Industrial computer data security dynamic protection method and system based on AI edge calculation

Abstract

The application belongs to the cross field of industrial control and edge computing, and particularly relates to an industrial computer data security dynamic protection method and system based on AI edge computing. The scheme constructs a three-level coordinated industrial control system dynamic protection architecture of "edge-fog-cloud". Firstly, the hardware level trusted execution environment is used to realize industrial data encryption and standardized preprocessing. Secondly, the AI model is used to realize real-time anomaly detection of encrypted data flow, and threat scores are generated by combining industrial protocol feature analysis, forming an edge layer intelligent detection capability. Then, the threat score is used to dynamically switch the authentication mode, and adaptive strategy adjustment is realized in the fog layer. Subsequently, the edge resource allocation is optimized according to the threat index and device load, and a cloud elastic scheduling mechanism is constructed. Finally, through the cooperation of hierarchical components, a security system covering data encryption, real-time detection, dynamic protection and resource optimization is formed, which is suitable for real-time threat detection and adaptive response in the industrial internet scene.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of industrial control and edge computing, specifically relating to a dynamic protection method and system for industrial control computer data security based on AI edge computing. Background Technology

[0002] Industrial control systems are facing increasingly complex security threats, and traditional protection technologies have shown significant limitations. In edge computing security authentication, while existing technologies have proposed multi-layered dynamic authentication strategies that match different security levels based on instruction types, their core reliance on static rule bases for decision-making makes them ineffective in identifying and responding to new and unknown attack patterns such as zero-day vulnerabilities and advanced persistent threats (APTs). Furthermore, these solutions do not fully consider the stringent real-time requirements of industrial control scenarios, with authentication delays often exceeding the tolerance threshold of industrial control systems. In threat assessment and resource allocation, while existing methods have introduced dynamic priority adjustment mechanisms based on real-time threat indices and resource constraints, their threat assessment models lack self-learning capabilities, relying on manual presets for key parameters, making them ill-suited to the complex environments of heterogeneous industrial equipment, diverse protocols, and fluctuating operating conditions. Regarding intrusion detection technology, although some methods detect intrusion behavior using traditional methods such as signal energy analysis, they fail to integrate advanced AI algorithms such as deep learning, resulting in insufficient accuracy in detecting highly concealed and rapidly evolving industrial control-specific attacks.

[0003] In-depth analysis reveals the following key problems in existing industrial control system security: First, defense strategies are static and rigid, with authentication rules and detection feature libraries lagging behind updates, failing to adapt to emerging threats in real time. Second, resource allocation mechanisms lack flexibility; in high-concurrency industrial control scenarios, insufficient resources may lead to delayed critical alarms, while excessive resource allocation may result in energy waste. Third, security decisions lack context awareness, failing to comprehensively assess the unique operating states of industrial control systems, such as PLC instruction cycles and sensor data stream timing characteristics, leading to persistently high false alarm rates. Fourth, edge-side intelligence is low; most solutions still rely on traditional rule engines or shallow machine learning algorithms, making it difficult to deeply mine complex features such as industrial control protocol loads and inter-device interaction behaviors. These deficiencies are particularly prominent in the context of deep integration with the Industrial Internet.

[0004] All of the above patents suffer from the problems raised in this background technology. In order to solve the problems raised in this background technology, this application designs a dynamic protection method and system for industrial control computer data security based on AI edge computing. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention proposes a dynamic protection method and system for industrial control computer data security based on AI edge computing.

[0006] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a dynamic data security protection method for industrial control computers based on AI edge computing, which includes the following specific steps:

[0007] S1. Trusted Data Encryption and Preprocessing: The original industrial control commands and sensor data are encrypted through a hardware-level trusted execution environment, and the original data is preprocessed to form a standardized encrypted data stream.

[0008] S2. Intelligent Anomaly Detection and Protocol Analysis: Based on an AI model, abnormal data packets in the standardized encrypted data stream are detected in real time. Combined with the characteristics of industrial control protocols, context verification is performed, and threat scores are generated in real time.

[0009] S3. Dynamic Security Policy Adjustment: Automatically switches authentication modes and executes dynamic security adjustment policies based on threat score levels;

[0010] S4. Elastic Resource Allocation and Optimization: Dynamically allocate edge computing resources based on real-time threat index and device load;

[0011] S5. Based on the above, dynamic protection of industrial control computer data security is achieved through a four-step closed loop of encryption-detection-adjustment-optimization.

[0012] Preferably, the method for encrypting the original industrial control commands and sensor data through a hardware-level trusted execution environment is as follows:

[0013] A chip-level secure isolation zone is constructed based on national cryptographic algorithms. PUF physical fingerprints are used to bind device identities. Keys are dynamically generated using quantum random numbers to encrypt industrial control commands and to verify and protect sensor data. Finally, blockchain evidence storage and anti-side channeling are integrated into the design.

[0014] Preferably, the specific implementation method for preprocessing the original data to form a standardized encrypted data stream is as follows:

[0015] Data standardization is achieved through a multi-level protocol parsing engine and a time-series feature alignment algorithm, and working condition context labels generated by digital twins are embedded.

[0016] Preferably, the method for real-time detection of abnormal data packets in standardized encrypted data streams based on AI models, combined with context verification using industrial control protocol characteristics, is as follows:

[0017] Quantum key decryption is completed in a TEE secure environment, preserving timestamps and PUF hardware fingerprints. Subsequently, multi-dimensional feature fusion is performed through a spatiotemporal parallel analysis architecture, combined with the operating context provided by digital twins, and finally, a threat score is output based on a dynamic weight model.

[0018] Preferably, the method for automatically switching authentication modes based on threat score levels is as follows:

[0019] Based on a real-time threat scoring model, the threat levels are divided into high and low. The authentication mode is automatically switched through a policy engine. Dynamic token authentication is used when the threat level is low, while quantum-enhanced key exchange and iris biometric multi-factor authentication are activated when the threat level is high.

[0020] Preferably, the specific implementation method of the dynamic security adjustment strategy is as follows:

[0021] Logs are automatically classified and stored based on real-time threat scoring. When the threat level is low, the logs are recorded in a local encrypted cache, and when the threat level is high, they are immediately written to quantum-secure cloud storage.

[0022] Preferably, the specific implementation method for dynamically allocating edge computing resources based on the real-time threat index and device load is as follows:

[0023] Dynamically allocate edge computing resources according to the formula:

[0024]

[0025] Where T priority As a threat priority, C util The current CPU utilization is represented by α and β, which are adaptive weighting factors.

[0026] The edge server collects device load data and threat scores in real time. Then, the federated learning engine dynamically adjusts the α and β coefficients, and finally the scheduler executes the allocation strategy based on the calculation results.

[0027] Secondly, the present invention provides a dynamic protection system for industrial control computer data security based on AI edge computing, which is implemented based on the above-mentioned dynamic protection method for industrial control computer data security based on AI edge computing, specifically including: a data acquisition and processing module for acquiring industrial control computer operation data through sensors;

[0028] The AI ​​detection module is used to perform multimodal fusion analysis and risk assessment on the acquired industrial control computer operation data through AI, and to build edge layer components;

[0029] The strategy control module is used to control the strategy of the industrial control computer system based on the risk assessment of the industrial control computer's operation and to build fog layer components;

[0030] The resource optimization module is used to achieve efficient allocation of computing resources in industrial control systems through dynamic algorithms and to build cloud components.

[0031] Thirdly, the present invention provides an electronic device, comprising: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0032] The processor executes the aforementioned dynamic data security protection method for industrial control computers based on AI edge computing by calling the computer program stored in the memory.

[0033] Fourthly, the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described method for dynamic protection of industrial control computer data security based on AI edge computing.

[0034] The beneficial effects of the technical solution of the present invention are:

[0035] The system achieves a breakthrough in security protection for industrial control systems through four innovative designs. First, it constructs instruction cycle models for industrial control protocols such as TCP based on a time-series feature extractor, enabling microsecond-level abnormal behavior detection. Second, it develops a multi-objective optimization algorithm that integrates threat index, equipment load, and network latency, achieving dynamic resource scheduling at the edge-fog layer and significantly improving the utilization rate of computing resources. Third, it designs a dynamic authentication decision tree based on AI threat scoring, greatly improving the protection level in high-threat scenarios. Finally, it adopts lightweight AI model compression technology to improve the overall energy efficiency ratio of the system. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of the present disclosure and are used to explain the disclosure, but do not constitute an undue limitation of the disclosure. In the drawings:

[0037] Figure 1 This is a schematic diagram of the overall framework of the dynamic protection method for industrial control computer data security based on AI edge computing of the present invention;

[0038] Figure 2 This is a schematic diagram of the overall process of the dynamic protection method for industrial control computer data security based on AI edge computing of the present invention;

[0039] Figure 3 This is a schematic diagram of the overall framework of the AI ​​edge computing-based dynamic data security protection system for industrial control computers according to the present invention. Detailed Implementation

[0040] To clearly illustrate the core content of this technical solution, the embodiments of this application are now systematically described in conjunction with the accompanying drawings. It should be particularly noted that the embodiments shown below are merely typical implementations of this application, and various optimizations and modifications may exist for their specific technical details, all of which fall within the scope of patent protection of this application.

[0041] Example 1

[0042] To address the technical problems raised in the background art, the present invention provides a preferred embodiment: as follows Figures 1-2 As shown, the dynamic protection method for industrial control computer data security based on AI edge computing includes the following specific steps:

[0043] S1. Trusted Data Encryption and Preprocessing: The original industrial control commands and sensor data are encrypted through a hardware-level trusted execution environment, and the original data is preprocessed to form a standardized encrypted data stream.

[0044] S2. Intelligent Anomaly Detection and Protocol Analysis: Based on an AI model, abnormal data packets in the standardized encrypted data stream are detected in real time. Combined with the characteristics of industrial control protocols, context verification is performed, and threat scores are generated in real time.

[0045] S3. Dynamic Security Policy Adjustment: Automatically switches authentication modes and executes dynamic security adjustment policies based on threat score levels;

[0046] S4. Elastic Resource Allocation and Optimization: Dynamically allocate edge computing resources based on real-time threat index and device load to further build cloud components;

[0047] S5. Based on the above, dynamic protection of industrial control computer data security is achieved through a four-step closed loop of encryption-detection-adjustment-optimization.

[0048] The raw industrial control commands and sensor data are encrypted using a hardware-level trusted execution environment. The specific implementation method is as follows:

[0049] The hardware-level trusted execution environment (TEE) achieves industrial control data encryption through three technologies: first, it constructs a chip-level security isolation zone based on the national cryptographic SM2 algorithm, and then uses PUF physical fingerprint binding to bind device identity;

[0050] It should be noted that: First, the unique fingerprint of the device is extracted through the PUF module of the Huawei HiSec 5.0 security chip, a 256-bit SM3 hash identity ID is generated, and an SM2 algorithm authentication channel is established to complete the two-way authentication between the PLC and the edge node;

[0051] Secondly, the key is dynamically generated using quantum random numbers to encrypt the industrial control commands in SM4-CTR mode, and the sensor data is protected with AES-256-GCM with verification.

[0052] It should be noted that: the SV-QRNG200 quantum random number chip is used to generate keys in real time, the industrial control command stream is encrypted using SM4-CTR mode, sensor data is protected by AES-256-GCM and the key is rotated every 10 minutes using the Kyber-768 algorithm; finally, combined with blockchain notarization and anti-side channel design, the specific implementation process is as follows: the SM3 hash value of the encrypted log is written into AntChain, and the electromagnetic shielding of 7nm process and dynamic voltage regulation technology (DVFS) are used to resist side channel attacks.

[0053] The specific implementation method for preprocessing the raw data is as follows:

[0054] Data standardization is achieved through a multi-level protocol parsing engine and a timing feature alignment algorithm. The protocol parsing uses a hardware-accelerated FPGA parsing module to achieve microsecond-level decomposition of TCP protocol fields. At the same time, nanosecond-level timing synchronization is achieved through the time-sensitive network gPTP protocol, and the operating condition context label generated by digital twin is embedded.

[0055] It should be noted that: First, based on the hardware parsing engine of the Xilinx Versal AI Edge FPGA chip, parallel pipeline technology is used to perform microsecond-level field decomposition of industrial control protocols such as Modbus TCP and OPC UA, achieving accurate extraction of key elements such as function codes and register addresses; second, through the IEEE 802.1AS-2025 time-sensitive networking protocol, combined with the hardware timestamp of the Huawei HI1812 chipset and the Beidou-3 time service system, cross-device nanosecond-level timing synchronization is achieved; finally, relying on the Unity Industrial digital twin platform, real-time operating parameters such as PLC operating status and equipment vibration spectrum are integrated to intelligently generate three-dimensional semantic tags containing original protocol fields, production scenario context, and security threat scores.

[0056] The specific implementation method is as follows: Anomaly data packets are detected in real time using an AI model, and contextual verification is performed using industrial control protocol characteristics.

[0057] First, quantum key decryption is completed in a TEE secure environment, preserving μs-level timestamps and PUF hardware fingerprints; then, multi-dimensional feature fusion is performed through a spatiotemporal parallel analysis architecture, combined with the operating context provided by digital twins; finally, a threat score of 0-1 is output based on a dynamic weight model.

[0058] It should be noted that: First, within the TEE secure environment, a quantum key distribution system based on the national cryptographic SM9 algorithm completes data decryption, simultaneously retaining the μs-level timestamp and PUF physical fingerprint generated by BeiDou-3 time synchronization; then, through a spatiotemporal parallel analysis architecture built with the Xilinx Versal AI Edge chip, the decrypted data stream is fused with the operating parameters provided in real time by the digital twin system, and a 3D-CNN model is used to extract spatial features and a Temporal-Transformer model is used to capture temporal patterns; finally, the data is input into a dynamic weight evaluation model, and combined with the threat intelligence database, a continuous score of 0-1 is output.

[0059] The specific implementation method for automatically switching authentication modes based on threat level is as follows:

[0060] Based on the real-time threat 0-1 continuous value scoring model, high and low level two threat levels are divided. The authentication mode is automatically triggered by the strategy engine. When the threat level is low, dynamic token authentication based on the time-synchronized OTP-2025 algorithm is used. When the threat level is high, quantum-enhanced key exchange + iris biometric multi-factor authentication is activated.

[0061] It should be noted that: First, the industrial control data stream is analyzed in real time based on a CNN-LSTM hybrid model, and a threat score is generated by combining the digital twin operating condition context. When a low-threat device with a score <0.7 is detected, OTP-2025 dynamic token authentication is activated. When a high-threat device with a score ≥0.7 is detected, quantum-enhanced multi-factor authentication is activated. That is, Huawei QKD-3000 first completes quantum-resistant key exchange, then biometric verification is performed through an iris recognition module, and finally, manual confirmation of operation permissions is required. All authentication records are uploaded to the blockchain in real time, and the scoring threshold is optimized daily through federated learning.

[0062] The specific implementation method for executing dynamic security adjustment policies is as follows:

[0063] Logs are automatically graded and stored based on a real-time threat score of 0-1. Low-threat devices with a score <0.7 are recorded in a local encrypted cache, while high-threat devices with a score ≥0.7 are immediately written to quantum-secure cloud storage. Each log is embedded with a Beidou-3 μs-level timestamp and the device's PUF fingerprint, and time synchronization between multiple nodes is achieved through the TSN network.

[0064] It should be noted that: the industrial control data stream is dynamically evaluated through a real-time threat scoring model, and a two-level storage strategy is implemented according to the threat level. For low-threat devices with a score <0.7, the logs are encrypted with SM4 and stored in the local NVMe cache. For high-threat devices with a score ≥0.7, the logs trigger the quantum security protocol, are encrypted through the "Micius" quantum channel and written to Alibaba Cloud quantum storage, and AntChain evidence is generated simultaneously. All logs are embedded with four-dimensional metadata including timestamp, PUF fingerprint, operating condition tag and SM3 feature code, and 30ns-level time synchronization is achieved through Huawei HI1812 chipset.

[0065] Edge computing resources are dynamically allocated based on real-time load and threat index. The specific implementation method is as follows:

[0066] Dynamically allocate edge computing resources according to the formula:

[0067] Where T priority As a threat priority, C util The current CPU utilization is represented by α and β, which are adaptive weighting factors.

[0068] Device load data and threat scores are collected in real time by edge servers. Then, the federated learning engine dynamically adjusts the α and β coefficients every 15 minutes. Finally, the KubeEdge 5.3 scheduler executes a hierarchical strategy based on the calculation results. Devices with a formula output value > 0.7 are allocated 80% of the CPU to AI detection tasks, while devices with a value < 0.7 release resources to industrial control application processes. Further feedback and adjustment are carried out, and the α and β coefficients are automatically updated based on network latency indicators.

[0069] It should be noted that: First, the Huawei Atlas 500 edge server collects device load data in real time and generates a threat score of 0-1 using a CNN-LSTM model. This score is then synchronized to the KubeEdge 5.3 control plane via the TSN network and appended with a BeiDou timestamp. The federated learning engine aggregates the data every 15 minutes, dynamically adjusting the α and β coefficients. KubeEdge then... Hierarchical scheduling is implemented: when the formula output value is ≥0.7, 80% of the CPU is allocated to the AI ​​detection accelerated by the FPGA; when the formula output value is <0.7, 50% of the resources are released to the industrial control process. Finally, the parameters are optimized every 30 minutes by the PID controller and stored on the blockchain.

[0070] Example 2

[0071] like Figure 3 As shown, the AI ​​edge computing-based dynamic data security protection system for industrial control computers is implemented based on the aforementioned AI edge computing-based dynamic data security protection method for industrial control computers, specifically including:

[0072] The data acquisition and processing module is used to acquire industrial computer operating data through sensors;

[0073] The AI ​​detection module is used to perform multimodal fusion analysis and risk assessment on the acquired industrial control computer operating data through AI, and to build edge layer components:

[0074] By embedding an AI security chip in the industrial control computer to build the hardware core, the device data is collected in real time through a multi-protocol data acquisition interface. Combined with a lightweight convolutional neural network (CNN) and long short-term memory network (LSTM) fusion model, the local data stream is analyzed in real time. The software layer deploys a lightweight anomaly detection model and a protocol whitelist rule base, combined with the national cryptographic SM4 / SM9 dual authentication controller and a local threat knowledge base, forming a "collection-analysis-detection-response" closed loop.

[0075] It should be noted that: the hardware layer uses the Ascend 910B AI chip and multi-protocol interfaces to achieve μs-level data acquisition and analysis; the analysis layer deploys a lightweight CNN-LSTM fusion model, which extracts spatial features through 3D-CNN and analyzes temporal patterns through Temporal-LSTM to achieve real-time inference of 200,000 points / second; the security layer runs in parallel a protocol whitelist, national cryptographic SM4 / SM9 dual authentication, and a local threat knowledge base; the response layer triggers graded handling based on dynamic 0-1 score range scoring, and high-risk threat devices with scores ≥0.7 are immediately isolated and FPGA deep forensics is initiated; the optimization layer updates the model every 6 hours through federated learning and continuously evolves by combining digital twin adversarial examples.

[0076] The strategy control module is used to control the strategies of the industrial control computer system based on the risk assessment of the industrial control computer's operation, and to construct the fog layer component:

[0077] Fog computing nodes are built by deploying edge servers, integrating multiple edge gateways, and using a federated learning framework to aggregate threat scores of various industrial control computers in real time. Computing resources are dynamically allocated through an intelligent scheduling engine. Quantum key rotation and traffic mirroring analysis are initiated for high-threat devices with scores ≥0.7, while lightweight rule verification is performed for low-threat devices. Through a multi-objective optimization algorithm module, collaborative threat assessment and resource scheduling are carried out in a coordinated manner.

[0078] It should be noted that the federated learning network is constructed using Huawei Atlas 500Pro fog computing nodes deployed at the edge layer. Each gateway generates a lightweight, real-time device-level threat score of 0-1. The encrypted threat features are aggregated every 5 minutes using the FATE framework to form a global threat map. Computing resources are dynamically scheduled based on the NSGA-III multi-objective optimization algorithm. For high-threat devices, Huawei QKD-3000 quantum key rotation and FPGA-accelerated traffic mirroring analysis are immediately initiated, while low-threat devices undergo lightweight rule verification. All operation records are stored through AntChain BaaS. The federated learning system optimizes 12 performance indicators every hour, achieving millisecond-level coordination between threat response and resource scheduling.

[0079] The resource optimization module is used to achieve efficient allocation of computing resources in industrial control systems through dynamic algorithms, and to build cloud components:

[0080] By deploying a distributed global threat intelligence center to connect with a vulnerability signature database, linking clusters to train hybrid models, and combining this with a policy distribution channel encrypted with the national cryptographic standard SM9, a three-in-one cloud defense system is constructed.

[0081] It should be noted that: First, distributed threat intelligence nodes are deployed in five major regions around the world to synchronize feature data from the CVE / NVD international vulnerability database in real time. Blockchain notarization ensures that the data is tamper-proof. Second, a CNN-Transformer hybrid model is trained by linking global nodes based on a federated learning framework. The model parameters are transmitted using differential privacy and SM4 algorithm encryption. The attack feature database is updated incrementally every day. Then, a policy distribution channel is built through the national cryptographic SM9 algorithm to achieve second-level global synchronization of defense policies. The policy package contains vulnerability feature fingerprints, handling rules, and weight parameters for triple verification. Finally, a three-in-one defense system of "intelligence-model-policy" is formed in the cloud.

[0082] The specific method for constructing a layered edge-fog-cloud collaborative architecture system based on the aforementioned edge layer components, fog layer components, and cloud layer components is as follows:

[0083] By adopting Time-Sensitive Networking (TSN) to build a nanosecond-level synchronous communication backbone, deploying the KubeEdge edge management framework to achieve full lifecycle management of containerized applications, and integrating federated learning with the national cryptographic SM9 encryption channel, a closed-loop system of "real-time edge detection - intelligent decision-making in fog domain - global optimization in the cloud" is formed.

[0084] Specifically, the system employs a time-sensitive network (TSN) to construct a nanosecond-level synchronous communication backbone, ensuring real-time data interaction between edge devices, fog nodes, and the cloud. Secondly, it deploys the KubeEdge edge management framework to achieve full lifecycle management of containerized applications, supporting the dynamic deployment of lightweight AI models from the cloud to the edge layer. Finally, through the fusion design of federated learning and the national cryptographic standard SM9 encryption channel, it completes the encrypted aggregation and collaborative analysis of multi-source threat data in the fog layer, forming a closed-loop system of "real-time edge detection - intelligent fog domain decision-making - global cloud optimization," thus constructing a layered edge-fog-cloud collaborative architecture system to achieve dynamic protection of industrial control computer data security.

[0085] Example 3

[0086] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0087] The processor executes the aforementioned sensor network-based underground reactor operation monitoring method by calling computer programs stored in memory.

[0088] The electronic device can vary considerably depending on its configuration or performance. It may include one or more processors and one or more memories, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the AI ​​edge computing-based dynamic data security protection method for industrial control computers provided in the above-described embodiment. The electronic device may also include other components for implementing its functions; for example, it may have wired or wireless network interfaces and input / output interfaces for data input and output. Further details are omitted here.

[0089] Example 4

[0090] This embodiment proposes a computer-readable storage medium on which an erasable and rewritable computer program is stored.

[0091] When a computer program runs on a computer device, the computer device executes the aforementioned dynamic data security protection method for industrial control computers based on AI edge computing.

[0092] For example, computer-readable storage media can be read-only memory, random access memory, read-only optical disc, magnetic tape, floppy disk, and optical data storage devices.

[0093] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired network and / or wireless network. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

Claims

1. An AI edge computing-based industrial computer data security dynamic protection method, characterized in that, It comprises the following specific steps: S1, trusted data encryption and preprocessing: encrypting original industrial control instructions and sensor data through a hardware-level trusted execution environment, and preprocessing the original data to form a standardized encrypted data stream; S2, intelligent anomaly detection and protocol analysis: based on an AI model, real-time detection of abnormal data packets in the standardized encrypted data stream is performed, and context verification is performed in combination with industrial control protocol characteristics to generate a threat score in real time; S3, dynamic security policy adjustment: automatically switching authentication modes according to the threat score level and executing dynamic security adjustment strategies; S4, flexible resource allocation and optimization: dynamically allocating edge computing resources according to real-time threat indexes and device loads; S5, four-dimensional coordination and closed-loop protection: through the four-step closed loop of encryption-detection-adjustment-optimization, dynamic protection of industrial computer data security is achieved; In S1, the original industrial control instructions and sensor data are encrypted through a hardware-level trusted execution environment, and the specific implementation method is: Based on the national secret algorithm, a chip-level security isolation area is constructed, the device identity is bound by PUF physical fingerprint, the key is dynamically generated by quantum random number, the industrial control instructions are encrypted, and the sensor data is protected by verification, and finally the design is combined with block chain storage and anti-side channel; In S2, the abnormal data packets in the standardized encrypted data stream are detected in real time based on an AI model, and context verification is performed in combination with industrial control protocol characteristics, and the specific implementation method is: First, the quantum key decryption is completed in the TEE security environment, the timestamp and PUF hardware fingerprint are retained, then the time-space parallel analysis architecture is used, the working condition context provided by the digital twin is combined for multi-dimensional feature fusion, and finally the threat score is output based on the dynamic weight model; In S4, the edge computing resources are dynamically allocated according to the real-time threat index and device load, and the specific implementation method is: The edge server collects device load data and threat scores in real time, then the federal learning engine dynamically adjusts the α and β coefficients, and finally the scheduler executes the allocation strategy according to the calculation results. ； where T priority is the threat priority, C util is the current CPU utilization, and a, b are adaptive weight factors; In S1, the original data is preprocessed to form a standardized encrypted data stream, and the specific implementation method is:

2. The method of claim 1, wherein the method further comprises: Through a multi-level protocol analysis engine and a time sequence feature alignment algorithm, data standardization processing is realized, and working condition context labels generated by a digital twin are embedded. In S3, the authentication mode is automatically switched according to the threat score level, and the specific implementation method is:

3. The method of claim 1, wherein the method further comprises: Based on the real-time threat score model, high and low threat levels are divided, the authentication mode switching is automatically triggered through the strategy engine, and dynamic token authentication is used for low threat; quantum-enhanced key exchange and iris biometric multi-factor authentication are started for high threat. In S3, the dynamic security adjustment strategy is executed, and the specific implementation method is:

4. The AI edge computing-based industrial computer data security dynamic protection method of claim 1, wherein, Based on the real-time threat score, the logs are automatically classified and stored, and the logs are recorded to the local encrypted cache for low threat, and the logs are immediately written to the quantum security cloud storage for high threat. It specifically includes a data acquisition and processing module, an AI detection module, a strategy control module, and a resource optimization module; 5. The industrial computer data security dynamic protection system based on AI edge computing, which is implemented based on the industrial computer data security dynamic protection system based on AI edge computing method according to any one of claims 1-4, characterized in that, The data acquisition module is configured to acquire industrial computer operation data through a sensor. ​ The AI detection module is configured to perform multi-modal fusion analysis and risk assessment on the obtained industrial computer operation data through AI, and construct an edge layer component. The policy regulation module is configured to perform dynamic protection policy regulation of industrial computer data security according to the risk assessment of the industrial computer operation, and construct a fog layer component. The resource optimization module is configured to realize efficient allocation of industrial computer system computing resources through a dynamic algorithm, and construct a cloud component.

6. An electronic device comprising: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; The processor calls the computer program stored in the memory to execute the AI edge computing-based industrial computer data security dynamic protection method according to any one of claims 1-4.

7. A computer readable storage medium characterized by The computer program is stored in the memory and, when executed on the computer, causes the computer to execute the AI edge computing-based industrial computer data security dynamic protection method according to any one of claims 1-4.

Images