sort all the neighborhood data points of the marked data point to obtain a neighborhood sorting sequence, and calculate the difference between two adjacent data in the neighborhood sorting sequence of the marked data point to obtain a neighborhood difference sequence;

[0060] The sum of the squares of the differences between each difference value in the neighborhood difference sequence of the marked data and the average value of the neighborhood difference sequence is calculated to obtain the local change of the neighborhood data. The density uniformity of each data item of the marked data point is obtained by dividing the local change by the number of neighborhood data points and taking the square root.

[0061] Specifically, the density uniformity of each data item in the neighborhood data of the marked data point satisfies the following relationship:

[0062] ;

[0063] in, Indicates the The neighborhood data of the data point The density uniformity of the data items, represents the first Item data value, Indicates the The data point The average of the neighborhood difference series.

[0064] That is to say, For the The difference between two adjacent data in the neighborhood sorting sequence of a data point reflects the local changes in the neighborhood data; It reflects the average local variation of the neighborhood data, and the deviation of each difference value in the neighborhood difference sequence from the average value, that is, the difference between each local change and the average local change; represents the sum of squares of all deviations, that is, the sum of squares of the differences of all local variations from the mean local variation.

[0065] The method for obtaining the density uniformity of the marked data points is consistent with that in Example 1 and will not be described again.

[0066] For example, the preset density threshold is 0.47, and the implementer may set the preset density threshold according to specific implementation conditions.

[0067] S3: Significant use The LOF anomaly detection is performed on each data point to obtain the degree of anomaly of each data point, and the corresponding abnormal equipment in the industrial Internet is detected.

[0068] Run data and significant Value input LOF algorithm, use significant The value determines the range of the neighborhood data points, calculates the local reachable distance between each data point and the neighborhood data points, calculates the local anomaly factor of each data according to the local reachable distance, and obtains the degree of anomaly of the running data.

[0069] Detect equipment anomalies in the Industrial Internet based on the degree of abnormality of data points, and conduct timely safety supervision when abnormal equipment appears.

[0070] It should be noted that the local reachable distance and the local anomaly factor are well known to those skilled in the art and will not be described in detail here.

[0071] The present invention also provides an industrial Internet security supervision system. Figure 2 As shown, the system includes a processor and a memory, and the memory stores computer program instructions. When the computer program instructions are executed by the processor, an industrial Internet security supervision method according to the first aspect of the present invention is implemented.

[0072] The system also includes other components well known to those skilled in the art, such as a communication bus and a communication interface. The configuration and functions of these components are known in the art and therefore will not be described in detail here.

[0073] In the present invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, the computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store the required information and can be accessed by an application, module, or both. Any such computer storage medium can be part of, accessible to, or connectable to a device. Any application or module described in the present invention can be implemented by computer-readable / executable instructions stored or otherwise retained by such a computer-readable medium.

[0074] In the description of this specification, "multiple" and "several" mean at least two, such as two, three or more, unless otherwise clearly defined.

[0075] While several embodiments of the present invention have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Numerous modifications, variations, and alternatives will occur to those skilled in the art without departing from the concept and spirit of the present invention. It should be understood that various alternatives to the embodiments of the present invention described herein may be employed in practicing the present invention.

Claims

1. A method for industrial Internet security supervision, characterized in that: include: Obtain the operating data of equipment in industrial Internet security supervision, including temperature, pressure, operating speed, equipment vibration frequency, and ambient temperature and humidity data; Set the initial value for each data point in the running data. Value, obtain the neighborhood data points of each data point, and calculate the reference weight of the neighborhood data points based on the Euclidean distance of the neighborhood data points and the time series attenuation factor of the acquisition time series; Take any data point as the marked data point, sort all the neighboring data points of the marked data point, and obtain the neighborhood sorting sequence. Calculate the difference between any data of the marked data point and the average value of the corresponding data of the neighboring data points, and divide it by the range of any data in the neighboring data of the marked data point. Then calculate the absolute value to obtain the relative position difference. Calculate the relative deviation by dividing the difference between the item data of two adjacent data corresponding to the marked data point in the neighborhood sorting sequence of the marked data point by the average distribution density and summing the difference with 1. Sum the reference weights of the neighborhood data as the weights of the relative deviation and multiply the sum with the product of the relative position difference to obtain the density uniformity of any item of data in the neighborhood data of the marked data point. The average value of the sum of the density uniformity of each item of the marked data point is used as the density uniformity of the marked data point. The average distribution density is the ratio between the range of any data in the neighborhood data of the marked data point and the number of neighborhood data points; The ratio between the density uniformity of the data points and the preset density threshold is used to calculate the initial The value was corrected to obtain significant value; Significant use The LOF anomaly detection is performed on each data point to obtain the degree of anomaly of each data point, and the corresponding abnormal equipment in the industrial Internet is detected.

2. The industrial Internet security supervision method according to claim 1, characterized in that: The reference weights include: Take any data point as the marked data point and use the Euclidean distance to calculate the initial The number of neighborhood data points with the same value is obtained, the collection time series of the neighborhood data points is obtained, the Euclidean distance and the exponential decay term of the time series difference between the marked data point and each neighborhood data point are calculated respectively, and the original reference weight of the neighborhood data point corresponding to the marked data point is obtained by multiplying them. The original reference weights of all neighborhood data points are summed as the normalization factor, and the original reference weight of each neighborhood data point is divided by the normalization factor to obtain the reference weight of each neighborhood data point.

3. The industrial Internet security supervision method according to claim 1, characterized in that: The reference weights further include: Taking any data point as the marked data point, calculate the linear attenuation term of the time series difference between the acquisition index of the marked data point and the acquisition index of the neighboring data points, calculate the Euclidean distance between the marked data point and each neighboring data point, multiply the Euclidean distance by the linear attenuation term to obtain the original reference weight, and divide the original reference weight of each neighboring data point by the sum of the original reference weights of all neighboring data points to obtain the normalized reference weight.

4. The industrial Internet security supervision method according to claim 1, characterized in that: Obtaining the abnormality degree of each data point includes: Run data and significant Value input LOF algorithm, use significant The value determines the range of the neighborhood data points, calculates the local reachable distance between each data point and the neighborhood data points, calculates the local anomaly factor of each data according to the local reachable distance, and obtains the degree of anomaly of the running data.

5. An industrial Internet security supervision system, characterized in that: include: A processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the industrial Internet security supervision method according to any one of claims 1 to 4 is implemented.

Images