Security monitoring method and device for data stream and medium

Abstract

The invention relates to the technical field of data monitoring, in particular to a data stream security monitoring method and device and a medium, and the method comprises the following steps: synchronously collecting a data stream of a printing device and a physical state sensor signal, and cutting the data stream into beat synchronization data blocks according to the rotation period of a printing cylinder; performing dual verification on the beat synchronization data block to generate an abnormal weight coefficient; and when the abnormal weight coefficient exceeds a beat tolerance threshold value, delaying to a stop gap of the end of the current printing period, injecting a reverse balance instruction into the printing equipment controller, and calculating and generating a parameter value of the reverse balance instruction based on the deviation value and the dynamic correlation degree. According to the method, a data-physical-control multi-closed-loop protection mechanism is constructed, so that the overall abnormal response speed and control smoothness are improved, and the problems of false alarm, overcompensation or interlocking interference are avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of data monitoring, and in particular to a method, device and medium for securely monitoring data streams. Background Art

[0002] With the development of intelligent and networked printing equipment, the coordinated consistency between the data flow and physical operation status involved in the printing control system has become the key to ensuring production safety and data integrity. However, existing industrial control systems generally use a synchronization method based on software timestamps to associate network data messages with sensor signals through a logical timeline for subsequent data verification and anomaly detection. However, this method has multiple technical bottlenecks in high-frequency mechanical systems: First, the accuracy of timestamp synchronization is insufficient. Due to the influence of software-level sampling delays, operating system scheduling offsets, etc., the synchronization error between network data and physical status is often several milliseconds, which makes it difficult to effectively perceive sub-beat-level abnormal behaviors (such as tiny time drift attacks) in high-speed printing equipment.

[0003] Secondly, the anomaly detection model lacks physical constraint relevance. Existing solutions usually only implement anomaly judgment through data content hash verification or instruction logic sequence comparison, and fail to fully utilize physical quantity characteristics such as pressure fluctuations and speed changes during equipment operation, resulting in low detection rates and increased false alarm rates when facing complex security threats such as forged instructions, physical simulation attacks, or communication man-in-the-middle attacks.

[0004] In addition, the control intervention method is too rigid. When the system identifies an abnormality, it often uses a direct shutdown or reset protection mechanism, and fails to combine the structural operation rules of the printing equipment (such as the roller paper receiving / paper separation gap cycle) to inject intelligent beats into the control instructions, which may interfere with the normal production rhythm and even cause system overload or paper waste. Summary of the invention

[0005] The present invention provides a data flow security monitoring method, device and medium, which integrate the data flow, physical state and control logic of the printing equipment into a trinity, and has a security monitoring method with high-precision synchronization, high-robust recognition and low-interference response characteristics to meet the security control needs of the new generation of intelligent printing manufacturing.

[0006] A data flow security monitoring method comprises the following steps: S1: Synchronously collect the data stream and physical state sensor signal of the printing equipment, cut the data stream into beat synchronization data blocks according to the rotation cycle of the printing cylinder, and bind each data block to the equipment pressure value and speed value in the corresponding cycle; S2: Double-verify the beat synchronization data block. First, verify the deviation value between the timestamp of the instruction sequence in the data block and the drum rotation phase. Then, verify the correlation degree difference between the hash chain of the encrypted data payload and the device pressure value, and generate an anomaly weight coefficient. S3: When the anomaly weight coefficient exceeds the beat tolerance threshold, delay until the rest gap at the end of the current printing cycle, and inject a reverse balance instruction into the printing device controller. The parameter value of the reverse balance instruction is calculated based on the deviation value and the dynamic correlation degree in S2.

[0007] Optionally, the S1 specifically includes: S11: Generate a pulse signal through the photoelectric encoder installed on the main shaft of the printing drum. Use the pulse rising edge as the synchronous trigger signal to real-time obtain the network packets in the data stream acquisition card buffer and the analog signal of the pressure sensor. S12: According to the number of pulses N included in the preset printing cycle, use consecutive N pulse intervals as the time window to cut the data stream to form a beat synchronization data block. S13: At the end of each time window, extract the arithmetic mean value of the pressure sensor signal waveform in this time window as the device pressure value, extract the reciprocal of the encoder pulse interval as the rotational speed value, and create a metadata area at the head of the beat synchronization data block to store the pressure value, rotational speed value, and the corresponding drum phase angle.

[0008] Optionally, the number of pulses N is calculated as: N = P × C; where P represents the number of encoder pulses generated by one rotation of the drum, and C represents the number of printing colors set in the current work order. Automatically adjust the beat synchronization window according to the work order configuration.

[0009] Metadata area structure design: Pressure value : 4 bytes (float); Rotational speed value Byte (float); Phase angle : 2 bytes (uint16, angle accuracy is about 0.01°); Checksum: 2 bytes (used for integrity check, such as CRC16).

[0010] Optionally, the S2 includes parsing the instruction sequence in the beat synchronization data block, extracting the timestamp of each instruction, establishing a timestamp-phase mapping table according to the drum phase angle in the metadata area, and calculating the maximum deviation value between the real-time phase angle corresponding to each instruction timestamp and the metadata record phase angle. 。

[0011] Optionally, the S2 also includes performing a hash operation on the encrypted data payload according to the preset block rule to generate the current hash chain. ; Query the pre-stored pressure-hash mapping table based on the device pressure value to obtain the theoretical hash chain , and calculate the hash correlation degree difference value .

[0012] Optionally, the abnormal weight coefficient is calculated as follows: ; where is the abnormal weight coefficient, are the weight factors of the phase deviation and the hash difference respectively, satisfying , is the hash chain correlation degree difference value; The determination rule is: If : Mark it as a valid anomaly and submit it to the next step to execute the reverse balance control instruction injection; If : Mark it as normal or slightly disturbed and do not trigger control.

[0013] Mapping function is established depending on the roller rotation speed and the encoder pulse period, as follows: I. Define the required variables: : The timestamp (absolute time) of the th instruction; : The time (period) for the current roller to make one full rotation; : The number of pulses output by the encoder per full rotation; : The current angular velocity of the roller; : The timestamp reference point for the start of the most recent full rotation of the current roller (the nearest pulse time can be taken).

[0014] II. Mapping function formula: The formula for the roller phase angle is as follows: ; That is: Subtract the instruction timestamp from the current reference start time , then divide by the rotation time for one full circle , to obtain the progress of the current roller in the circle (a decimal, range 0-1), and finally multiply by 360° to get the current angle of the roller, taking the modulus of 360° to ensure that the phase angle result is within the interval.

[0015] III. Solution method for the roller period of: It can be estimated from the encoder pulse interval and the number: ; where is the time interval between adjacent encoder pulses. If the sampling interval is stable, it can also be obtained by multiplying the average interval of one pulse by to get: ; this is inversely deduced from the reciprocal of the rotational speed value , represents the average interval time of encoder pulses and is the mean value of several pulse intervals.

[0016] IV. Encoder Pulse Aided Method (Enhanced Precision): Sampling based on encoder pulses, precise positioning can be achieved through the pulse number and its occurrence time .

[0017] V. ; where is the encoder pulse number, is the start pulse timestamp of the current revolution, is the angular displacement per unit time.

[0018] Summary of the mapping logic flowchart: 1. Collect the current rotational speed of the drum Deduce ; 2. Determine the reference time point (starting point of a full revolution); 3. Input the command timestamp ; 4. Apply the mapping function ; 5. Output the phase angle .

[0019] Optionally, S3 specifically includes: S31, Dynamic Beat Tolerance Threshold Calculation: Calculate the beat tolerance threshold : ; where is the beat anomaly weight reference threshold calibrated by the equipment manufacturer (with the same unit consistency as , taking the value of 1), represents the rotational speed compensation factor, , where is the real-time drum rotational speed; is the rated drum rotational speed, represents the safety level coefficient, defined according to the work order type as: .

[0020] S32, Resting Gap Judgment and Command Suspension Control Continuously monitor the drum phase angle , when the following conditions are met: When it is determined as an injectable window, the abnormal control instruction is suspended and sent at the last stage of entering this interval.

[0021] S33, Reverse balance instruction parameter calculation: When the abnormal weight coefficient in S2 is as follows, extract: Phase deviation value , Hash difference value , Current pressure value and current rotational speed ; And calculate the following two control parameters: (1) Pressure compensation amount : , where is the circumference of the printing cylinder.

[0022] (2) Rotational speed correction amount : ; where ln is the natural logarithm function (smoothly adjust the rotational speed); Limiting condition: ; represents the rated pressure value of the device.

[0023] S34, Reverse balance instruction injection control: Package and into a control instruction packet: Instruction packet CMD_REV , Check code ; And send it to the printing device controller within the last 5 ms time window of the currently detected rest gap: The instruction packet is only sent within the window period to ensure no interference with the printing cycle; Lock the injection requests of the same type of instructions within the next 3 cycles after injection to prevent cumulative overcompensation.

[0024] A terminal device includes a processor and a memory, and the processor is coupled to the memory; the processor is used to execute the computer program stored in the memory to execute the above-mentioned security monitoring method.

[0025] A medium includes a computer program or instruction, and when the computer program or instruction runs on a computer, it executes the above-mentioned security monitoring method.

[0026] Advantages of the present invention:

[0027] In the present invention, by introducing a hardware-level triggering mechanism based on the pulses of an optoelectronic encoder, the data stream is cut into beat-synchronized data blocks, and each block of data is structurally bound to the real-time roller rotation speed, pressure value, and phase angle, solving the problem of millisecond-level error accumulation in traditional software timestamp methods. Combining the dynamic calculation logic of the number of pulses per revolution of the roller and the number of printing colors, it supports adaptive data alignment and reconstruction in multi-work order scenarios, ensuring high time accuracy in the subsequent phase difference calculation in double verification, and providing an accurate positioning basis for micro-disturbance-level anomalies (such as timestamp drift or pressure simulation tampering).

[0028] In the present invention, an abnormal weight factor is jointly constituted by the difference between the instruction timestamp and the roller phase angle and the difference degree of the hash chain driven by the pressure value, and the tolerance threshold is dynamically calculated according to the current rotation speed and the work order security level, realizing differential and conditional judgment of data tampering behaviors. A mapping relationship is established between physical parameters (such as pressure and rotation speed) and an encryption structure (hash chain), effectively identifying "simulated physical state attacks" that cannot be prevented by conventional hash collisions. At the same time, an adaptive weight allocation strategy (emphasizing phase deviation at high rotation speeds and hash deviation at high pressures) is adopted to improve adaptability and robustness in complex operating scenarios.

[0029] In this method, the injection of reverse balance instructions is restricted to the rest gap window of the roller phase angle from 180° to 355°, and the control signal injection is completed within the last 5 ms of the window, effectively avoiding conflicts between equipment load changes and printing tasks. At the same time, the reverse instruction parameters are calculated by driving with abnormal features Δθ and D, with clear physical compensation meanings. Combining the three-cycle instruction locking mechanism, a multi-closed-loop protection mechanism of data-physics-control is constructed, thereby improving the overall abnormal response speed and control smoothness, and avoiding problems such as false alarms, overcompensation, or chain interference. Description of the Drawings

[0030] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings described below are only for the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0031] Figure 1 It is a schematic flowchart of the monitoring method according to the embodiment of the present invention; Figure 2 It is a schematic diagram of the calculation and determination of the abnormal weight coefficient according to the embodiment of the present invention. Detailed Embodiments

[0032] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. For some well-known technologies, those skilled in the art can also adopt other alternative methods for implementation; moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0033] As Figure 1 - Figure 2 shown, a method for secure monitoring of data streams includes the following steps: S1: Synchronously collect the data stream of the printing device and the signals of the physical state sensors, and cut the data stream into beat-synchronized data blocks according to the rotation period of the printing cylinder. Each data block is bound with the device pressure value and rotation speed value within the corresponding period. S2: Perform double verification on the beat-synchronized data blocks. First, verify the deviation value between the timestamp of the instruction sequence in the data block and the rotation phase of the cylinder, and then verify the correlation degree difference between the hash chain of the encrypted data payload and the device pressure value to generate an abnormal weight coefficient. S3: When the abnormal weight coefficient exceeds the beat tolerance threshold, delay until the rest gap at the end of the current printing cycle, and inject a reverse balance instruction into the printing device controller. The parameter value of the reverse balance instruction is calculated based on the deviation value and dynamic correlation degree in S2.

[0034] S1 specifically includes: S11, Generate a pulse signal through the photoelectric encoder installed on the main shaft of the printing cylinder, and use the pulse rising edge as the synchronous trigger signal to obtain in real time: The network packets in the buffer of the data stream acquisition card; The analog signal output by the pressure sensor.

[0035] This synchronization mechanism ensures that the acquisition moment is strictly aligned with the actual physical phase of the printing cylinder.

[0036] S12, Set the number of encoder pulses included in the printing cycle to N, then use consecutive N pulse intervals as the time window to cut the data stream to form beat-synchronized data blocks.

[0037] N = P × C; where P represents the number of encoder pulses generated when the cylinder rotates one circle, and C represents the number of printing colors set in the current work order. Automatically adjust the beat synchronization window according to the work order configuration to avoid manual setting errors.

[0038] S13, At the end of each time window, extract the device physical quantities within this window: S131, The device pressure value : Take the arithmetic mean of the pressure sensor signal waveform: ; where represents the total number of pressure sampling points collected within the current time window, represents the The pressure value of a sampling point; S132, the equipment rotation speed value : Estimated from the reciprocal of the adjacent encoder pulse interval: ; Among them, represents the time interval between any two adjacent pulses; S133, the drum phase angle : Calculated from the position of the current pulse number in the total number of pulses in one circle: ; Among them, is the sequence number of the current pulse in one circle (starting from 0), is the number of pulses corresponding to one circle of the drum.

[0039] Metadata area structure design: Pressure value : 4 bytes (float); Rotation speed value bytes (float); Phase angle : 2 bytes (uint16, angle accuracy is about 0.01°); Check code: 2 bytes (used for integrity check, such as CRC16).

[0040] S2 specifically includes: S21, Instruction timestamp-phase deviation verification. Analyze all instruction sequences in the beat synchronization data block, extract the timestamp of each instruction , and establish a timestamp-phase mapping table according to the drum phase angle recorded in the metadata area . Through the mapping function: , calculate the real-time phase angle corresponding to each timestamp , and obtain the deviation: ; Among them, represents the real-time phase angle of the th instruction, represents the drum reference phase angle recorded in the beat data block, represents the conversion function that maps the timestamp to the phase angle.

[0041] If the current equipment pressure value exceeds the rated value , then automatically expand the angle tolerance: .

[0042] S22, Hash chain consistency and pressure mapping verification: Perform a block hash operation on the encrypted payload of the current beat data block to generate the current hash chain value : ; Among them, represents the last two digits of the hash value of the previous data block, is the pressure value of this block, is the current encrypted data payload content, represents an encryption hash function such as SHA-256, represents hash string concatenation; query the theoretical hash value corresponding to through a look-up table , and calculate the bit-level difference degree: ; among them, represents and the number of identical bits in the binary string, is the total number of bits of the hash (256), is the hash chain correlation difference value, ranging from [0,1], and the larger the value, the more obvious the difference.

[0043] S23, Abnormal weight coefficient calculation and determination: Calculate the abnormal weight coefficient according to the above results : ; among them, the dynamic weight factor is calculated as follows: ; among them, is the current rotational speed, is the rated rotational speed of the device, is the weight factor of the phase deviation and the hash difference, satisfying .

[0044] The determination rule is: If : Mark it as a valid anomaly and submit it to the next step to execute the reverse control instruction injection; If : Mark it as normal or minor disturbance and do not trigger control; Special cases (such as fluctuation stable): If , it is still regarded as environmental noise to avoid misjudgment.

[0045] Mapping function is established based on the roller rotational speed and the encoder pulse period, specifically as follows: I. Define the required variables: : The timestamp (absolute time) of the th instruction; : The time (period) for the current roller to make one revolution; : The number of pulses output by the encoder per revolution : Current angular velocity of the drum : Timestamp reference point for the start of the last full rotation of the current drum (the nearest pulse time can be taken).

[0046] II. Mapping function formula: The formula for the drum phase angle is as follows: ; That is: Subtract the instruction timestamp from the current reference start time , then divide by the rotation time of one circle , to obtain the progress of the current drum in the circle (a decimal, range 0 - 1), and finally multiply by 360° to get the current angle of the drum, and take the modulus of 360° to ensure that the phase angle result is within interval.

[0047] III. Solving method for the drum period : Can be estimated from the encoder pulse interval and quantity: ; Among them, is the time interval between adjacent encoder pulses. If the sampling interval is stable, it can also be obtained by multiplying the average interval of one pulse by : ; This is inversely deduced from the reciprocal of the rotational speed value , represents the average interval time of encoder pulses, which is the average value of several pulse intervals.

[0048] IV. Encoder pulse auxiliary method (enhancing precision): Sampling based on encoder pulses, then precisely locate through the pulse number and its occurrence time .

[0049] V. ; Among them, is the encoder pulse number, is the start pulse timestamp of the current circle, is the angular displacement per unit time.

[0050] Summary of the mapping logic flowchart: 1. Collect the current rotational speed of the drum Deduce ; 2. Determine the reference time point (start point of a full circle); 3. Input the instruction timestamp ; 4. Apply the mapping function ; 5. Output phase angle .

[0051] S3 specifically includes: S31, Dynamic beat tolerance threshold calculation: Calculate the beat tolerance threshold according to the safety level of the current work order and the real-time rotation speed of the printing cylinder : ; Among them, is the reference threshold of the beat anomaly weight calibrated by the equipment manufacturer (the unit consistency is the same , and the value is 1), represents the speed compensation factor, , among which, is the real-time cylinder rotation speed; is the rated cylinder rotation speed, represents the safety level coefficient, which is defined according to the work order type as: .

[0052] S32, Resting gap determination and instruction suspension control: Continuously monitor the cylinder phase angle , when the following conditions are met: , it is determined as an injectable window, and the abnormal control instruction is suspended and sent at the last stage of entering this interval.

[0053] S33, Reverse balance instruction parameter calculation: When the abnormal weight coefficient in S2 , extract: Phase deviation value , Hash difference value , Current pressure value and the current rotation speed ; And calculate the following two control parameters: (1)Pressure compensation amount : , among which, is the circumference of the printing cylinder.

[0054] (2)Speed correction amount : ; Among them, ln is the natural logarithm function (smoothly adjust the speed); Limiting condition: ; represents the rated pressure value of the equipment.

[0055] S34, Reverse balance instruction injection control: Package and into a control instruction packet: Instruction packet ​CMD_REV , checksum ; and send it to the printing device controller within the last 5 ms time window of the currently detected rest gap: The instruction packet is sent only within the window period to ensure no interference with the printing cycle; Lock the injection requests of the same type of instructions within the next 3 cycles after injection to prevent cumulative overcompensation.

[0056] The present invention further includes a terminal device, including a processor and a memory, the processor is coupled to the memory, and the processor is configured to execute a computer program stored in the memory to perform the above security monitoring method.

[0057] The present invention also includes a medium, including a computer program or instruction, when the computer program or instruction runs on a computer, the above security monitoring method is performed.

[0058] The present invention covers any alternatives, modifications, equivalent methods, and solutions made within the spirit and scope of the present invention. To enable the public to have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, and those skilled in the art can fully understand the present invention without the description of these details. In addition, well-known methods, processes, procedures, components, and circuits are not described in detail to avoid unnecessary confusion to the essence of the present invention.

[0059] The above is only the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. A method for secure monitoring of data streams, characterized in that, Including the following steps: S1: Synchronously collect the data stream of the printing device and the signals of the physical state sensors, and cut the data stream into beat-synchronized data blocks according to the rotation period of the printing cylinder. Each data block is bound with the device pressure value and rotation speed value within the corresponding period; S2: Perform double verification on the beat-synchronized data blocks. First, verify the deviation value between the timestamp of the instruction sequence within the data block and the rotation phase of the cylinder, and then verify the correlation degree difference between the hash chain of the encrypted data payload and the device pressure value to generate an anomaly weight coefficient; S3: When the anomaly weight coefficient exceeds the beat tolerance threshold, delay until the rest gap at the end of the current printing cycle, and inject a reverse balance instruction into the printing device controller. The parameter value of the reverse balance instruction is calculated based on the deviation value and dynamic correlation degree in S2.

2. The security monitoring method for a data stream according to claim 1, characterized in that The specific content of S1 includes: S11: Generate a pulse signal through the photoelectric encoder installed on the main shaft of the printing cylinder, use the pulse rising edge as the synchronous trigger signal, and obtain the network packets in the buffer area of the data stream acquisition card and the analog signals of the pressure sensors in real time; S12: According to the number of pulses N included in the preset printing cycle, use the continuous N pulse intervals as the time window to cut the data stream to form beat-synchronized data blocks; S13: At the end of each time window, extract the arithmetic mean of the pressure sensor signal waveform within the time window as the device pressure value, extract the reciprocal of the encoder pulse interval as the rotation speed value, and create a metadata area at the head of the beat-synchronized data block to store the pressure value, rotation speed value, and the corresponding cylinder phase angle.

3. The security monitoring method for a data stream according to claim 2, characterized in that, The number of pulses N is calculated as: N = P × C; where P represents the number of encoder pulses generated by one rotation of the cylinder, and C represents the number of printing colors set in the current work order. The beat synchronization window is automatically adjusted according to the work order configuration.

4. The security monitoring method for a data stream according to claim 2, characterized in that, The S2 includes parsing the instruction sequence in the beat synchronization data block, extracting the time stamp of each instruction, establishing a time stamp-phase mapping table according to the drum phase angle in the metadata area, and calculating the maximum deviation value between the real-time phase angle corresponding to each instruction time stamp and the metadata record phase angle .

5. A security monitoring method for a data stream according to claim 4, characterized in that, The S2 further includes performing a hashing operation on the encrypted data payload according to a preset chunking rule to generate a current hash chain ; Query the pre-stored pressure-hash mapping table based on the device pressure value to obtain the theoretical hash chain , calculate the hash correlation degree difference value .

6. The security monitoring method for a data stream according to claim 5, characterized in that, The abnormal weight coefficient is calculated as follows: ; where is the abnormal weight coefficient, are the weight factors of the phase deviation and the hash difference respectively, satisfying , is the hash chain correlation degree difference value; The determination rule is: If : Marked as a valid exception and submitted to the next step to execute the reverse balance control instruction injection; If : Marked as normal or slightly disturbed, without triggering control.

7. A method for secure monitoring of a data stream according to claim 6, characterized in that, The specific content of S3 includes: S31: Calculate the beat tolerance threshold T according to the safety level coefficient corresponding to the current work order type and the real-time rotation speed of the printing cylinder; S32: Monitor the change of the phase angle of the printing cylinder. When the phase angle enters the preset threshold interval, it is determined as the rest gap trigger window, and the blocking instruction queue is suspended within the window period; S33. When K≥T, extract the and in step S2, and calculate the reverse balance instruction parameters, including the pressure compensation amount and the rotational speed correction amount; S34: Package the pressure compensation amount and rotation speed correction amount into a reverse balance instruction, and send it to the device controller within the last time window of the rest gap trigger window, and lock the injection of the same instruction within the subsequent 3 cycles.

8. A method for secure monitoring of data streams according to claim 7, characterized in that, The beat tolerance threshold is calculated as: ; where is the calibrated beat anomaly weight reference threshold, represents the safety level coefficient, defined according to the work order type, represents the rotational speed compensation factor, , is the real-time drum rotational speed; is the rated drum rotational speed.

9. A terminal device, characterized in that, It includes a processor and a memory, and the processor is coupled with the memory; the processor is used to execute the computer program stored in the memory to execute the safety monitoring method according to any one of claims 1 to 8.

10. A medium, characterized in that, It includes a computer program or instruction. When the computer program or instruction runs on a computer, it executes the safety monitoring method according to any one of claims 1 to 8.

Images