Industrial internet security control method facing complex attack

Abstract

The invention discloses a complex attack-oriented industrial internet security control method, relates to the field of industrial internet, and is used for solving the problem that a current industrial internet security protection system cannot achieve effective defense and targeted defense and cannot achieve dynamic regulation and control of self defense. Analyzing the network access risk condition of the production link accessed to the industrial internet, and analyzing to obtain the risk equipment rate of the production link; s2, analyzing a historical intrusion condition of a production link accessed to the industrial internet, and analyzing to obtain a risk influence value of the production link; s3, setting a corresponding safety control strategy for the production link accessed to the industrial internet based on the risk equipment rate and the risk influence value; and S4, dynamically updating the security control strategy of the production link accessed to the industrial internet according to the attack situation. According to the method and the system, the targeted defense and the dynamic defense of the industrial internet are realized in the face of complex attacks.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial Internet, and specifically relates to a security control method for industrial Internet facing complex attacks. Background Art

[0002] At present, the industrial Internet has entered a new stage of large-scale development. Its infrastructure construction has been continuously strengthened, the technological innovation ability has been steadily enhanced, the industrial scale has continued to grow, and the driving role has become increasingly prominent. However, with the rapid development of the industrial Internet, security issues have become increasingly prominent. Traditional security defense means are often ineffective in the face of new and complex attacks, and the security of the industrial Internet faces severe challenges.

[0003] In the prior art, in the face of complex attacks of unknown software vulnerabilities and new malware, although the industrial Internet has deployed a variety of security protection systems such as firewalls, intrusion detection systems, and anti-virus gateways, due to the setting of a unified security control method for numerous production links accessing the industrial Internet, traditional security control methods cannot effectively defend and target defend against complex attacks. At the same time, traditional security control methods also cannot dynamically adjust their own defenses;

[0004] Therefore, the present invention proposes a security control method for industrial Internet facing complex attacks. Summary of the Invention

[0005] The purpose of the present invention is: aiming at the deficiencies existing in the prior art, the purpose of the present invention is to provide a security control method for industrial Internet facing complex attacks.

[0006] The technical problem to be solved by the present invention is:

[0007] How to achieve targeted defense and dynamic defense of the industrial Internet in the face of complex attacks.

[0008] In order to achieve the above purpose, the present invention adopts the following technical solutions:

[0009] A security control method for industrial Internet facing complex attacks, the method includes:

[0010] Step S1, analyze the network access risk situation of the production links accessing the industrial Internet, and obtain the risk equipment rate of the production links;

[0011] Step S2, analyze the historical intrusion situation of the production links accessing the industrial Internet, and obtain the risk impact value of the production links;

[0012] Step S3, set corresponding security control strategies for the production links accessing the industrial Internet based on the risk equipment rate and the risk impact value;

[0013] Step S4: Dynamically update the security control strategy for the production links accessing the industrial Internet according to the attack situation.

[0014] Furthermore, step S1 includes the following sub-steps:

[0015] Step S11: Obtain the production equipment data corresponding to the production links accessing the industrial Internet, and obtain the number of networked devices in the production links, as well as the commissioning time, repair times, and security protection levels of each networked device.

[0016] The production equipment data is the number of networked devices in the production links accessing the industrial Internet, as well as the commissioning time, repair times, and security protection levels of each networked device. The security protection levels include the first security protection level, the second security protection level, and the third security protection level. The protection effect of the first security protection level is higher than that of the second security protection level, and the protection effect of the second security protection level is higher than that of the third security protection level.

[0017] Step S12: Calculate the risk device rate of the production links based on the production equipment data.

[0018] Furthermore, the calculation process of the risk device rate includes:

[0019] Step S121: Subtract the commissioning time from the current time to obtain the usage duration STiu of each networked device in the production links, where i is the number of the production links and u is the number of the networked device.

[0020] Step S122: Mark the repair times of each networked device in the production links as WCiu, and obtain the security protection coefficient FXiu of each networked device in the production links according to the security protection level; among them, the security protection level is proportional to the security protection coefficient.

[0021] Step S123: Calculate the network connection risk value Fiu of each networked device in the production links through the formula. The specific formula is as follows:

[0022] Fiu = (STiu / ST + WCiu / WC) / (FXiu / FX); in the formula, ST is the standard value corresponding to the usage duration, WC is the standard value corresponding to the repair times, and FX is the standard value corresponding to the security protection coefficient.

[0023] Step S124: Compare the network connection risk value with the network connection risk threshold. If the network connection risk value is greater than or equal to the network connection risk threshold, mark the corresponding networked device as a risk networked device. If the network connection risk value is less than the network connection risk threshold, do not perform any operation.

[0024] Step S125: Count the number of risk networked devices and record it as the number of risk networked devices.

[0025] Step S126: Obtain the number of networked devices in the production link. The ratio of the number of risky networked devices to the number of networked devices gives the risk device rate in the production link.

[0026] Further, step S2 includes the following sub-steps:

[0027] Step S21: Obtain the network intrusion data corresponding to the production link accessing the industrial Internet.

[0028] The network intrusion data is the number of network intrusions in the production link accessing the industrial Internet, the number of device paralyzes and the device paralysis duration of the networked devices in the production link during each network intrusion, and the production delay progress in the production link during each network intrusion.

[0029] Step S22: Mark the number of network intrusions in the production link accessing the industrial Internet as RQi.

[0030] Step S23: Mark the number of device paralyzes of the networked devices in the production link during each network intrusion as THi, and mark the device paralysis duration of the networked devices in the production link during each network intrusion as TTi.

[0031] Step S24: Then mark the production delay progress in the production link during each network intrusion as DWi.

[0032] Step S25: Calculate the risk impact value FYi of the networked devices accessing the industrial Internet through the formula. The specific formula is as follows:

[0033] FYi = [(RQi / RQ) × a1 + (THi / TH) × a2 + (TTi / TT) × a3 + ] × DWi;

[0034] In the above formula, RQ is the standard value of the number of network intrusions, TH is the standard value of the number of device paralyzes, TT is the standard value of the device paralysis duration, and a1, a2, and a3 are proportionality coefficients.

[0035] Further, when the number of products with production stagnation is [X1, X2], the production delay progress is S1;

[0036] When the number of products with production stagnation is (X2, X3], the production delay progress is S2;

[0037] When the number of products with production stagnation is (X3, X4], the production delay progress is S3;

[0038] When the number of products with production stagnation is (X4, ∞), the production delay progress is S4; where X1, X2, X3, and X4 are all positive integers, 0 < X1 < X2 < X3 < X4, and 0 < S1 < S2 < S3 < S4.

[0039] Further, the step S3 includes the following sub-steps:

[0040] Step S31, obtaining the risk equipment rate FLi and the risk impact value FYi of the production link;

[0041] Step S32, calculating the risk value Fi of the production link accessing the industrial Internet through the formula Fi = FLi × FYi;

[0042] Step S33, if the risk value is less than or equal to the first risk threshold, the third security control strategy is executed for the production link accessing the industrial Internet;

[0043] If the risk value is greater than the first risk threshold and less than or equal to the second risk threshold, the second security control strategy is executed for the production link accessing the industrial Internet;

[0044] If the risk value is greater than the second risk threshold, the first security control strategy is executed for the production link accessing the industrial Internet; wherein, the second risk threshold is greater than the first risk threshold.

[0045] Further, the security strength of the first security control strategy is higher than that of the second security control strategy, and the security strength of the second security control strategy is higher than that of the third security control strategy.

[0046] Further, the step S4 includes the following sub-steps:

[0047] Step S41, setting a virtual folder for the network access devices of the production link accessing the industrial Internet, and a specified number of multiple groups of test files are built in the virtual folder;

[0048] Step S42, when it is detected that the industrial Internet is facing a network attack, performing integrity verification and file attribute check on the test files in the virtual folder;

[0049] Step S43, if both the integrity verification and the file attribute check of the test files pass, the test files are recorded as original files, and if any one of the integrity verification or the file attribute check of the test files fails, the test files are recorded as tampered files;

[0050] Step S44, counting the number of tampered files and recording it as the number of tampered files, comparing the number of tampered files with the total number of test files, and obtaining the tampering rate of the test files in the virtual folders corresponding to different production links.

[0051] Further, the step S4 also includes the following sub-steps:

[0052] Step S45, obtaining the preset tampering rate corresponding to the production link according to the executed security control strategy, specifically:

[0053] If it is the third security control policy, the preset tampering rate is Y3;

[0054] If it is the second security control policy, the preset tampering rate is Y2;

[0055] If it is the first security control policy, the preset tampering rate is Y1; where Y1 < Y2 < Y3;

[0056] Step S46: Compare the tampering rate of the test file in the virtual folder with the corresponding preset tampering rate in the production link;

[0057] Step S47: If the tampering rate is less than or equal to the preset tampering rate, do nothing;

[0058] If the tampering rate is greater than the preset tampering rate, upgrade the corresponding security control policy set in the production link.

[0059] Furthermore, the verification process of the integrity check is as follows:

[0060] Calculate and save the hash value of the test file in advance. During a cyber attack, calculate the hash value of the test file again and compare it with the previously saved hash value;

[0061] If the two calculated hash values are the same, the integrity of the test file has not been damaged;

[0062] If the two calculated hash values are different, it means that the integrity of the test file has been damaged.

[0063] In summary, due to the adoption of the above technical solutions, the beneficial effects of the present invention are as follows:

[0064] 1. The present invention analyzes the network access risk situation of the production links accessing the industrial Internet, obtains the risk device rate of the production links, and realizes the intelligent analysis of the network access risk situation of the corresponding production links accessing the industrial Internet;

[0065] 2. The present invention analyzes the historical intrusion situation of the production links accessing the industrial Internet, obtains the risk impact value of the production links, and realizes the analysis and determination of the historical intrusion situation of the corresponding production links accessing the industrial Internet;

[0066] 3. The present invention combines the risk device rate and the risk impact value to set corresponding security control policies for the production links accessing the industrial Internet, and realizes targeted defense against the industrial Internet in the face of complex attacks;

[0067] 4. When facing complex attacks, the present invention dynamically updates the security control policies of the production links accessing the industrial Internet according to the attack situation, can dynamically adjust the corresponding defense system of the industrial Internet, and realizes dynamic defense. Brief Description of the Drawings

[0068] Figure 1 is the flowchart of the steps of the present invention;

[0069] Figure 2 is the flowchart of the sub-steps corresponding to step S1 in the present invention;

[0070] Figure 3 is the flowchart of the sub-steps corresponding to step S2 in the present invention;

[0071] Figure 4 is the flowchart of the sub-steps corresponding to step S3 in the present invention;

[0072] Figure 5 is the flowchart of the sub-steps corresponding to step S4 in the present invention;

[0073] Figure 6 is the flowchart of the sub-steps corresponding to step S6 in the present invention;

[0074] Figure 7 is the structural schematic diagram of the electronic device in the present invention. Detailed Description of the Invention

[0075] Next, the technical solution of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0076] Embodiment 1: Please refer to Figures 1-6 as shown, the technical solution provided by the present invention is: an industrial Internet security control method for complex attacks, mainly used for the security control of each production link in an intelligent factory, and realizing the network connection control of industrial equipment used in each production link through the industrial Internet. The method includes:

[0077] Step S1, analyzing the network connection risk situation of the production links accessing the industrial Internet, and obtaining the risk equipment rate of the production links;

[0078] Exemplarily, the production link may be composed of product material screening, product material processing, product packaging, etc., and no specific limitation is made here;

[0079] In this embodiment, the step S1 includes the following sub-steps:

[0080] Step S11: Obtain the production equipment data corresponding to the production links accessing the industrial Internet, and obtain the number of networked devices in the production links, as well as the commissioning time, number of repairs, and safety protection level of each networked device.

[0081] Specifically, the production equipment data is the number of networked devices in the production links accessing the industrial Internet, as well as the commissioning time, number of repairs, and safety protection level of each networked device. Among them, the safety protection level is obtained from the nameplate on the production equipment. The safety protection level includes the first safety protection level, the second safety protection level, and the third safety protection level. The protection effect of the first safety protection level is higher than that of the second safety protection level, and the protection effect of the second safety protection level is higher than that of the third safety protection level.

[0082] Step S12: Calculate the risk equipment rate of the production links based on the production equipment data. The calculation process of the risk equipment rate is as follows:

[0083] Step S121: Use the current time minus the commissioning time to obtain the usage duration STiu of each networked device in the production links, where i is the number of the production link and u is the number of the networked device.

[0084] Step S122: Mark the number of repairs of each networked device in the production links as WCiu, and obtain the safety protection coefficient FXiu of each networked device in the production links according to the safety protection level. Among them, the safety protection level is directly proportional to the safety protection coefficient, that is, the better the protection effect of the safety protection level, the larger the value of the safety protection coefficient. Exemplarily, the safety protection coefficient corresponding to the first safety protection level is 1.3, the safety protection coefficient corresponding to the second safety protection level is 1.2, and the safety protection coefficient corresponding to the third safety protection level is 1.1.

[0085] Step S123: Calculate the network access risk value Fiu of each networked device in the production links through the formula. The formula is as follows:

[0086] Fiu = (STiu / ST + WCiu / WC) / (FXiu / FX); in the formula, ST is the standard value corresponding to the usage duration, WC is the standard value corresponding to the number of repairs, and FX is the standard value corresponding to the safety protection coefficient. Among them, the existence of the standard value is to remove the units of each parameter.

[0087] Step S124: Compare the network access risk value with the network access risk threshold. If the network access risk value is greater than or equal to the network access risk threshold, mark the corresponding networked device as a risk networked device. If the network access risk value is less than the network access risk threshold, do not perform any operation.

[0088] Step S125: Count the number of risk networked devices and record it as the number of risk networked devices.

[0089] Step S126, obtain the number of networked devices in the production link, and compare the number of risk networked devices with the number of networked devices to obtain the risk device rate in the production link.

[0090] Step S2, analyze the historical intrusion situation of the production link accessing the industrial Internet, and analyze to obtain the risk impact value of the production link;

[0091] In this embodiment, the step S2 includes the following sub-steps:

[0092] Step S21, obtain the network intrusion data corresponding to the production link accessing the industrial Internet;

[0093] It should be specifically noted that the network intrusion data is the number of network intrusions in the production link accessing the industrial Internet, as well as the number of device paralyzes and the device paralysis duration of the networked devices in the production link during each network intrusion, and the production delay progress in the production link during each network intrusion. Among them, the device paralysis duration is the maximum duration when the networked device is paralyzed, and the production delay progress is obtained by converting the number of products whose production is stagnated due to the networked device being paralyzed during the network intrusion;

[0094] Specifically, when the number of products with stagnant production is [X1, X2], the production delay progress is S1;

[0095] When the number of products with stagnant production is (X2, X3], the production delay progress is S2;

[0096] When the number of products with stagnant production is (X3, X4], the production delay progress is S3;

[0097] When the number of products with stagnant production is (X4, ∞), the production delay progress is S4; where X1, X2, X3, and X4 are all positive integers, 0 < X1 < X2 < X3 < X4, 0 < S1 < S2 < S3 < S4;

[0098] Step S22, mark the number of network intrusions in the production link accessing the industrial Internet as RQi;

[0099] Step S23, mark the number of device paralyzes of the networked devices in the production link during each network intrusion as THi, and mark the device paralysis duration of the networked devices in the production link during each network intrusion as TTi;

[0100] Step S24, then mark the production delay progress in the production link during each network intrusion as DWi;

[0101] Step S25, calculate the risk impact value FYi of the networked devices accessing the industrial Internet through the formula. The specific formula is as follows:

[0102] FYi = [(RQi / RQ) × a1 + (THi / TH) × a2 + (TTi / TT) × a3 + ] × DWi;

[0103] In the above formula, RQ is the standard value of the number of network intrusions, TH is the standard value of the number of device paralyzes, TT is the standard value of the duration of device paralysis, and a1, a2, and a3 are proportionality coefficients.

[0104] Step S3, set corresponding security control strategies for the production links accessing the industrial Internet based on the risk device rate and the risk impact value;

[0105] In this embodiment, the step S3 includes the following sub-steps:

[0106] Step S31, obtain the risk device rate FLi and the risk impact value FYi of the production link calculated above;

[0107] Step S32, calculate the risk value Fi of the production link accessing the industrial Internet through the formula Fi = FLi × FYi;

[0108] Step S33, compare the risk value with the risk threshold, and determine to execute the corresponding security control strategy for the production link accessing the industrial Internet. Specifically:

[0109] If the risk value is less than or equal to the first risk threshold, the third security control strategy is executed for the production link accessing the industrial Internet;

[0110] If the risk value is greater than the first risk threshold and less than or equal to the second risk threshold, the second security control strategy is executed for the production link accessing the industrial Internet;

[0111] If the risk value is greater than the second risk threshold, the first security control strategy is executed for the production link accessing the industrial Internet; where the second risk threshold is greater than the first risk threshold, the security strength of the first security control strategy is higher than that of the second security control strategy, and the security strength of the second security control strategy is higher than that of the third security control strategy;

[0112] In this embodiment, by way of example, the security control strategy refers to a multi-level defense system for the production link. The defense system of the first security control strategy includes network layer security protection, system layer security protection, and data layer security protection. The defense system of the second security control strategy includes system layer security protection and data layer security protection. The defense system of the third security control strategy includes data layer security protection;

[0113] Among them, network layer security protection adopts advanced network security technologies, such as industrial firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc., to monitor and filter network traffic in real time and prevent the intrusion of malicious traffic; system layer security protection is to strengthen the security of operating systems, databases, application software, etc. in the industrial Internet system to prevent vulnerabilities from being exploited. At the same time, security auditing and log analysis technologies are adopted to record and analyze system operations and detect abnormal behaviors in a timely manner; data layer security protection adopts technologies such as data encryption, data backup, and data recovery to ensure the confidentiality, integrity, and availability of data. At the same time, a data access control mechanism is established to strictly control the access rights to data.

[0114] Step S4: Dynamically update the security control strategy of the production links accessing the industrial Internet according to the attack situation;

[0115] In this embodiment, the step S4 includes the following sub-steps:

[0116] Step S41: Set a virtual folder for the networked devices in the production links accessing the industrial Internet. The virtual folder contains a specified number of multiple groups of test files; among them, no security control strategy is set for the virtual folder and the test files;

[0117] Step S42: When it is detected that the industrial Internet is facing a network attack, perform integrity verification and file attribute check on the test files in the virtual folder;

[0118] In specific implementation, integrity verification can be achieved through methods such as hash value verification, check code verification, digital signature verification, etc. In this embodiment, it is preferably to determine whether the test file has been tampered with by means of hash value verification; file attribute check can be achieved through methods such as file size change, file name garbled code, content garbled code, etc.;

[0119] Among them, hash value verification is: calculate and save the hash value of the test file in advance. When a network attack occurs, calculate the hash value of the test file again and compare it with the previously saved hash value. If the results of the two calculations are the same, it means that the integrity of the test file has not been damaged. If they are different, it means that the integrity of the test file has been damaged;

[0120] Step S43: If both the integrity verification and file attribute check of the test file pass, record the test file as an original file. If any one of the integrity verification or file attribute check of the test file fails, record the test file as a tampered file;

[0121] Step S44: Count the number of tampered files and record it as the number of tampered files. Compare the number of tampered files with the total number of test files to obtain the tampering rate of the test files in the virtual folders corresponding to different production links;

[0122] Step S45, obtain the preset tampering rate corresponding to the production link according to the executed security control policy, specifically:

[0123] If it is the third security control policy, the preset tampering rate is Y3;

[0124] If it is the second security control policy, the preset tampering rate is Y2;

[0125] If it is the first security control policy, the preset tampering rate is Y1; where Y1 < Y2 < Y3;

[0126] Step S46, compare the tampering rate of the test files in the virtual folder with the preset tampering rate corresponding to the production link;

[0127] Step S47, if the tampering rate is less than or equal to the preset tampering rate, do nothing;

[0128] If the tampering rate is greater than the preset tampering rate, upgrade the corresponding security control policy of the production link;

[0129] In this embodiment, upgrading means that when the tampering rate is greater than the preset tampering rate, if the security control policy of this production link is the second security control policy, then dynamically update the security control policy of this production link to the first security control policy. When the tampering rate is greater than the preset tampering rate, if the security control policy of this production link is the first security control policy, then add the defense system in the corresponding security control policy of this production link on the basis of the first security control policy.

[0130] As a further solution of this embodiment, when the tampering rate is greater than the preset tampering rate, monitor each networked device in the production link accessing the industrial Internet. The industrial Internet security control method further includes:

[0131] Step S5, obtain the real-time device data of the networked devices in the production link accessing the industrial Internet;

[0132] Among them, the real-time device data is the real-time download network speed and real-time upload network speed of the networked devices at different time points;

[0133] Step S6, perform security monitoring on the networked devices in the production link accessing the industrial Internet according to the real-time device data;

[0134] In this embodiment, step S6 includes the following sub-steps:

[0135] Step S61, set the monitoring duration of the networked devices and set multiple time points within the monitoring duration;

[0136] Step S62: Obtain the real-time download speed and real-time upload speed of the networked devices at different time points;

[0137] Step S63: Calculate the difference between the real-time download speeds at adjacent time points and take the absolute value to obtain the download speed fluctuation value. Similarly, calculate the difference between the real-time upload speeds at adjacent time points and take the absolute value to obtain the upload speed fluctuation value;

[0138] Step S64: If the download speed fluctuation value between any adjacent time points is greater than the download speed fluctuation threshold or the upload speed fluctuation value between any adjacent time points is greater than the upload speed fluctuation threshold, generate a device anomaly signal;

[0139] Step S65: If the download speed fluctuation values between all adjacent time points are less than or equal to the download speed fluctuation threshold, and the upload speed fluctuation values between all adjacent time points are less than or equal to the upload speed fluctuation threshold, generate a device normal signal;

[0140] Actually, when generating a device anomaly signal, the corresponding networked device is shut down, and the networked device is disconnected from the industrial Internet.

[0141] In this application, if there are corresponding calculation formulas, the above calculation formulas are all calculated by taking the numerical values without dimensions. For the coefficients such as weight coefficients and proportionality coefficients in the formulas, the sizes set are for obtaining a result value by quantifying each parameter. Regarding the sizes of the weight coefficients and proportionality coefficients, as long as the proportional relationship between the parameters and the result value is not affected.

[0142] Example 2: As Figure 7 shown, this embodiment provides an electronic device, which may include: a processor, a communication interface, a memory, and a system bus. Among them, the processor, the communication interface, and the memory communicate with each other through the system bus. The processor can call the logical instructions in the memory to execute an industrial Internet security control method for complex attacks, and the method includes: analyzing the network connection risk situation of the production links accessing the industrial Internet to obtain the risk device rate of the production links; analyzing the historical intrusion situation of the production links accessing the industrial Internet to obtain the risk impact value of the production links; setting corresponding security control strategies for the production links accessing the industrial Internet based on the risk device rate and the risk impact value; dynamically updating the security control strategies of the production links accessing the industrial Internet according to the attack situation; obtaining the real-time device data of the networked devices in the production links accessing the industrial Internet; and performing security monitoring on the networked devices in the production links accessing the industrial Internet based on the real-time device data.

[0143] In addition, when the logical instructions in the above-mentioned memory are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0144] Embodiment 3: This application also provides a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute an industrial Internet security control method for complex attacks provided by the above-mentioned various methods. The method includes: analyzing the network connection risk situation of the production links accessing the industrial Internet to obtain the risk device rate of the production links; analyzing the historical intrusion situation of the production links accessing the industrial Internet to obtain the risk impact value of the production links; setting corresponding security control policies for the production links accessing the industrial Internet based on the risk device rate and the risk impact value; dynamically updating the security control policies of the production links accessing the industrial Internet according to the attack situation; obtaining the real-time device data of the networked devices in the production links accessing the industrial Internet; and performing security monitoring on the networked devices in the production links accessing the industrial Internet based on the real-time device data.

[0145] Embodiment 4: This application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute an industrial Internet security control method for complex attacks provided by the above-mentioned various methods. The method includes: analyzing the network connection risk situation of the production links accessing the industrial Internet to obtain the risk device rate of the production links; analyzing the historical intrusion situation of the production links accessing the industrial Internet to obtain the risk impact value of the production links; setting corresponding security control policies for the production links accessing the industrial Internet based on the risk device rate and the risk impact value; dynamically updating the security control policies of the production links accessing the industrial Internet according to the attack situation; obtaining the real-time device data of the networked devices in the production links accessing the industrial Internet; and performing security monitoring on the networked devices in the production links accessing the industrial Internet based on the real-time device data.

[0146] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0147] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0148] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An industrial Internet security control method for complex attacks, characterized in that The specific steps are as follows: Step S1: Analyze the network connection risk situation of the production links connected to the industrial Internet, and obtain the risk equipment rate of the production links through the analysis; Step S2: Analyze the historical intrusion situation of the production links connected to the industrial Internet, and obtain the risk impact value of the production links through the analysis; Step S3: Set corresponding security control strategies for the production links connected to the industrial Internet based on the risk equipment rate and the risk impact value; Step S4: Dynamically update the security control strategies of the production links connected to the industrial Internet according to the attack situation.

2. The industrial Internet security control method for complex attacks according to claim 1, wherein Step S1 includes the following sub-steps: Step S11: Obtain the production equipment data corresponding to the production links connected to the industrial Internet, and obtain the number of networked devices in the production links, as well as the commissioning time, repair times, and security protection level of each networked device; The production equipment data is the number of networked devices in the production links connected to the industrial Internet, as well as the commissioning time, repair times, and security protection level of each networked device. The security protection level includes the first security protection level, the second security protection level, and the third security protection level. The protection effect of the first security protection level is higher than that of the second security protection level, and the protection effect of the second security protection level is higher than that of the third security protection level; Step S12: Calculate the risk equipment rate of the production links based on the production equipment data.

3. The industrial Internet security control method for complex attacks according to claim 2, characterized in that, The calculation process of the risk equipment rate includes: Step S121: Use the current time minus the commissioning time to obtain the usage duration STiu of each networked device in the production links, where i is the number of the production links and u is the number of the networked device; Step S122: Mark the repair times of each networked device in the production links as WCiu, and obtain the security protection coefficient FXiu of each networked device in the production links according to the security protection level; among them, the security protection level is proportional to the security protection coefficient; Step S123: Calculate the network connection risk value Fiu of each networked device in the production links through the formula. The specific formula is as follows: Fiu = (STiu / ST + WCiu / WC) / (FXiu / FX); in the formula, ST is the standard value corresponding to the usage duration, WC is the standard value corresponding to the repair times, and FX is the standard value corresponding to the security protection coefficient; Step S124: Compare the network connection risk value with the network connection risk threshold. If the network connection risk value is greater than or equal to the network connection risk threshold, mark the corresponding networked device as a risk networked device. If the network connection risk value is less than the network connection risk threshold, do not perform any operation; Step S125: Count the number of risk networked devices and record it as the number of risk networked devices; Step S126: Obtain the number of networked devices in the production links, and compare the number of risk networked devices with the number of networked devices to obtain the risk equipment rate of the production links.

4. An industrial Internet security control method for complex attacks according to claim 3, characterized in that Step S2 includes the following sub-steps: Step S21: Obtain the network intrusion data corresponding to the production links connected to the industrial Internet; The network intrusion data is the number of network intrusions in the production links connected to the industrial Internet, as well as the number of device paralyzes and the device paralysis duration of the networked devices in the production links during each network intrusion, and the production delay progress of the production links during each network intrusion; Step S22: Mark the number of network intrusions in the production link connected to the industrial Internet as RQi; Step S23: Mark the number of device paralyzes of the networked devices in the production link during each network intrusion as THi, and mark the duration of device paralysis of the networked devices in the production link during each network intrusion as TTi; Step S24: Then mark the production delay progress of the production link during each network intrusion as DWi; Step S25: Calculate the risk impact value FYi of the networked devices connected to the industrial Internet through the formula. The specific formula is as follows: FYi = [(RQi / RQ) × a1 + (THi / TH) × a2 + (TTi / TT) × a3 + ] × DWi; In the formula, RQ is the standard value of the number of network intrusions, TH is the standard value of the number of device paralyzes, TT is the standard value of the device paralysis duration, and a1, a2, and a3 are proportionality coefficients.

5. The industrial Internet security control method for complex attacks according to claim 4, characterized in that, When the number of products with production stagnation is [X1, X2], the production delay progress is S1; When the number of products with production stagnation is (X2, X3], the production delay progress is S2; When the number of products with production stagnation is (X3, X4], the production delay progress is S3; When the number of products with production stagnation is (X4, ∞), the production delay progress is S4; where X1, X2, X3, and X4 are all positive integers, 0 < X1 < X2 < X3 < X4, and 0 < S1 < S2 < S3 < S4.

6. The industrial Internet security control method for complex attacks according to claim 5, characterized in that, Step S3 includes the following sub-steps: Step S31: Obtain the risk device rate FLi and the risk impact value FYi of the production link; Step S32: Calculate the risk value Fi of the production link connected to the industrial Internet through the formula Fi = FLi × FYi; Step S33: If the risk value is less than or equal to the first risk threshold, the production link connected to the industrial Internet executes the third security control strategy; If the risk value is greater than the first risk threshold and less than or equal to the second risk threshold, the production link connected to the industrial Internet executes the second security control strategy; If the risk value is greater than the second risk threshold, the production link connected to the industrial Internet executes the first security control strategy; where the second risk threshold is greater than the first risk threshold.

7. An industrial Internet security control method for complex attacks according to claim 6, characterized in that, The security strength of the first security control strategy is higher than that of the second security control strategy, and the security strength of the second security control strategy is higher than that of the third security control strategy.

8. An industrial Internet security control method for complex attacks according to claim 6, characterized in that, Step S4 includes the following sub-steps: Step S41: Set a virtual folder for the networked devices in the production link connected to the industrial Internet. The virtual folder contains a specified number of multiple groups of test files; Step S42: When it is detected that the industrial Internet is facing a network attack, perform integrity verification and file attribute check on the test files in the virtual folder; Step S43: If both the integrity verification and the file attribute check of the test files pass, mark the test files as original files. If any one of the integrity verification or the file attribute check of the test files fails, mark the test files as tampered files; Step S44: Count the number of tampered files and record it as the number of tampered files. Compare the number of tampered files with the total number of test files to obtain the tampering rate of the test files in the virtual folder corresponding to different production links.

9. The industrial Internet security control method for complex attacks according to claim 8, characterized in that, Step S4 also includes the following sub-steps: Step S45: Obtain the preset tampering rate corresponding to the production link according to the executed security control policy. Specifically: If it is the third security control policy, the preset tampering rate is Y3; If it is the second security control policy, the preset tampering rate is Y2; If it is the first security control policy, the preset tampering rate is Y1; where Y1 < Y2 < Y3; Step S46: Compare the tampering rate of the test files in the virtual folder with the preset tampering rate corresponding to the production link. Step S47: If the tampering rate is less than or equal to the preset tampering rate, do nothing. If the tampering rate is greater than the preset tampering rate, upgrade the corresponding security control policy set for the production link.

10. An industrial Internet security control method for complex attacks according to claim 8, characterized in that, The verification process of integrity check is as follows: Calculate and save the hash value of the test file in advance. When a cyber attack occurs, calculate the hash value of the test file again and compare it with the previously saved hash value. If the two calculated hash values are the same, the integrity of the test file has not been damaged. If the two calculated hash values are different, it means that the integrity of the test file has been damaged.

Images