Equipment information dynamic management method and device and industrial control equipment

Abstract

The invention provides an equipment information dynamic management method and device and industrial control equipment. The method comprises the following steps: acquiring an equipment change request from a client; determining equipment change associated information of the client based on the equipment change request; detecting whether the equipment change associated information meets the security verification condition or not; and if the equipment change associated information meets the security verification condition, passing the equipment change request, otherwise, rejecting the equipment change request. According to the technical scheme, information equipment management is automated and standardized, the labor cost is reduced, compared with the situation of excessive manual participation, the error rate of information equipment management can be effectively reduced, and the safety of enterprise information equipment is further guaranteed.

Description

Technical Field

[0001] This application relates to the technical field of device information management, and in particular, to a method and device for dynamically managing device information and an industrial control device. Background Art

[0002] In recent years, with the frequent occurrence of information security incidents such as information leakage and data theft, the information security control of industrial control systems (ICS) faces severe challenges. Industrial control devices, as the key infrastructure of industrial production, cover various types such as PLC, DCS, SCADA systems, industrial servers, industrial network devices, industrial storage media, and various industrial terminal devices. However, industrial control devices are often in a state of dynamic change and may undergo multiple operations such as configuration changes, firmware upgrades, maintenance, etc. since the day of activation, which brings great complexity to the management of industrial control devices.

[0003] In the prior art, enterprise administrators usually use EXCEL tables to manage the ledger of industrial control devices. This method has problems such as untimely update of the ledger and serious inconsistency with the actual device status, and it is difficult to meet the real-time and accurate management requirements. Especially in the context of Industry 4.0 and intelligent manufacturing, the traditional management method can no longer meet the control requirements of large-scale and distributed industrial devices. In addition, administrators also need to log in to various security software for inspections and screen logs to discover anomalies in industrial control devices. This method is not only inefficient but also prone to missing key information, unable to achieve comprehensive and effective monitoring of industrial control devices, and even more difficult to meet the stringent requirements of industrial control systems for real-time and reliability.

[0004] Therefore, building an efficient and accurate industrial control device management system to achieve real-time monitoring and dynamic management of enterprise information devices has become an urgent technical problem to be solved. Summary of the Invention

[0005] The embodiments of this application provide a method and device for dynamically managing device information and an industrial control device, aiming to solve the technical problems of low efficiency and insufficient management ability in the related art of device management.

[0006] In a first aspect, the embodiments of this application provide a method for dynamically managing device information, including: Obtaining a device change request from a client; Based on the device change request, determining the device change association information of the client; Detecting whether the device change association information meets the security verification conditions; If the device change association information meets the security verification conditions, passing the device change request; otherwise, rejecting the device change request.

[0007] In one embodiment of the present application, optionally, the device change association information includes client application information, background management parameter information, and device real-time security information. Then Determining the device change association information of the client based on the device change request includes: Obtaining the client application information in the device change request, where the client application information includes one or more of applicant, application department, application date, responsible person, device usage, changed device number, changed device type, change type, change location, and change application reason; Based on the changed device number in the client application information, obtaining the background management parameter information of the target device corresponding to the changed device number in the device management database, where the background management parameter information includes one or more of IP address, hard disk serial number, MAC address, network access permission level, operating system version, and operating system installation time; and Real-time monitoring the device real-time security information of the target device, where the device real-time security information includes one or more of registry, system events, and network traffic.

[0008] In one embodiment of the present application, optionally, detecting whether the device change association information meets the security verification conditions includes: Obtaining the historical work logs of the applicant, the application department, or the responsible person in the device management database; Determining whether each piece of the client application information matches the historical work log, where If each piece of the client application information matches the historical work log, determining that the device change association information meets the security verification conditions; If at least one piece of the client application information does not match the historical work log, determining that the device change association information does not meet the security verification conditions.

[0009] In one embodiment of the present application, optionally, detecting whether the device change association information meets the security verification conditions includes: Determining whether each piece of the background management parameter information is consistent with the real-time parameter information of the client, where If each piece of the background management parameter information is consistent with the real-time parameter information, determining that the background management parameter information meets the security verification conditions; If at least one piece of the background management parameter information is inconsistent with the real-time parameter information, determining that the background management parameter information does not meet the security verification conditions.

[0010] In one embodiment of the present application, optionally, detecting whether the device change association information meets the security verification condition includes: Obtaining the real-time security detection result of the client by the security monitoring software of the client, where the real-time security detection result is used to reflect the real-time performance of the real-time device security information of the client; If the real-time security detection result meets the abnormal condition, determining that the real-time device security information meets the security verification condition; otherwise, determining that the real-time device security information does not meet the security verification condition, where the abnormal condition includes at least one of the following: The product ID and / or vendor ID accessed in the registry in the real-time security detection result is a preset risk ID; A specified dangerous event occurs in the system event in the real-time security detection result; The specified security maintenance event does not occur in the system event in the first specified duration in the real-time security detection result; The network traffic in the real-time security detection result is greater than the predetermined security traffic threshold in the second specified duration.

[0011] In one embodiment of the present application, optionally, detecting whether the device change association information meets the security verification condition includes: Determining the abnormality degree of the device change request based on the device change association information; Determining whether the abnormality degree is within a predetermined security range, where If the abnormality degree is within the predetermined security range, determining that the device change association information meets the security verification condition; If the abnormality degree is not within the predetermined security range, determining that the device change association information does not meet the security verification condition.

[0012] In one embodiment of the present application, optionally, determining the abnormality degree of the device change request based on the device change association information includes: Obtaining the first historical attention degree of each piece of the client application information, where the first historical attention degree represents the ratio of the number of abnormalities occurring in the historical management tasks of the same type of devices of the client within a single specified historical period to the total number of requests for changes to the same type of devices in the historical management tasks within the single specified historical period; Using the first historical attention degree as the first weight, performing a weighted sum of all the client application information to obtain a first sub-abnormality degree; Obtain the second historical attention degree of each piece of the background management parameter information, where the second historical attention degree represents the ratio of the number of times of anomalies in the historical management tasks of the devices in the same department of the client within a single specified historical period to the total number of times the devices in the same department are requested to be changed in the historical management tasks within a single specified historical period; Use the second historical attention degree as the second weight, and sum the weights of all the background management parameter information to obtain the second sub-abnormality degree; Obtain the third historical attention degree of each piece of the device real-time security information, where the third historical attention degree represents the ratio of the number of times the client is monitored to have anomalies by the security monitoring software of the client within a single specified historical period to the total number of times the client is monitored by the security monitoring software within a single specified historical period; Use the third historical attention degree as the third weight, and sum the weights of all the device real-time security information to obtain the third sub-abnormality degree; Determine the variance of the first sub-abnormality degree, the second sub-abnormality degree, and the third sub-abnormality degree as the abnormality degree of the device change request.

[0013] In an embodiment of the present application, optionally, it further includes: For each piece of the client application information, obtain the first distribution range of the client application information, where the first distribution range represents the distribution of the first historical attention degrees corresponding to the client application information in multiple specified historical periods; For each piece of the background management parameter information, obtain the second distribution range of the background management parameter information, where the second distribution range represents the distribution of the second historical attention degrees corresponding to the background management parameter information in multiple specified historical periods; For each piece of the device real-time security information, obtain the third distribution range of the device real-time security information, where the third distribution range represents the distribution of the third historical attention degrees corresponding to the device real-time security information in multiple specified historical periods; Based on the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the device real-time security information, determine the minimum value of the historical change risk performance parameter of the client through the particle swarm algorithm, where , is the number of each piece of the device change association information, is the total number of the device change association information, represents the changing the weight of the device change associated information described in item denote at time the th particle's performance value on the device change associated information described in item denote at time the th particle's update speed on the device change associated information described in item is the minimum value of the historical risk performance parameter, which means searching for a set of values of all the device change associated information in the first distribution range corresponding to each client application information, the second distribution range corresponding to each background management parameter information, and the third distribution range corresponding to each device real-time security information such that the output value is the minimum; determine the minimum value of the historical change risk performance parameter and the mean value of the abnormality degree of the device change request; replace the mean value with the abnormality degree of the device change request.

[0014] In a second aspect, an embodiment of the present application provides a device information dynamic management device, including: a device change request acquisition unit, configured to acquire a device change request from a client; a device change associated information determination unit, configured to determine the device change associated information of the client based on the device change request; a security verification condition detection unit, configured to detect whether the device change associated information meets the security verification condition; a management execution unit, configured to, if the device change associated information meets the security verification condition, pass the device change request, otherwise, reject the device change request.

[0015] In an embodiment of the present application, optionally, the device change associated information includes client application information, background management parameter information, and device real-time security information, then the device change associated information determination unit includes: a client application information determination unit, configured to acquire the client application information in the device change request, where the client application information includes one or more of an applicant, an application department, an application date, a responsible person, a device use, a changed device number, a changed device type, a change type, a change location, and a change application reason; The background management parameter information determination unit is configured to obtain the background management parameter information of the target device corresponding to the changed device number in the device management database based on the changed device number in the client application information, where the background management parameter information includes one or more of: IP address, hard disk serial number, MAC address, network access permission level, operating system version, and operating system installation time; and The device real-time security information determination unit is configured to monitor the device real-time security information of the target device in real time, where the device real-time security information includes one or more of: registry, system events, and network traffic.

[0016] In an embodiment of the present application, optionally, the security verification condition detection unit includes: The first detection unit is configured to obtain the historical work logs of the applicant, the application department, or the responsible person in the device management database, and determine whether each item of the client application information matches the historical work logs. Wherein, if each item of the client application information matches the historical work logs, it is determined that the device change association information meets the security verification conditions; if at least one item of the client application information does not match the historical work logs, it is determined that the device change association information does not meet the security verification conditions.

[0017] In an embodiment of the present application, optionally, the security verification condition detection unit includes: The second detection unit is configured to determine whether each item of the background management parameter information is consistent with the real-time parameter information of the client. Wherein, if each item of the background management parameter information is consistent with the real-time parameter information, it is determined that the background management parameter information meets the security verification conditions; if at least one item of the background management parameter information is inconsistent with the real-time parameter information, it is determined that the background management parameter information does not meet the security verification conditions.

[0018] In an embodiment of the present application, optionally, the security verification condition detection unit includes: The third detection unit is configured to obtain the real-time security detection result of the client by the security monitoring software of the client, where the real-time security detection result is used to reflect the real-time performance of the device real-time security information of the client. If the real-time security detection result meets the abnormal conditions, it is determined that the device real-time security information meets the security verification conditions; otherwise, it is determined that the device real-time security information does not meet the security verification conditions.

[0019] In an embodiment of the present application, optionally, the abnormal conditions include at least one of the following: The product ID and / or vendor ID accessed in the registry in the real-time security detection result is a preset risk ID; A specified dangerous event occurs in the system event in the real-time security detection result; No specified security maintenance event occurs in the system event in the real-time security detection result within a first specified duration; The network traffic in the real-time security detection result is greater than a predetermined safe traffic threshold within a second specified duration.

[0020] In an embodiment of the present application, optionally, the security verification condition detection unit includes: An abnormality degree calculation unit, configured to determine the abnormality degree of the device change request based on the device change association information; An abnormality degree judgment unit, configured to determine whether the abnormality degree is within a predetermined safe range. Wherein, if the abnormality degree is within the predetermined safe range, it is determined that the device change association information meets the security verification condition; if the abnormality degree is not within the predetermined safe range, it is determined that the device change association information does not meet the security verification condition.

[0021] In an embodiment of the present application, optionally, the abnormality degree calculation unit is specifically configured to: obtain the first historical attention degree of each item of the client application information, where the first historical attention degree represents the ratio of the number of abnormalities that occurred in the historical management tasks of the same type of devices of the client within a single specified historical period to the total number of times the same type of devices were requested to be changed in the historical management tasks within the single specified historical period; use the first historical attention degree as the first weight, and perform a weighted sum on all the client application information to obtain a first sub-abnormality degree; obtain the second historical attention degree of each item of the background management parameter information, where the second historical attention degree represents the ratio of the number of abnormalities that occurred in the historical management tasks of the devices in the same department of the client within a single specified historical period to the total number of times the devices in the same department were requested to be changed in the historical management tasks within the single specified historical period; use the second historical attention degree as the second weight, and perform a weighted sum on all the background management parameter information to obtain a second sub-abnormality degree; obtain the third historical attention degree of each item of the device real-time security information, where the third historical attention degree represents the ratio of the number of abnormalities monitored by the security monitoring software of the client within a single specified historical period to the total number of times the security monitoring software monitored the client within the single specified historical period; use the third historical attention degree as the third weight, and perform a weighted sum on all the device real-time security information to obtain a third sub-abnormality degree; determine the variance of the first sub-abnormality degree, the second sub-abnormality degree, and the third sub-abnormality degree as the abnormality degree of the device change request.

[0022] In one embodiment of the present application, optionally, the device further includes: A first distribution range calculation unit, configured to obtain a first distribution range of each piece of the client application information, where the first distribution range represents the distribution of the first historical attention degrees corresponding to the client application information in a plurality of the specified historical time periods; A second distribution range calculation unit, configured to obtain a second distribution range of each piece of the background management parameter information, where the second distribution range represents the distribution of the second historical attention degrees corresponding to the background management parameter information in a plurality of the specified historical time periods; A third distribution range calculation unit, configured to obtain a third distribution range of each piece of the device real-time security information, where the third distribution range represents the distribution of the third historical attention degrees corresponding to the device real-time security information in a plurality of the specified historical time periods; A minimum value calculation unit, configured to determine the minimum value of the historical change risk performance parameter of the client through a particle swarm algorithm based on the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the device real-time security information, where , is the number of each piece of the device change association information, is the total number of the device change association information, represents the th piece of the weight of the device change association information, represents the performance value of the i-th particle at the t-th moment on the th piece of the device change association information, represents the update speed of the i-th particle at the (t + 1)-th moment on the th piece of the device change association information, is the minimum value of the historical risk performance parameter, indicating to search for a set of values of all the device change association information in the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the device real-time security information such that the output value is the minimum; A risk degree correction unit, configured to determine the average value of the minimum value of the historical change risk performance parameter and the abnormality degree of the device change request, and replace the average value with the abnormality degree of the device change request.

[0023] In a third aspect, an embodiment of the present application provides an industrial control device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in the first aspect above.

[0024] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions for executing the method described in the first aspect above.

[0025] In view of the technical problems of low efficiency and insufficient management ability in the device management method in the related art, the above technical solutions propose a security verification mechanism based on device change association information, which can effectively improve the security and efficiency of device management. By real-time monitoring the security status of the device and comprehensively analyzing it in combination with historical data, potential security risks can be detected in a timely manner before the device change operation is executed, ensuring the security and stability of the enterprise information device. At the same time, by automating and standardizing the management of information devices, the labor cost is reduced. Compared with the situation of excessive manual participation, the error rate of information device management can be effectively reduced, further ensuring the security of the enterprise information device. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0027] Figure 1 Shows a flowchart of a method for dynamically managing device information according to an embodiment of the present application; Figure 2 Shows a flowchart of a method for dynamically managing device information according to another embodiment of the present application; Figure 3 Shows a block diagram of an industrial control device according to an embodiment of the present application; Figure 4 Shows a block diagram of an industrial control device according to another embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0028] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0029] Figure 1 The flowchart of the method for dynamically managing device information according to an embodiment of the present application is shown.

[0030] As Figure 1 shown, the method for dynamically managing device information according to an embodiment of the present application includes: Step 102, obtaining a device change request from a client.

[0031] When the client performs a change operation on the information device, it will initiate a device change request to the information device management system, that is, the device change request is a change operation request initiated by the client for a certain information device. Optionally, the change operation may include an application issuance request, a repair request, a replacement request, an upgrade request, a scrapping request, a permission change request, a responsible person change, an installation location change, etc. for the information device.

[0032] Step 104, determining the device change association information of the client based on the device change request.

[0033] Optionally, the device change request carries the device change association information of the client.

[0034] Optionally, the device change request carries the storage address of the device change association information in the client, and the information device management system addresses and downloads the device change association information in the client based on this storage address in the device change request after receiving the device change request.

[0035] The device change association information includes, but is not limited to, client application information, background management parameter information, and device real-time security information. Specifically, the client application information represents the specific information involved in the application requirements of the client, including, but is not limited to, the applicant, the application department, the device usage, the changed device number, the change type, etc.

[0036] The background management parameter information represents the parameter information currently possessed by the information device for which the client applies for change, including, but is not limited to, the IP address of the device, the hard disk serial number, the MAC address, the operating system version, etc.

[0037] The device real-time security information represents the monitoring information of the security monitoring software for the information device for which the client applies for change, including, but is not limited to, the registry status of the device, system events, network traffic, etc. Generally speaking, the device change association information is used to reflect the information possessed by the client itself and the information device for which the client applies for change, which has an impact on device management. Optionally, the device real-time security information is as Figure 3 shown.

[0038] It should be added that based on the client application information and the background management parameter information, an information device ledger can be generated as shown in Tables 1 and 2 below.

[0039] Table 1

[0040] Table 2

[0041] Step 106: Detect whether the device change association information meets the security verification conditions.

[0042] The security verification conditions are conditions set to ensure that device change operations do not pose a threat to the enterprise's information security, and are used to reflect the specific standards that should be met when the client for this device change operation, the information device for which the client applies for change, and the current network environment monitored by the security monitoring software are all secure.

[0043] In a possible design, Step 106 includes: obtaining the historical work logs of the applicant, the applying department, or the responsible person in the device management database; determining whether each piece of the client application information matches the historical work logs. Among them, if each piece of the client application information matches the historical work logs, it is determined that the device change association information meets the security verification conditions; if at least one piece of the client application information does not match the historical work logs, it is determined that the device change association information does not meet the security verification conditions.

[0044] That is, the verification of the client application information includes: by querying the historical work logs in the device management database, verifying whether each piece of client application information such as the applicant and the applying department is consistent with the historical records. If it is consistent, it means that the current client has the qualification to apply for device change, and thus passes the verification; otherwise, it means that the current client does not have the qualification to apply for device change, and the request is rejected.

[0045] In a possible design, Step 106 includes: determining whether each piece of the background management parameter information is consistent with the real-time parameter information of the client. Among them, if each piece of the background management parameter information is consistent with the real-time parameter information, it is determined that the background management parameter information meets the security verification conditions; if at least one piece of the background management parameter information is inconsistent with the real-time parameter information, it is determined that the background management parameter information does not meet the security verification conditions.

[0046] That is, the verification method for the background management parameter information is as follows: By comparing the real-time parameter information of the information device for which the client applies for change with the background management parameter information, it is ensured that the actual state of the information device is consistent with the background record. If they are consistent, it indicates that the information device is in a safe and reliable state and has the qualification to be changed, and thus passes the verification; otherwise, it indicates that the information device is in an abnormal state and cannot be changed, and the request is rejected. After rejecting the request, more attention can be given to the information device in the abnormal state to promptly discover and handle the abnormality of the information device and reduce the occurrence of problems such as information leakage.

[0047] In a possible design, step 106 includes: Obtaining the real-time security detection result of the client by the security monitoring software of the client, where the real-time security detection result is used to reflect the real-time performance of the device real-time security information of the client; If the real-time security detection result meets the abnormal condition, it is determined that the device real-time security information meets the security verification condition, otherwise, it is determined that the device real-time security information does not meet the security verification condition.

[0048] That is, the verification method for the device real-time security information is as follows: Obtain the real-time security detection result of the information device through the security monitoring software and determine whether there are any abnormal situations. For example, whether there are risk IDs in the registry, whether dangerous events occur in system events, whether network traffic exceeds the security threshold, etc. If there are abnormalities, it indicates that the current network environment of the information device is abnormal, and the request is rejected; otherwise, it indicates that the current network environment of the information device is safe and reliable, and the verification can be passed.

[0049] Specifically, the abnormal condition includes at least one of the following: The product ID and / or vendor ID accessed in the registry in the real-time security detection result is a preset risk ID; A specified dangerous event occurs in the system event in the real-time security detection result; A specified security maintenance event does not occur in the system event in the real-time security detection result within the first specified duration; The network traffic in the real-time security detection result is greater than the predetermined security traffic threshold within the second specified duration.

[0050] The preset risk ID includes the self ID and vendor ID of known large-capacity storage devices on the market. If the product ID and / or vendor ID accessed in the registry in the real-time security detection result is a preset risk ID, it indicates that the information device currently has the possibility of accessing a large-capacity storage device, and accessing a large-capacity storage device means that someone may be copying or transferring the data in the information device through the large-capacity storage device.

[0051] The specified dangerous events include, but are not limited to, discovering viruses, discovering networking operations that exceed the permissions of the information device or the user of the client, external device access operations, etc. The occurrence of specified dangerous events means that the information device may be in an insecure environment. Conversely, the specified security maintenance events refer to completing the virus killing task within a specified period, periodically scanning whether the security monitoring software is offline, etc. The non-occurrence of specified security maintenance events indicates that there are omissions in the protection of the information device, increasing the risk of abnormalities in the information device, and the information device may be in an insecure environment.

[0052] Step 108, if the device change associated information meets the security verification conditions, approve the device change request; otherwise, reject the device change request.

[0053] If the device change associated information passes all the security verification conditions, that is, the client application information, the background management parameter information, and the device real-time security information all meet the security verification conditions, the information device management system will allow the execution of the device change request; otherwise, the information device management system will reject the request and record the relevant abnormal information for subsequent analysis.

[0054] The above technical solution addresses the problems of low efficiency and insufficient management capabilities in the existing device management methods, and proposes a security verification mechanism based on device change associated information, which can effectively improve the security and efficiency of device management. By real-time monitoring the security status of the device and comprehensively analyzing it in combination with historical data, potential security risks can be detected in a timely manner before the execution of device change operations, ensuring the security and stability of enterprise information devices. At the same time, by automating and standardizing the information device management, the labor cost is reduced. Compared with the situation of excessive manual participation, the error rate of information device management can also be effectively reduced, further ensuring the security of enterprise information devices.

[0055] It should be added that in the information device management system, for a single information device, a life cycle resume as shown in Table 3 below can be automatically generated for it to strengthen the effective management of the information device.

[0056] Table 3

[0057] After completing the control of the information device, an enterprise information device security library can also be established. The enterprise information device security library stores the information device ledger information extracted from the security monitoring software and information such as the number of illegal external connections and virus infections that are prone to information security incidents. The record content of the information devices in the enterprise information device security library is as shown in Table 4 below.

[0058] Table 4

[0059] After completing the control of information devices, an information device alarm library can be established. As shown in Table 5 below, using the device number of the information device as the only identifier, the account information in the information device security library is automatically compared with the information device security library. Information such as IP addresses, hard disk serial numbers, records of violations generated in security software, and the number of infected viruses that are inconsistent is used to form an information device alarm library. The administrator regularly inspects and disposes of the information device alarm library to improve the enterprise's information security protection level.

[0060] Table 5

[0061] Among them, for information device S001, the IP address collected by the security software for the information device is dynamically allocated, while the IP address in the account is 192.168.1.1. This information device has an information security risk of accessing the Internet.

[0062] For information device S002, the hard disk serial number collected by the security software is SD000018, while the account shows the hard disk serial number as SD000002, indicating a discrepancy. The administrator checks the host monitoring and auditing software and discovers the system log of the user changing the hard disk. After verification, it is found that the user disassembled the original hard disk SD000002 and privately replaced it with a new hard disk SD000018, posing a great information security risk of data theft.

[0063] For information device S003, the security software shows that the host has not been scanned for viruses for more than 30 days, the antivirus software has not been upgraded and updated, and the number of infected viruses is 23.

[0064] For information device S004, the PID and VID (access product ID and vendor ID) in the information device registry collected by the security software are used to determine that this information device has a risk of accessing a large-capacity information storage device.

[0065] Figure 2 The flowchart of the device information dynamic management method according to another embodiment of the present application is shown.

[0066] As Figure 2 shown, the device information dynamic management method according to another embodiment of the present application includes: Step 202, obtaining a device change request from the client.

[0067] When the client performs a change operation on an information device, it will initiate a device change request to the information device management system. The device change request is a request for a change operation on a specific information device initiated by the client. The change operation can include requests for application issuance, repair, replacement, upgrade, scrapping, permission change, etc. for the information device. The device change request usually contains detailed information such as the applicant, the applying department, the device number, the change type, and the reason for the change. Optionally, the device change request can be submitted through the front-end interface of the client or initiated through an automated script or API interface.

[0068] Step 204, based on the device change request, determine the device change association information of the client.

[0069] The device change association information is the key information involved in the device change request and is used to evaluate the security and compliance of the device change operation. The device change association information includes, but is not limited to, the client application information, the background management parameter information, and the device real-time security information. The device change association information has been described in detail above and will not be elaborated here.

[0070] Step 206, based on the device change association information, determine the abnormality degree of the device change request.

[0071] The abnormality degree is a comprehensive security evaluation index of the device change request and is used to quantify the security risk of the device change operation. The calculation of the abnormality degree is based on the various data in the device change association information.

[0072] Specifically, the calculation method of the abnormality degree includes: First, obtain the first historical attention degree of each piece of the client application information.

[0073] Among them, the first historical attention degree represents the ratio of the number of abnormalities that occurred in the historical management tasks of the same type of devices of the client within a single specified historical period to the total number of requests for changes to the same type of devices in the historical management tasks within the single specified historical period.

[0074] Using the first historical attention degree as the first weight, sum the weights of all the client application information to obtain the first sub-abnormality degree. For example, if a certain type of information device frequently has abnormalities in historical changes, the abnormality degree of the change request for this type of device will increase accordingly, and the impact on the overall abnormality level will be greater.

[0075] Second, obtain the second historical attention degree of each piece of the background management parameter information.

[0076] Wherein, the second historical attention degree represents the ratio of the number of anomalies occurring in the historical management tasks of the devices in the same department of the client within a single specified historical period to the total number of times the devices in the same department are requested to be changed in the historical management tasks within a single specified historical period.

[0077] Using the second historical attention degree as the second weight, the weighted sum of all the background management parameter information is obtained to get the second sub-anomaly degree. For example, if the devices of a certain department frequently have anomalies during historical changes, the anomaly degree of the device change requests of this department will increase accordingly, and the impact on the overall anomaly level will be more serious.

[0078] Third, obtain the third historical attention degree of each piece of the device real-time security information.

[0079] Wherein, the third historical attention degree represents the ratio of the number of anomalies monitored by the security monitoring software of the client within a single specified historical period to the total number of times the security monitoring software monitors the client within a single specified historical period.

[0080] Using the third historical attention degree as the third weight, the weighted sum of all the device real-time security information is obtained to get the third sub-anomaly degree. For example, if the real-time security information of a certain device shows that it frequently has network traffic anomalies or system event anomalies, the anomaly degree of the change request of this device will increase accordingly, and the impact on the overall anomaly level will be more serious.

[0081] Finally, determine the variance of the first sub-anomaly degree, the second sub-anomaly degree, and the third sub-anomaly degree as the anomaly degree of the device change request. The calculation of the variance can reflect the dispersion degree of each sub-security degree. If the variance is large, it indicates that the security risk of the device change request is high; if the variance is small, it indicates that the security risk of the device change request is low.

[0082] Step 208, determine whether the anomaly degree is within a predetermined security range.

[0083] Step 210, if the anomaly degree is within the predetermined security range, determine that the device change association information meets the security verification condition; if the anomaly degree is not within the predetermined security range, determine that the device change association information does not meet the security verification condition.

[0084] The predetermined safety range is the threshold range in which the anomaly level set by the information device management system is insufficient to affect the security of the information device, and is used to determine whether the device change request meets the security verification conditions. If the anomaly level is within the predetermined safety range, it indicates that the security risk of the device change request is relatively low and can pass the verification; if the anomaly level is not within the predetermined safety range, it indicates that the security risk of the device change request is relatively high and further review or rejection is required.

[0085] Step 212, if the device change associated information meets the security verification conditions, approve the device change request; otherwise, reject the device change request.

[0086] If the device change associated information passes all the security verification conditions, that is, the client application information, the background management parameter information, and the device real-time security information all meet the security verification conditions, the information device management system will allow the execution of the device change request; otherwise, the information device management system will reject the request and record the relevant anomaly information for subsequent analysis.

[0087] The above technical solution addresses the problems of low efficiency and insufficient management capabilities in the existing device management methods, and proposes a security verification mechanism based on device change associated information, which can effectively improve the security and efficiency of device management. By detecting the performance of both the client and the information device, and real-time monitoring the security status of the device, and combining historical data for comprehensive analysis, potential security risks can be detected in a timely manner before the device change operation is executed, ensuring the security and stability of the enterprise information device. At the same time, by automating and standardizing the information device management, the labor cost is reduced. Compared with the situation of excessive manual participation, the error rate of information device management can also be effectively reduced, further ensuring the security of the enterprise information device.

[0088] In addition, the calculated anomaly level can be further corrected by the historical performance of each device change associated information.

[0089] First, for each piece of the client application information, obtain the first distribution range of the client application information, where the first distribution range represents the distribution of the first historical attention degrees corresponding to the client application information in multiple specified historical periods.

[0090] For each piece of the background management parameter information, obtain the second distribution range of the background management parameter information, where the second distribution range represents the distribution of the second historical attention degrees corresponding to the background management parameter information in multiple specified historical periods.

[0091] For each piece of the real-time security information of the device, obtain the third distribution range of the real-time security information of the device, where the third distribution range represents the distribution of the third historical attention degrees corresponding to the real-time security information of the device in multiple specified historical periods.

[0092] The distribution of the client application information, the background management parameter information, and the real-time security information of the device in multiple historical periods can comprehensively reflect the historical change trends and abnormal manifestations of these information. The accumulation and analysis of this historical data help to more accurately evaluate the risks of current device change requests. By analyzing the distribution of the historical attention degrees, it is possible to identify which information frequently triggers abnormalities in historical changes, thereby providing data support for the current risk assessment.

[0093] Next, based on the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the real-time security information of the device, determine the minimum value of the historical change risk performance parameter of the client through the particle swarm algorithm.

[0094] Through optimized search, find a set of values of the device change correlation information such that the historical risk performance parameter is minimized. This means that the system can identify the safest device change plan, thereby reducing the risks of device change operations. The historical change risk performance parameter of this safest device change plan reflects the historical security level of the device and is an important influencing factor for the abnormality degree calculated above. Or rather, the historical security level of the device has an impact on whether the current device change is abnormal.

[0095] Therefore, the minimum value of the historical change risk performance parameter and the average value of the abnormality degree of the device change request can be determined, and the average value is replaced with the abnormality degree of the device change request, that is, the abnormality degree is corrected with the minimum value of the historical change risk performance parameter, further exploring the influence of the historical security level of the device on the current device change behavior and improving the accuracy of the abnormality degree calculation.

[0096] Among them, , is the number of each piece of the device change correlation information, is the total number of the device change correlation information, represents the th weight of the device change correlation information, represents the performance value of the i-th particle at time t on the th piece of the device change correlation information, represents the performance value of the i-th particle at time t + 1 on the The update speed on the device change association information described in item is the minimum value of the historical risk performance parameter, which means searching for a set of values of all the device change association information in the first distribution range corresponding to each client application information, the second distribution range corresponding to each background management parameter information, and the third distribution range corresponding to each device real-time security information, so that the output value is the smallest.

[0097] Simply put, the particle swarm algorithm searches for the optimal solution in the solution space by simulating the group behavior of bird flocks or fish schools. Each particle represents a potential solution (i.e., a set of values of device change association information), and by continuously updating its position and speed, it gradually approaches the global optimal solution.

[0098] Specifically, represents the current performance value of the i-th particle on the j-th device change association information, represents the update speed of the i-th particle on the j-th device change association information, is the weight of the j-th device change association information, reflecting the level of its historical attention, is the minimum value of the historical risk performance parameter, representing the optimal solution searched in the solution space. By dynamically adjusting the position and speed of the particles, the system can adaptively optimize the search process and gradually approach the global optimal solution. This dynamic adjustment mechanism enables the system to flexibly adjust the values of device change association information according to historical data and current data, thereby reducing the risk of device change operations.

[0099] Among them, The calculation method of

[0100] It should be noted that is the historical optimal performance value of the i-th particle on the j-th device change association information, and are preset learning factors, respectively reflecting the influence degrees of individual and group experience on the update speed, and are random numbers used to introduce randomness, w represents the weight of the j-th device change association information, is the numerical embodiment of the historical optimal performance of all the device change association information. On this basis, is and The sum. Thus, by dynamically adjusting the positions and velocities of particles within each first distribution range, each second distribution range, and each third distribution range, the system can adaptively optimize the search process, gradually approaching the global optimal solution and searching for the most suitable value of the device change association information. This dynamic adjustment mechanism enables the system to flexibly adjust the value of the device change association information based on historical data and current data, thereby reducing the risk of device change operations.

[0101] Generally speaking, the device change association information involves multiple dimensions (such as client application information, background management parameter information, device real-time security information, etc.), and each dimension has different value ranges and weights. The particle swarm algorithm can efficiently search for the optimal solution in the multi-dimensional solution space and find a set of values of the device change association information that minimizes the historical risk performance parameter. By globally searching for the optimal solution in the multi-dimensional solution space, the system can comprehensively consider the impacts of various device change association information, thereby making a better decision. This global search mechanism enables the system to find the safest device change plan in a complex device management environment. In summary, through the combination of historical data and current data, this technical solution can make decisions more intelligently, further ensuring the security of device change operations. This intelligent decision-making mechanism enables the system to make better decisions in a complex device management environment.

[0102] An embodiment of the present application provides a device information dynamic management device, including: A device change request acquisition unit, configured to acquire a device change request from a client; A device change association information determination unit, configured to determine the device change association information of the client based on the device change request; A security verification condition detection unit, configured to detect whether the device change association information meets the security verification conditions; A management execution unit, configured to, if the device change association information meets the security verification conditions, pass the device change request; otherwise, reject the device change request.

[0103] In an embodiment of the present application, optionally, the device change association information includes client application information, background management parameter information, and device real-time security information, and the device change association information determination unit includes: A client application information determination unit, configured to acquire the client application information in the device change request, where the client application information includes one or more of an applicant, an application department, an application date, a responsible person, a device use, a changed device number, a changed device type, a change type, a change location, and a change application reason; A background management parameter information determination unit, configured to obtain the background management parameter information of the target device corresponding to the changed device number in the device management database based on the changed device number in the client application information, where the background management parameter information includes one or more of: IP address, hard disk serial number, MAC address, network access permission level, operating system version, and operating system installation time; and A device real-time security information determination unit, configured to monitor the device real-time security information of the target device in real time, where the device real-time security information includes one or more of: registry, system events, and network traffic.

[0104] In an embodiment of the present application, optionally, the security verification condition detection unit includes: A first detection unit, configured to obtain the historical work logs of the applicant, the application department, or the responsible person in the device management database, and determine whether each piece of the client application information matches the historical work logs. Wherein, if each piece of the client application information matches the historical work logs, it is determined that the device change association information meets the security verification conditions; if at least one piece of the client application information does not match the historical work logs, it is determined that the device change association information does not meet the security verification conditions.

[0105] In an embodiment of the present application, optionally, the security verification condition detection unit includes: A second detection unit, configured to determine whether each piece of the background management parameter information is consistent with the real-time parameter information of the client. Wherein, if each piece of the background management parameter information is consistent with the real-time parameter information, it is determined that the background management parameter information meets the security verification conditions; if at least one piece of the background management parameter information is inconsistent with the real-time parameter information, it is determined that the background management parameter information does not meet the security verification conditions.

[0106] In an embodiment of the present application, optionally, the security verification condition detection unit includes: A third detection unit, configured to obtain the real-time security detection result of the client by the security monitoring software of the client, where the real-time security detection result is used to reflect the real-time performance of the device real-time security information of the client. If the real-time security detection result meets the abnormal conditions, it is determined that the device real-time security information meets the security verification conditions; otherwise, it is determined that the device real-time security information does not meet the security verification conditions.

[0107] In an embodiment of the present application, optionally, the abnormal conditions include at least one of the following: The product ID and / or vendor ID accessed in the registry in the real-time security detection result is a preset risk ID; A specified dangerous event occurs in the system event in the real-time security detection result; No specified security maintenance event occurs in the system event in the real-time security detection result within a first specified duration; The network traffic in the real-time security detection result is greater than a predetermined security traffic threshold within a second specified duration.

[0108] In an embodiment of the present application, optionally, the security verification condition detection unit includes: An abnormality degree calculation unit, configured to determine the abnormality degree of the device change request based on the device change association information; An abnormality degree judgment unit, configured to determine whether the abnormality degree is within a predetermined security range. Wherein, if the abnormality degree is within the predetermined security range, it is determined that the device change association information meets the security verification condition; if the abnormality degree is not within the predetermined security range, it is determined that the device change association information does not meet the security verification condition.

[0109] In an embodiment of the present application, optionally, the abnormality degree calculation unit is specifically configured to: obtain the first historical attention degree of each item of the client application information, where the first historical attention degree represents the ratio of the number of abnormalities that occurred in the historical management tasks of the same type of devices of the client within a single specified historical period to the total number of requests for changes to the same type of devices in the historical management tasks within the single specified historical period; use the first historical attention degree as the first weight, and perform a weighted sum on all the client application information to obtain a first sub-abnormality degree; obtain the second historical attention degree of each item of the background management parameter information, where the second historical attention degree represents the ratio of the number of abnormalities that occurred in the historical management tasks of the devices in the same department of the client within a single specified historical period to the total number of requests for changes to the devices in the same department in the historical management tasks within the single specified historical period; use the second historical attention degree as the second weight, and perform a weighted sum on all the background management parameter information to obtain a second sub-abnormality degree; obtain the third historical attention degree of each item of the device real-time security information, where the third historical attention degree represents the ratio of the number of abnormalities monitored by the security monitoring software of the client within a single specified historical period to the total number of monitoring times of the client by the security monitoring software within the single specified historical period; use the third historical attention degree as the third weight, and perform a weighted sum on all the device real-time security information to obtain a third sub-abnormality degree; determine the variance of the first sub-abnormality degree, the second sub-abnormality degree, and the third sub-abnormality degree as the abnormality degree of the device change request.

[0110] In one embodiment of the present application, optionally, the device further includes: A first distribution range calculation unit, configured to obtain a first distribution range of each piece of the client application information, where the first distribution range represents the distribution of the first historical attention degrees corresponding to the client application information in a plurality of the specified historical time periods; A second distribution range calculation unit, configured to obtain a second distribution range of each piece of the background management parameter information, where the second distribution range represents the distribution of the second historical attention degrees corresponding to the background management parameter information in a plurality of the specified historical time periods; A third distribution range calculation unit, configured to obtain a third distribution range of each piece of the device real-time security information, where the third distribution range represents the distribution of the third historical attention degrees corresponding to the device real-time security information in a plurality of the specified historical time periods; A minimum value calculation unit, configured to determine the minimum value of the historical change risk performance parameter of the client based on the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the device real-time security information through a particle swarm algorithm, where , is the number of each piece of the device change association information, is the total number of the device change association information, represents the th piece of the weight of the device change association information, represents the performance value of the i-th particle at the t-th moment on the th piece of the device change association information, represents the update speed of the i-th particle at the (t + 1)-th moment on the th piece of the device change association information, is the minimum value of the historical risk performance parameter, indicating to search for a set of values of all the device change association information in the first distribution range corresponding to each piece of the client application information, the second distribution range corresponding to each piece of the background management parameter information, and the third distribution range corresponding to each piece of the device real-time security information such that the output value of is the minimum; A risk degree correction unit, configured to determine the mean value of the minimum value of the historical change risk performance parameter and the abnormality degree of the device change request, and replace the mean value with the abnormality degree of the device change request.

[0111] This device uses the solution described in any of the above embodiments, and thus has all the above technical effects, which will not be elaborated here.

[0112] In addition, in one embodiment, the present application provides an industrial control device, which can be a server, and its internal structure diagram can be as Figure 3 shown. The industrial control device includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor of the industrial control device is used to provide computing and control capabilities. The memory of the industrial control device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the industrial control device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, it can implement the method described in any of the above embodiments.

[0113] In one embodiment, the present application further provides an industrial control device, which can be a client, and its internal structure diagram can be as Figure 4 shown. The industrial control device includes a processor, a memory, a network interface, a display screen, and an input device connected through a system bus. Among them, the processor of the industrial control device is used to provide computing and control capabilities. The memory of the industrial control device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the industrial control device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, it can implement the method described in any of the above embodiments.

[0114] Any of the above industrial control devices in the embodiments of the present application exist in various forms, including but not limited to: (1) Mobile communication devices: The characteristic of such devices is that they have mobile communication functions and mainly aim to provide voice and data communication. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones, etc.

[0115] (2) Ultra-mobile personal computer devices: Such devices belong to the category of personal computers, have computing and processing functions, and generally also have the characteristic of mobile Internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as iPad.

[0116] (3) Portable entertainment devices: Such devices can display and play multimedia content. Such devices include: audio and video players (such as iPod), handheld game consoles, e-books, and smart toys, wearable devices, and portable in-vehicle navigation devices.

[0117] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but due to the need to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc.

[0118] (5) Other electronic devices with data interaction functions.

[0119] In addition, the embodiments of the present application provide a computer-readable storage medium storing computer-executable instructions, and the computer-executable instructions are used to execute the following steps: A security verification mechanism based on device change association information is proposed, which can effectively improve the security and efficiency of device management. By real-time monitoring the security status of devices and comprehensively analyzing historical data, potential security risks can be detected in time before the execution of device change operations, ensuring the security and stability of enterprise information devices. At the same time, by automating and standardizing the management of information devices, the labor cost is reduced. Compared with the situation of excessive manual participation, the error rate of information device management can also be effectively reduced, further ensuring the security of enterprise information devices.

[0120] It should be noted that the functions or steps that can be realized by the above computer-readable storage medium or industrial control device can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described in detail here.

[0121] The technical solution of the present application has been described in detail above with reference to the accompanying drawings. The technical solution of the present application proposes a security verification mechanism based on device change association information, which can effectively improve the security and efficiency of device management. By real-time monitoring the security status of devices and comprehensively analyzing historical data, potential security risks can be detected in time before the execution of device change operations, ensuring the security and stability of enterprise information devices. At the same time, by automating and standardizing the management of information devices, the labor cost is reduced. Compared with the situation of excessive manual participation, the error rate of information device management can also be effectively reduced, further ensuring the security of enterprise information devices.

[0122] It should be understood that the term "and / or" used herein is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally represents an "or" relationship between the associated objects before and after.

[0123] It should be understood that although the terms first, second, etc. may be used in the embodiments of the present application to describe sub - abnormality degrees, these sub - abnormality degrees should not be limited to these terms. These terms are only used to distinguish the sub - abnormality degrees from each other. For example, without departing from the scope of the embodiments of the present application, the first sub - abnormality degree may also be referred to as the second sub - abnormality degree, and similarly, the second sub - abnormality degree may also be referred to as the first sub - abnormality degree.

[0124] Depending on the context, the word "if" as used herein can be interpreted as "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detected (stated condition or event)" can be interpreted as "when determined" or "in response to determining" or "when detected (stated condition or event)" or "in response to detecting (stated condition or event)".

[0125] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "the", and "said" used in the embodiments of the present application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0126] In several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of devices or units can be in electrical, mechanical, or other forms.

[0127] In addition, each functional unit in the various embodiments of the present application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above - mentioned integrated units can be implemented in the form of hardware, or in the form of a combination of hardware and software functional units.

[0128] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0129] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for dynamic management of device information, characterized in that: include: Get device change request from client; Based on the device change request, determining device change associated information of the client; Detecting whether the device change associated information satisfies the security verification condition; If the device change associated information satisfies the security verification condition, the device change request is approved; otherwise, the device change request is rejected.

2. The method according to claim 1, characterized in that The device change associated information includes client application information, background management parameter information and device real-time security information. The determining, based on the device change request, device change associated information of the client includes: Obtaining the client application information in the equipment change request, wherein the client application information includes: one or more of the applicant, application department, application date, responsible person, equipment purpose, changed equipment number, changed equipment type, change type, change location and change application reason; Based on the changed device number in the client application information, obtaining the background management parameter information of the target device corresponding to the changed device number in the device management database, wherein the background management parameter information includes: one or more of: IP address, hard disk serial number, MAC address, networking permission level, operating system version and operating system installation time; and The real-time security information of the target device is monitored in real time, wherein the real-time security information of the target device includes one or more of a registry, a system event, and a network flow.

3. The method according to claim 2, characterized in that The detecting whether the device change associated information satisfies the security verification condition includes: Obtaining the historical work log of the applicant, the application department or the responsible person in the equipment management database; Determine whether each of the client application information matches the historical work log, wherein: If each of the client application information matches the historical work log, it is determined that the device change associated information meets the security verification condition; If at least one item of the client application information does not match the historical work log, determining that the device change associated information does not meet the security verification condition; Determine whether each item of the background management parameter information is consistent with the real-time parameter information of the client, wherein: If each of the background management parameter information is consistent with the real-time parameter information, it is determined that the background management parameter information meets the security verification condition; If at least one item of the background management parameter information is inconsistent with the real-time parameter information, it is determined that the background management parameter information does not meet the security verification condition.

4. The method according to claim 2, characterized in that: The detecting whether the device change associated information satisfies the security verification condition includes: Obtaining a real-time security detection result of the client by the security monitoring software of the client, wherein the real-time security detection result is used to reflect the real-time performance of the real-time security information of the device of the client; If the real-time security detection result meets the abnormal condition, it is determined that the real-time security information of the device meets the security verification condition; otherwise, it is determined that the real-time security information of the device does not meet the security verification condition, wherein the abnormal condition includes at least one of the following: The product ID and / or supplier ID in the registration form in the real-time security detection result is a preset risk ID; A specified dangerous event occurs in the system event in the real-time safety detection result; No designated security maintenance event occurs in the system events in the real-time security detection result within the first designated time period; The network traffic in the real-time security detection result is greater than a predetermined security traffic threshold within a second specified time period.

5. The method according to claim 2, characterized in that: The detecting whether the device change associated information satisfies the security verification condition includes: Determining the abnormality of the device change request based on the device change associated information; Determine whether the abnormality is within a predetermined safety range, wherein: If the abnormality is within the predetermined safety range, determining that the device change associated information satisfies the safety verification condition; If the abnormality is not within the predetermined safety range, it is determined that the device change associated information does not satisfy the safety verification condition.

6. The method according to claim 5, characterized in that The determining, based on the device change associated information, the abnormality of the device change request includes: Obtaining a first historical attention level for each item of the client application information, wherein the first historical attention level represents a ratio of the number of times that a similar device of the client has anomalies in a historical management task within a single specified historical period to the total number of times that the similar device has been requested to be changed in a historical management task within the single specified historical period; Taking the first historical attention degree as a first weight, weighted summing all the client application information is performed to obtain a first sub-abnormality degree; Obtaining a second historical attention level for each item of the background management parameter information, wherein the second historical attention level represents a ratio of the number of times that anomalies occurred in the same department device of the client in a historical management task within a single specified historical period to the total number of times that the same department device was requested to be changed in a historical management task within a single specified historical period; Taking the second historical attention degree as a second weight, weighted summing all the background management parameter information is performed to obtain a second sub-abnormality degree; Obtaining a third historical attention level for each item of the real-time security information of the device, wherein the third historical attention level represents a ratio of the number of times the security monitoring software of the client monitors the occurrence of anomalies on the client within a single specified historical period to the total number of times the security monitoring software monitors the client within a single specified historical period; Taking the third historical attention degree as a third weight, weighted summing up all the real-time safety information of the devices to obtain a third sub-abnormality degree; A variance of the first sub-abnormality degree, the second sub-abnormality degree, and the third sub-abnormality degree is determined as the abnormality degree of the equipment change request.

7. The method according to claim 6, characterized in that Also includes: For each item of the client application information, a first distribution range of the client application information is obtained, wherein the first distribution range represents the distribution of the first historical attentions corresponding to the client application information in the plurality of the specified historical time periods; For each item of the background management parameter information, a second distribution range of the background management parameter information is obtained, wherein the second distribution range represents the distribution of the second historical attentions corresponding to the background management parameter information in the plurality of designated historical time periods; For each item of the real-time safety information of the device, a third distribution range of the real-time safety information of the device is obtained, wherein the third distribution range represents the distribution of the third historical attention levels respectively corresponding to the real-time safety information of the device in the plurality of the specified historical time periods; Based on the first distribution range corresponding to each item of the client application information, the second distribution range corresponding to each item of the background management parameter information, and the third distribution range corresponding to each item of the device real-time security information, the minimum value of the historical change risk performance parameter of the client is determined by a particle swarm algorithm, wherein: ， For each of the equipment changes, the total number of associated information changes for the device, Indicates The weight of the device change related information described in the item, Indicates the time t The particle in The performance value of the device change related information described in the item, express Moment The particle in The update speed of the device change related information described in the item, is the minimum value of the historical risk performance parameter, indicating that a set of values ​​of all the device change associated information is searched in the first distribution range corresponding to each item of the client application information, the second distribution range corresponding to each item of the background management parameter information, and the third distribution range corresponding to each item of the device real-time security information so that The output value of is the smallest; Determining a minimum value of the historical change risk performance parameter and a mean value of the abnormality of the equipment change request; The mean value is replaced by the abnormality of the equipment change request.

8. A device for dynamic management of equipment information, characterized in that: include: A device change request acquisition unit, used to acquire a device change request from a client; a device change associated information determining unit, configured to determine the device change associated information of the client based on the device change request; A security verification condition detection unit, used to detect whether the device change associated information meets the security verification condition; The management execution unit is configured to approve the device change request if the device change associated information satisfies the security verification condition, and reject the device change request otherwise.

9. An industrial control device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are configured to enable the processor to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are configured to execute the method according to any one of claims 1 to 7.

Images