An industrial Internet security monitoring and control system

Abstract

The present invention relates to the field of industrial Internet security monitoring, and specifically discloses an industrial Internet security monitoring and control system, including a network security monitoring module, a control logic monitoring module, a traceability analysis module, and an early warning execution module. The network security monitoring module analyzes the network attack risk level and the illegal access risk level through traffic baseline comparison, attack feature matching, and risk model evaluation; the control logic monitoring module identifies control logic anomalies based on equipment operation status data and triggers verification alarms; the traceability analysis module uses a decision tree algorithm, combined with operation logs, behavior trajectories, and version update records, to determine whether the cause of tampering is misoperation, malicious tampering, or system update; the early warning execution module triggers differentiated graded early warnings based on risk level and tampering cause classification. The system can effectively identify external attacks, illegal access, and logic tampering behaviors, and improve the security protection capabilities of the industrial Internet.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security monitoring and particularly to an industrial Internet security monitoring and control system. Background Art

[0002] The Industrial Internet is a technical architecture and industrial development model that deeply integrates Internet technology into the industrial sector, achieving intelligent, efficient, and networked industrial production systems. Specifically, the Industrial Internet connects industrial equipment and systems through various communication technologies, such as the Internet of Things, wired networks, and wireless networks. This connects various devices, machines, sensors, and control systems used in industrial production, enabling interoperability and data sharing between devices, enabling efficient, stable, and secure collaboration.

[0003] However, due to the inconsistent protocols, strong device heterogeneity, and complex network architectures of industrial equipment and systems in the Industrial Internet, security risks such as data leakage, malicious intrusion, and production instruction tampering are easily exposed due to communication protocol vulnerabilities, device authentication flaws, or unencrypted data transmission. Furthermore, weak coordination mechanisms between heterogeneous devices can lead to production process disruptions or physical damage. Therefore, it is necessary to conduct full-link control of the interconnected and collaborative process between devices by real-time monitoring of process data flows, establishing dynamic access control policies, and deploying abnormal behavior analysis systems. This can identify and block attack paths and ensure the security of cross-system collaboration and production continuity.

[0004] Existing technologies have obvious shortcomings in the security monitoring and control of interconnected collaboration between industrial equipment.

[0005] For example, the existing Chinese patent with authorization announcement number CN115826539B discloses a device collaborative control method and system based on industrial Internet identification. The core of the method is to group and identify multiple devices through industrial Internet identification, thereby achieving collaborative control of the devices. The specific steps include: obtaining device information and dividing the device groups, assigning industrial Internet identification to each device group and device, and finally performing collaborative control based on these identifications. This method focuses on identification management and collaborative operation between devices, but does not involve security monitoring and control of interconnected collaboration between devices.

[0006] For example, the existing Chinese patent with authorization announcement number CN114755993B discloses a collaborative control method, system, and related equipment for industrial internet applications. This method analyzes the data type, generation time, and processing device status of operational data in industrial production processes to determine data priority and target processing devices, ultimately selecting the optimal processing device to perform the task. This method focuses on improving data processing efficiency and industrial control efficiency, and similarly does not address the security issues of interconnected collaboration between devices. Summary of the Invention

[0007] In response to the above problems, the present invention proposes an industrial Internet security monitoring and control system to realize the function of industrial Internet security monitoring.

[0008] The technical solution adopted by the present invention to solve its technical problems is: the present invention provides an industrial Internet security monitoring and control system, including: a network security monitoring module: based on the collected traffic data of the industrial equipment communication network, it analyzes and identifies external network attack behaviors and illegal access requests, and analyzes the risk level based on the attack type, attack frequency, impact range, number of visits, and number of access devices.

[0009] Control logic monitoring module: It uses the collected industrial equipment operating status data to identify whether the control logic between devices has been tampered with, and triggers a verification alarm when a logic anomaly is detected.

[0010] Source tracing analysis module: After receiving the verification alarm, the operation log, behavior trajectory and version update record are retrieved for multi-dimensional analysis, and a decision tree algorithm is used to determine whether the cause of tampering is one or more combinations of misoperation, malicious tampering or system download update.

[0011] Early warning execution module: triggers differentiated graded early warnings based on risk levels and tampering reasons.

[0012] Compared with the existing technology, the industrial Internet security monitoring and control system described in the present invention has the following beneficial effects: 1. Network security monitoring: The present invention analyzes the traffic data of the industrial equipment communication network in real time, identifies external network attack behaviors and illegal access requests, and evaluates the risk level based on multi-dimensional parameters such as attack type, frequency, and impact range, thereby realizing comprehensive monitoring of network security.

[0013] 2. Control logic tampering detection: This invention detects anomalies in the order, content, and cycle of control logic execution by comparing equipment operating status data with standard control logic, thereby promptly discovering control logic tampering behavior and ensuring the normal operation of industrial equipment.

[0014] 3. Multi-dimensional source tracing analysis: This invention combines operation logs, behavior trajectories and version update records, and uses a decision tree algorithm to distinguish control logic anomalies caused by misoperation, malicious tampering and system updates. It can clearly identify the root cause of the problem and facilitate targeted treatment. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a system module connection diagram of the present invention.

[0017] Figure 2 This is a composition diagram of the network security monitoring module of the present invention.

[0018] Figure 3 This is a composition diagram of the traceability analysis module of the present invention. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0020] See also Figure 1 As shown, the present invention provides an industrial Internet security monitoring and control system, including a network security monitoring module, a control logic monitoring module, a traceability analysis module, and an early warning execution module.

[0021] The control logic monitoring module is connected to the source tracing analysis module, and the early warning execution module is connected to the network security monitoring module and the source tracing analysis module respectively.

[0022] The network security monitoring module analyzes and identifies external network attack behaviors and illegal access requests based on the collected traffic data of the industrial equipment communication network, and analyzes the risk level based on the attack type, attack frequency, impact range, number of accesses, and number of access devices.

[0023] Further, see Figure 2 As shown, the network security monitoring module includes a flow data acquisition unit, an external network attack monitoring unit, and an illegal access monitoring unit. The specific working process of the flow data acquisition unit is: setting a listening port on each key node device in the industrial equipment communication network to mirror its network traffic, and copying the data packets flowing through these devices and sending them to the traffic analysis system to obtain the flow data of each key node device in the communication network during the monitoring period.

[0024] As a preferred solution, key node devices are devices that occupy a critical position in an industrial equipment communication network and play a vital role in the normal operation, data transmission, and security of the network. In one specific embodiment, key node devices include but are not limited to: routers, switches, firewalls, intrusion detection systems / intrusion prevention systems, servers, load balancers, network access devices, core network equipment, etc.

[0025] In another specific embodiment, professional traffic collection tools, such as Wireshark, tcpdump, etc., are used to capture original data packets on each network interface of the industrial equipment communication network, and save them as files or directly perform real-time analysis to obtain traffic data.

[0026] Furthermore, the specific working process of the external network attack monitoring unit includes: using the traffic pattern of normal network activities of the industrial equipment communication network stored in the database to obtain the average traffic, peak traffic, and port traffic distribution of each key node device in the communication network in different time periods, thereby establishing a traffic baseline for each key node device in the communication network.

[0027] The flow data of each key node device in the communication network during the monitoring period is compared with its flow baseline to obtain the deviation of the average flow, peak flow, and port flow distribution relative to the flow baseline, and the deviation is input into the preset flow data relative baseline deviation-flow anomaly coefficient relationship model, and the flow anomaly coefficient of each key node device is output. The relationship model contains a quantitative mapping relationship between the flow data relative baseline deviation and the flow anomaly coefficient.

[0028] If the traffic anomaly coefficient of a key node device in the communication network is greater than the set threshold, it is determined that there is an external network attack on the communication network, and the key node device is recorded as an abnormal node device, and the number of abnormal node devices is counted.

[0029] It should be noted that a feasible simulation process assumes that there are three key node devices: device A, device B, and device C. The flow baselines and actual flow data of the three key node devices during the monitoring period can be found in Table 1 and Table 2 respectively. Based on the flow data relative baseline deviation-flow anomaly coefficient relationship model, the flow anomaly coefficient of each key node device can be analyzed and obtained. Please refer to Table 3 for details.

[0030] Table 1. Baseline data of key node equipment

[0031]

[0032] Table 2. Actual traffic data of key node equipment

[0033]

[0034] Table 3 Analysis results of abnormal flow coefficient of key node equipment

[0035]

[0036] The model rules are as follows: (1) Average flow anomaly coefficient = |average flow deviation percentage| × 0.1; (2) Peak flow anomaly coefficient = |peak flow deviation percentage| × 0.15; (3) Port distribution anomaly coefficient = total port distribution deviation (the sum of the absolute values of the percentage changes of each port) × 0.05; (4) The total flow anomaly coefficient is the sum of the three anomaly coefficients.

[0037] Furthermore, the specific working process of the external network attack monitoring unit also includes: extracting the attack traffic characteristics of each abnormal node device from the traffic data, and comparing them with the traffic characteristics of various network attacks stored in the database, matching the network attack type corresponding to each abnormal node device, and classifying and statistically obtaining a set of attack types of external network attacks on the communication network.

[0038] As a preferred solution, the types of external network attacks include DDoS attacks, SQL injections, XSS, man-in-the-middle attacks, port scans, malware propagation, phishing attacks, zero-day vulnerability exploits, brute force cracking, DNS hijacking, etc. The traffic characteristics of each attack include packet size, frequency, protocol used, abnormal behavior, etc.

[0039] The network attack frequency corresponding to each abnormal node device is obtained, and the attack frequency of the external network attack of the communication network is obtained by performing maximum value calculation.

[0040] As a preferred option, network attack frequency refers to the number or rate of attack behaviors launched against a specific target, system or network within a certain time frame.

[0041] The number of abnormal node devices in the communication network is substituted into the preset correspondence between the number of abnormal node devices and the impact range level, and the impact range level of the external network attack on the communication network is obtained by matching.

[0042] The attack type set, attack frequency, and impact scope level of the external network attack on the communication network are input into the set network attack risk level assessment model to obtain the network attack risk level of the communication network.

[0043] It should be noted that the network attack risk level assessment model includes a quantitative mapping relationship between the attack type set, attack frequency, impact scope level and network attack risk level.

[0044] It should be noted that a feasible simulation process, as shown in Tables 4, 5, and 6, is a specific process for analyzing the network attack risk level of the communication network: setting a risk factor corresponding to each attack type, screening and obtaining the risk factors corresponding to each type of attack in the attack type set of external network attacks on the communication network, and accumulating them to obtain the attack type risk factor of the external network attack on the communication network.

[0045] Set the risk factors corresponding to each attack frequency range and each impact range level, and filter out the attack frequency risk factor and impact range risk factor of the external network attack on the communication network.

[0046] The weighted average of the attack type risk factor, attack frequency risk factor, and impact scope risk factor of the external network attack on the communication network is calculated to obtain the comprehensive risk factor of the external network attack on the communication network, and the calculation result is substituted into the set correspondence between the comprehensive risk factor and the network attack risk level to obtain the network attack risk level of the communication network.

[0047] Table 4. Definition of risk factors and their weights

[0048]

[0049] Table 5. Risk level mapping table

[0050]

[0051] Table 6. Network attack risk level assessment results

[0052]

[0053] It should be noted that the present invention is based on dynamic traffic data, uses traffic baseline comparison and anomaly coefficient calculation to accurately detect external network attack behaviors and quantify risk levels, thereby improving the accuracy and pertinence of detection, and realizing real-time monitoring and risk analysis of network attack behaviors.

[0054] Furthermore, the specific working process of the illegal access monitoring unit is: based on the traffic data of each key node device in the communication network during the monitoring period, the characteristics of each access request of each key node device in the communication network during the monitoring period are extracted, and the characteristics include traffic frequency, access time, IP location, number of failed connections, protocol-port combination, and compared with the corresponding characteristics of illegal access stored in the database to determine whether it is an illegal access request.

[0055] Further obtain the cumulative number of illegal access requests to key node devices in the communication network and the cumulative number of illegal access to key node devices, record them as the number of access requests and the number of access devices of the communication network, and substitute them into the preset illegal access risk level assessment model to obtain the illegal access risk level of the communication network.

[0056] It should be noted that a feasible simulation process for determining whether it is an illegal access request is as follows: based on the characteristics corresponding to the illegal access stored in the database, the traffic frequency range, access time period, IP location blacklist, failed connection number range, and protocol-port combination library corresponding to the illegal access are obtained.

[0057] Set the matching factor of the traffic frequency that belongs to and does not belong to the corresponding traffic frequency range of illegal access, and filter out the matching factor of the traffic frequency of each access request of each key node device in the communication network with the illegal access, and record it as , Indicates the The number of key node equipment, , Indicates the The number of access requests, Similarly, we can get the access time, IP location, number of failed connections, protocol-port combination and illegal access matching factor of each access request of each key node device in the communication network, and record them as .

[0058] By analyzing the formula Obtain the illegal access tendency degree of each access request of each key node device in the communication network ,in They represent the preset traffic frequency, access time, IP location, number of failed connections, and weight of the protocol-port combination. .

[0059] The illegal access tendency degree of each access request of each key node device in the communication network is compared with the preset illegal access tendency degree threshold. If the illegal access tendency degree of a certain access request of a key node device is greater than the threshold, it is determined to be an illegal access request.

[0060] It should be noted that a feasible simulation process obtains the communication network illegal access risk level assessment result based on the illegal access risk level assessment model according to the number of access requests and the number of access devices of the communication network. Please refer to Table 7 for details.

[0061] Table 7. Illegal access risk level assessment results

[0062]

[0063] It should be noted that the present invention extracts access features and efficiently identifies illegal access requests and evaluates risk levels based on multi-feature comparison and illegal access tendency calculation, thereby realizing the identification and risk grading of illegal access requests and enhancing the system's defense capabilities.

[0064] The control logic monitoring module identifies whether the control logic between devices has been tampered with through the collected industrial equipment operation status data, and triggers a verification alarm when a logic anomaly is detected.

[0065] Furthermore, the specific working process of the control logic monitoring module is: collecting real-time data on the operating status of industrial equipment, obtaining the execution sequence, execution content and execution cycle of control instructions between industrial equipment, and comparing them with the standard execution sequence, standard execution content and execution cycle thresholds of control instructions between industrial equipment stored in the database.

[0066] The abnormal factors corresponding to inconsistent execution order, different execution content and exceeding the execution cycle threshold are set respectively, and the abnormal factors corresponding to the order, content and cycle of the control instruction execution between industrial equipment are matched. The abnormal factors are accumulated to obtain the control logic abnormality coefficient between industrial equipment, and the result is compared with the set threshold. If it is greater than the threshold, the control logic between industrial equipment is abnormal and has been tampered with.

[0067] It should be noted that the execution sequence, execution content, and execution cycle of control instructions between industrial equipment are the core of the control logic. The execution sequence is the timing skeleton of the control logic, the execution content is the behavioral definition of the control logic, and the execution cycle is the timing constraint of the control logic. The sequence, content, and cycle together encode the complete rule chain of "when → what to do → how long to last". These three together define the core rules of system operation, ensuring that equipment completes collaborative tasks at the right time and in the right way.

[0068] It's important to note that monitoring the execution sequence, content, and cycle of industrial equipment control instructions to determine logic tampering is reasonable, as the proper operation of industrial control systems relies on the strict timing, parameter consistency, and periodicity of predefined logic. Tampering with control logic can inevitably lead to instruction sequences violating established process flows (e.g., misordered steps), execution parameters deviating from safety thresholds (e.g., injection of abnormal values), or unexpected fluctuations in operation intervals (e.g., cycle compression / lengthening). These characteristics can quantifiably differ from legitimate behavior patterns in baseline models. By comparing the characteristic parameters of actual instruction streams with those of standard logic in real time and combining them with anomaly detection algorithms, covert logic tampering can be effectively identified. Essentially, this approach leverages the deterministic characteristics of the control system to construct a fingerprint of abnormal behavior, aligning with the dual verification principle of "whitelisting + behavioral analysis" in industrial security defense.

[0069] It should be noted that the present invention detects abnormalities in the execution sequence, content or cycle of the control logic by comparing the equipment operation status data with the standard logic, and thus promptly discovers the tampering of the control logic to ensure the normal operation of the industrial equipment.

[0070] After receiving the verification alarm, the traceability analysis module retrieves the operation log, behavior trajectory and version update record for multi-dimensional analysis, and uses a decision tree algorithm to determine whether the cause of tampering is one or more combinations of misoperation, malicious tampering or system download update.

[0071] Further, see Figure 3 As shown, the traceability analysis module includes an error operation analysis unit, a malicious tampering analysis unit and a system download and update analysis unit, wherein the specific working process of the error operation analysis unit is: calling the operation log of the industrial equipment, obtaining the modification time point of the industrial equipment control logic program code and the text before and after the modification; if the modification time point of the program code is during normal working hours or error-prone time and the conversion of the text before and after the modification conforms to common input errors, it is determined that the cause of the tampering of the control logic between industrial equipment is an error operation.

[0072] As a preferred solution, the error-prone times include shift changes, fatigue periods, etc.

[0073] As a preferred solution, the common input errors include spaces, deletions, duplications, transpositions, etc.

[0074] Furthermore, the specific working process of the malicious tampering analysis unit is: obtaining the behavioral trajectory of the industrial equipment personnel's operation, identifying whether there are set malicious tampering behavior characteristics, and if so, determining that the cause of the tampering of the control logic between industrial equipment is malicious tampering, where the malicious tampering behavior characteristics include operation modes that circumvent normal processes, time distribution during non-working hours, deliberate concealment, target selectivity, and no subsequent correction attempts.

[0075] As a preferred solution, the deliberate concealment behavior includes deleting logs or using other people's credentials.

[0076] As a preferred solution, the target selectivity means that the modification of the control logic program code is targeted at specific key parameters or processes.

[0077] Furthermore, the specific working process of the system download update analysis unit is: obtaining the version update record of the industrial equipment. If the modification time point of the industrial equipment control logic program code coincides with the version update time point, the version update mentions the modification of the control logic and the control logic can be restored to normal by rolling back to the version before the update, then it is determined that the cause of the tampering of the control logic between the industrial equipment is the system download update.

[0078] It should be noted that the present invention combines operation logs, behavior trajectories and version update records, and uses a decision tree algorithm to distinguish control logic anomalies caused by misoperation, malicious tampering and system updates, which can clarify the root cause of the problem and facilitate targeted processing.

[0079] The warning execution module triggers differentiated graded warnings according to risk levels and tampering reasons.

[0080] Furthermore, the specific working process of the early warning execution module is: setting the mapping relationship between the network attack risk level of the communication network, the illegal access risk level and the tampering reason of the control logic between devices and the early warning level, and according to the risk level and the tampering reason, screening to obtain the corresponding early warning level and triggering the early warning.

[0081] It should be noted that a feasible simulation process obtains the warning level assessment results based on the network attack risk level of the communication network, the illegal access risk level and the cause of tampering with the control logic between devices. For some specific data, please refer to Table 8.

[0082] Table 8. Partial evaluation results of warning levels

[0083]

[0084] It should be noted that the present invention triggers graded warnings based on the network attack risk level, illegal access risk level and tampering cause classification, thereby ensuring that the response measures match the risk level, realizing a differentiated graded warning mechanism, and improving the accuracy and efficiency of the warning.

[0085] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they should all fall within the scope of protection of the present invention.

Claims

1. An industrial Internet security monitoring and control system, characterized in that: include: Network security monitoring module: Identifies external network attacks and illegal access requests based on collected traffic data from industrial equipment communication networks, and analyzes risk levels based on attack type, attack frequency, impact range, number of accesses, and number of access devices. Control logic monitoring module: This module uses collected data on the operating status of industrial equipment to identify whether the control logic between devices has been tampered with. When a logic anomaly is detected, a verification alarm is triggered. Source tracing analysis module: After receiving verification alarms, it retrieves operation logs, behavior tracing, and version update records for multi-dimensional analysis. It uses a decision tree algorithm to determine whether the tampering is caused by one or more combinations of misoperation, malicious tampering, or system download updates. Early warning execution module: triggers differentiated graded early warnings based on risk levels and tampering causes; The network security monitoring module includes a traffic data acquisition unit, an external network attack monitoring unit, and an illegal access monitoring unit; The specific working process of the external network attack monitoring unit includes: Establish traffic baselines for key node devices in the communication network; The traffic patterns of normal network activities of industrial equipment communication networks stored in the database are used to obtain the average traffic, peak traffic, and port traffic distribution of each key node device in the communication network in different time periods; The flow data of each key node device in the communication network during the monitoring period is compared with its flow baseline to obtain the deviation of the average flow, peak flow, and port flow distribution relative to the flow baseline, and the deviation is input into a preset flow data relative baseline deviation-flow anomaly coefficient relationship model, and the flow anomaly coefficient of each key node device is output. The relationship model includes a quantitative mapping relationship between the flow data relative baseline deviation and the flow anomaly coefficient; If the traffic anomaly coefficient of a key node device in the communication network is greater than the set threshold, it is determined that there is an external network attack on the communication network, and the key node device is recorded as an abnormal node device, and the number of abnormal node devices is counted; The specific working process of the control logic monitoring module is as follows: Collect real-time data on the operating status of industrial equipment, obtain the execution sequence, execution content, and execution cycle of control instructions between industrial equipment, and compare them with the standard execution sequence, standard execution content, and execution cycle thresholds of control instructions between industrial equipment stored in the database; The abnormal factors corresponding to inconsistent execution order, different execution content and exceeding the execution cycle threshold are set respectively, and the abnormal factors corresponding to the order, content and cycle of the control instruction execution between industrial equipment are matched. The abnormal factors are accumulated to obtain the control logic abnormality coefficient between industrial equipment, and the result is compared with the set threshold. If it is greater than the threshold, the control logic between industrial equipment is abnormal and has been tampered with.

2. The industrial Internet security monitoring and control system according to claim 1, characterized in that: The specific working process of the flow data collection unit is as follows: A listening port is set up on each key node device in the industrial equipment communication network to mirror its network traffic, and the data packets flowing through these devices are copied and sent to the traffic analysis system to obtain the traffic data of each key node device in the communication network during the monitoring period.

3. The industrial Internet security monitoring and control system according to claim 1, characterized in that: The specific working process of the external network attack monitoring unit also includes: Extract the attack traffic characteristics of each abnormal node device from the traffic data, and compare them with the traffic characteristics of various network attacks stored in the database, match the network attack type corresponding to each abnormal node device, and classify and count the attack types of external network attacks on the communication network; Obtain the network attack frequency corresponding to each abnormal node device, and perform maximum value calculation to obtain the attack frequency of the external network attack on the communication network; Substituting the number of abnormal node devices in the communication network into the preset correspondence between the number of abnormal node devices and the impact range level, the impact range level of the external network attack on the communication network is obtained; The attack type set, attack frequency, and impact scope level of the external network attack on the communication network are input into the set network attack risk level assessment model to obtain the network attack risk level of the communication network.

4. The industrial Internet security monitoring and control system according to claim 1, characterized in that: The specific working process of the illegal access monitoring unit is as follows: Extract the characteristics of each access request from each key node device in the communication network during the monitoring period based on the traffic data of each key node device in the communication network during the monitoring period. The characteristics include traffic frequency, access time, IP location, number of failed connections, and protocol-port combination. Compare them with the corresponding characteristics of illegal access stored in the database to determine whether it is an illegal access request; Further obtain the cumulative number of illegal access requests to key node devices in the communication network and the cumulative number of illegal access to key node devices, record them as the number of access requests and the number of access devices of the communication network, and substitute them into the preset illegal access risk level assessment model to obtain the illegal access risk level of the communication network.

5. The industrial Internet security monitoring and control system according to claim 1, characterized in that: The traceability analysis module includes an error operation analysis unit, a malicious tampering analysis unit, and a system download and update analysis unit. The specific working process of the error operation analysis unit is as follows: Retrieve the operation log of the industrial equipment to obtain the modification time of the industrial equipment control logic program code and the text before and after the modification. If the modification time of the program code is during normal working hours or error-prone time and the conversion of the text before and after the modification conforms to common input errors, then it is determined that the cause of the tampering of the control logic between industrial equipment is an incorrect operation.

6. The industrial Internet security monitoring and control system according to claim 5, characterized in that: The specific working process of the malicious tampering analysis unit is as follows: Obtain the behavioral trajectory of industrial equipment personnel operations and identify whether there are set malicious tampering behavior characteristics. If so, determine that the cause of tampering with the control logic between industrial equipment is malicious tampering. The malicious tampering behavior characteristics include operation modes that circumvent normal processes, time distribution during non-working hours, deliberate concealment, target selectivity, and no subsequent correction attempts.

7. The industrial Internet security monitoring and control system according to claim 5, characterized in that: The specific working process of the system download update analysis unit is as follows: Obtain the version update record of the industrial equipment. If the modification time of the industrial equipment control logic program code coincides with the version update time, the version update mentions the modification of the control logic, and the control logic can be restored to normal by rolling back to the version before the update, then it is determined that the cause of the tampering of the control logic between the industrial equipment is a system download update.

8. The industrial Internet security monitoring and control system according to claim 1, characterized in that: The specific working process of the early warning execution module is as follows: Set the mapping relationship between the network attack risk level of the communication network, the illegal access risk level, the tampering cause of the control logic between devices and the warning level. According to the risk level and tampering cause, filter out the corresponding warning level and trigger the warning.

Images