A data flow security monitoring method, device and medium

Abstract

The present invention relates to the field of data monitoring technology, and more specifically to a data stream security monitoring method, device, and medium, comprising the following steps: synchronously collecting a printing device's data stream and physical status sensor signals, cutting the data stream into beat-synchronized data blocks based on the printing cylinder's rotation cycle; performing double verification on the beat-synchronized data blocks to generate an anomaly weight coefficient; and when the anomaly weight coefficient exceeds the beat tolerance threshold, delaying the injection of a reverse balancing instruction into the printing device controller until the rest interval at the end of the current printing cycle, wherein the parameter value of the reverse balancing instruction is calculated and generated based on a deviation value and a dynamic correlation degree. The present invention constructs a multi-closed-loop protection mechanism for data-physical-control, thereby improving the overall abnormal response speed and control smoothness, and avoiding false alarms, overcompensation, or chain interference problems.

Description

Technical Field

[0001] The present invention relates to the field of data monitoring technology, and in particular to a method, device and medium for securely monitoring data streams. Background Art

[0002] With the development of intelligent and networked printing equipment, the coordinated consistency between the data flow and physical operating status involved in the printing control system has become the key to ensuring production safety and data integrity. However, existing industrial control systems generally use a synchronization method based on software timestamps, which associates network data messages with sensor signals through a logical timeline for subsequent data verification and anomaly detection. However, this method has multiple technical bottlenecks in high-frequency mechanical systems:

[0003] First, timestamp synchronization accuracy is insufficient. Due to software-level sampling delays and operating system scheduling offsets, the synchronization error between network data and physical states often reaches several milliseconds, making it difficult to effectively detect sub-beat abnormal behaviors (such as tiny time drift attacks) in high-speed printing equipment.

[0004] Secondly, anomaly detection models lack physical constraint relevance. Existing solutions typically rely solely on data content hashing or instruction logic sequence comparison to identify anomalies. These solutions fail to fully utilize physical characteristics such as pressure fluctuations and speed changes during device operation. This results in low detection rates and increased false positives when faced with complex security threats such as forged instructions, physical simulation attacks, or man-in-the-middle attacks.

[0005] Furthermore, control intervention methods are overly rigid. When the system identifies an anomaly, it often uses a direct shutdown or reset protection mechanism, failing to intelligently inject control commands into the printing equipment's structural operating rules (such as the roller paper receiving / paper removal interval cycle). This can disrupt normal production rhythms and even cause system overloads or paper waste. Summary of the Invention

[0006] The present invention provides a data flow security monitoring method, equipment and medium, which integrates the data flow, physical state and control logic of the printing equipment into a trinity, and has a security monitoring method with high-precision synchronization, high-robust recognition and low-interference response characteristics to meet the security control needs of the new generation of intelligent printing manufacturing.

[0007] A data flow security monitoring method comprises the following steps:

[0008] S1: Synchronously collect the data stream and physical status sensor signals of the printing equipment, cut the data stream into beat synchronization data blocks according to the rotation cycle of the printing cylinder, and bind each data block to the equipment pressure value and speed value within the corresponding cycle;

[0009] S2: Double-verify the beat synchronization data block. First, verify the deviation between the timestamp of the instruction sequence in the data block and the drum rotation phase. Then, verify the correlation difference between the hash chain of the encrypted data payload and the device pressure value to generate an abnormal weight coefficient.

[0010] S3: When the abnormal weight coefficient exceeds the beat tolerance threshold, the reverse balance instruction is injected into the printing device controller after a delay until the rest interval at the end of the current printing cycle. The parameter value of the reverse balance instruction is calculated and generated based on the deviation value and dynamic correlation in S2.

[0011] Optionally, the S1 specifically includes:

[0012] S11: Generate a pulse signal through the photoelectric encoder installed on the main shaft of the printing cylinder, use the rising edge of the pulse as the synchronous trigger signal, and obtain the network message in the buffer area of ​​the data stream acquisition card and the analog signal of the pressure sensor in real time;

[0013] S12: According to the preset number of pulses N included in the printing cycle, the N consecutive pulse intervals are used as time windows to cut the data stream into beat synchronization data blocks;

[0014] S13: At the end of each time window, the arithmetic mean of the pressure sensor signal waveform within the time window is extracted as the device pressure value, the inverse of the encoder pulse interval is extracted as the speed value, and a metadata area is created at the head of the beat synchronization data block to store the pressure value, speed value and corresponding roller phase angle.

[0015] Optionally, the pulse number N is calculated as: N=P×C; wherein P represents the number of encoder pulses generated by one rotation of the drum, and C represents the number of printing colors set for the current work order, and the beat synchronization window is automatically adjusted according to the work order configuration.

[0016] Metadata area structure design:

[0017] Pressure value :4 bytes (float);

[0018] Speed ​​value byte(float);

[0019] Phase Angle :2 bytes (uint16, angle accuracy is about 0.01°);

[0020] Check code: 2 bytes (used for integrity check, such as CRC16).

[0021] Optionally, the S2 includes parsing the instruction sequence in the beat synchronization data block, extracting the timestamp of each instruction, establishing a timestamp-phase mapping table based on the drum phase angle in the metadata area, and calculating the maximum deviation value between the real-time phase angle corresponding to each instruction timestamp and the metadata recorded phase angle. .

[0022] Optionally, the S2 further includes performing a hash operation on the encrypted data payload according to a preset block rule to generate the current hash chain ; Based on the device pressure value, query the pre-stored pressure-hash mapping table to obtain the theoretical hash chain , calculate the hash association difference value .

[0023] Optionally, the abnormal weight coefficient is calculated as: ;in, is the abnormal weight coefficient, are the weight factors of phase deviation and hash difference, respectively, satisfying , is the difference value of the hash chain association degree;

[0024] The judgment rules are:

[0025] like : Mark as a valid exception and submit to the next step to execute reverse balance control instruction injection;

[0026] like : Marked as normal or slight disturbance, no control is triggered.

[0027] Mapping Function It is established based on the drum speed and encoder pulse period, as follows:

[0028] 1. Define the required variables:

[0029] : No. Timestamp of the instruction (absolute time);

[0030] : The time (period) for the current drum to rotate one circle;

[0031] : The number of pulses output by the encoder per revolution;

[0032] : Current roller angular velocity;

[0033] : The timestamp reference point of the most recent full rotation of the current roller (the most recent pulse time can be taken).

[0034] 2. Mapping function formula:

[0035] The formula for the drum phase angle is as follows: ;

[0036] That is: the instruction timestamp With the current reference start time Subtract and divide by the rotation time of one circle , get the progress of the current roller circle (a decimal, range 0-1), and finally multiply it by 360° to get the current angle of the roller, and take the modulus of 360° to ensure that the phase angle result is within Within the range.

[0037] 3. Drum cycle Solution: It can be estimated from the encoder pulse interval and number:

[0038] ;in, The time interval between adjacent encoder pulses. If the sampling interval is stable, the average interval of a pulse can also be multiplied by It turns out that: ;this By speed value The inverse of is deduced, Indicates the average interval time of encoder pulses, which is the average of several pulse intervals.

[0039] 4. Encoder pulse auxiliary mode (enhanced accuracy): based on the encoder pulse sampling, the pulse number and the time it happened Precise positioning.

[0040] five, ;in, is the encoder pulse number, is the starting pulse timestamp of the current circle, is the angular displacement per unit time.

[0041] Summarize the mapping logic flow chart:

[0042] 1. Collect the current drum speed Derivation ;

[0043] 2. Determine the reference time point (Starting point of the full circle);

[0044] 3. Input command timestamp ;

[0045] 4. Apply the mapping function ;

[0046] 5. Output phase angle .

[0047] Optionally, S3 specifically includes:

[0048] S31, dynamic beat tolerance threshold calculation: calculate the beat tolerance threshold based on the safety level of the current work order and the real-time speed of the printing cylinder : ;in, The reference threshold value of the beat abnormality weight calibrated by the equipment manufacturer (the unit consistency is the same as , value 1), represents the speed compensation factor, ,in, is the real-time drum speed; is the rated drum speed, Indicates the safety level coefficient, which is defined according to the work order type:

[0049] .

[0050] S32, rest gap determination and command suspension control continuously monitors the drum phase angle , when satisfying:

[0051] When it is determined to be an injection window, the abnormal control instruction is suspended and sent when entering the final stage of the interval.

[0052] S33, reverse balance instruction parameter calculation: when the abnormal weight coefficient in S2 When extracting:

[0053] Phase deviation value , hash difference value , current pressure value and the current speed ;

[0054] And calculate the following two control parameters:

[0055] (1) Pressure compensation : ,in, is the circumference of the printing cylinder.

[0056] (2) Speed ​​correction : ; Among them, ln is a natural logarithmic function (smoothly adjust the speed);

[0057] Restrictions: ; Indicates the rated pressure value of the equipment.

[0058] S34, reverse balance instruction injection control: and Encapsulated as a control instruction packet:

[0059] Instruction Packet CMD_REV , check code ; and sent to the printing device controller within the last 5ms time window of the currently detected pause:

[0060] The command packet is only sent within the window period to ensure no interference with the printing cycle;

[0061] After injection, the same type of instruction injection requests in the following three cycles are locked to prevent cumulative overcompensation.

[0062] A terminal device includes a processor and a memory, wherein the processor and the memory are coupled; the processor is used to execute a computer program stored in the memory to perform the above-mentioned security monitoring method.

[0063] A medium includes a computer program or instruction. When the computer program or instruction is run on a computer, the above-mentioned security monitoring method is executed.

[0064] Beneficial effects of the present invention:

[0065] The present invention introduces a hardware-level trigger mechanism based on photoelectric encoder pulses, cuts the data stream into beat-synchronized data blocks, and structurally binds each block of data with the real-time drum speed, pressure value, and phase angle, thereby solving the millisecond-level error accumulation problem existing in traditional software timestamp methods. Combined with the dynamic calculation logic of the number of pulses per drum rotation and the number of printed colors, it supports adaptive data alignment and reconstruction in multi-work order scenarios, ensuring that the phase difference calculation in subsequent double verification has high time accuracy, and providing accurate positioning basis for micro-disturbance-level anomalies (such as timestamp drift or pressure simulation tampering).

[0066] This invention combines the instruction timestamp, the roller phase angle difference, and the pressure-driven hash chain variance to form an anomaly weight factor. It also dynamically calculates a tolerance threshold based on the current speed and work order security level, enabling differentiated, conditional judgment of data tampering. By mapping physical parameters (such as pressure and speed) to the encryption structure (hash chain), it effectively identifies "simulated physical attacks" that conventional hash collisions cannot protect against. Furthermore, an adaptive weight allocation strategy (focusing on phase deviation at high speeds and hash deviation at high pressures) improves adaptability and robustness in complex operating scenarios.

[0067] This method limits the injection of reverse balancing instructions to the rest gap window of 180°~355° of the roller phase angle, and completes the control signal injection within the last 5ms of the window, effectively avoiding the conflict between the equipment load change and the printing task. At the same time, the reverse instruction parameters are calculated by the abnormal characteristics Δθ and D drive, with a clear physical compensation meaning. Combined with the three-cycle instruction locking mechanism, a multi-closed-loop protection mechanism of data-physics-control is constructed, thereby improving the overall abnormal response speed and control smoothness, and avoiding false alarms, overcompensation or chain interference problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0069] Figure 1 A flow chart of a monitoring method according to an embodiment of the present invention;

[0070] Figure 2 Schematic diagram of abnormal weight coefficient calculation and determination according to an embodiment of the present invention. DETAILED DESCRIPTION

[0071] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. Those skilled in the art may also implement some known technologies in other alternative ways. The accompanying drawings are only for describing the embodiments in more detail and are not intended to limit the present invention in any specific way.

[0072] like Figure 1-Figure 2 As shown, a data flow security monitoring method includes the following steps:

[0073] S1: Synchronously collect the data stream and physical status sensor signals of the printing equipment, cut the data stream into beat synchronization data blocks according to the rotation cycle of the printing cylinder, and bind each data block to the equipment pressure value and speed value within the corresponding cycle;

[0074] S2: Double-verify the beat synchronization data block. First, verify the deviation between the timestamp of the instruction sequence in the data block and the drum rotation phase. Then, verify the correlation difference between the hash chain of the encrypted data payload and the device pressure value to generate an abnormal weight coefficient.

[0075] S3: When the abnormal weight coefficient exceeds the beat tolerance threshold, the reverse balance instruction is injected into the printing equipment controller after a delay until the rest interval at the end of the current printing cycle. The parameter value of the reverse balance instruction is generated based on the deviation value and dynamic correlation calculation in S2.

[0076] S1 specifically includes:

[0077] S11, a photoelectric encoder installed on the main shaft of the printing cylinder generates a pulse signal, and the rising edge of the pulse is used as a synchronous trigger signal to obtain real-time:

[0078] Network messages in the buffer area of ​​the data stream acquisition card;

[0079] The analog signal output by the pressure sensor.

[0080] This synchronization mechanism ensures that the acquisition moment is strictly aligned with the actual physical phase of the printing cylinder.

[0081] S12, setting the number of encoder pulses included in the printing cycle to N, and cutting the data stream with the intervals of N consecutive pulses as the time window to form beat synchronization data blocks.

[0082] N=P×C; P represents the number of encoder pulses generated by one rotation of the drum, and C represents the number of printing colors set for the current work order. The beat synchronization window is automatically adjusted according to the work order configuration to avoid manual setting errors.

[0083] S13, at the end of each time window, extract the physical quantity of the device within the window:

[0084] S131, equipment pressure value : Take the arithmetic mean of the pressure sensor signal waveform:

[0085] ;in, Indicates the total number of pressure sampling points collected in the current time window. Indicates the The pressure value of each sampling point;

[0086] S132, equipment speed value : Estimated by the inverse of the interval between adjacent encoder pulses: ;in, Represents the time interval between any two adjacent pulses;

[0087] S133, drum phase angle : Calculated by the position of the current pulse number in the total number of pulses in a circle:

[0088] ;in, is the serial number of the current pulse in a circle (starting from 0), The number of pulses corresponding to one rotation of the drum.

[0089] Metadata area structure design:

[0090] Pressure value :4 bytes (float);

[0091] Speed ​​value byte(float);

[0092] Phase Angle :2 bytes (uint16, angle accuracy is about 0.01°);

[0093] Check code: 2 bytes (used for integrity check, such as CRC16).

[0094] S2 specifically includes:

[0095] S21, instruction timestamp-phase deviation verification parses all instruction sequences in the beat synchronization data block and extracts the timestamp of each instruction , according to the drum phase angle recorded in the metadata area , establish a timestamp-phase mapping table. Through the mapping function: , calculate the timestamps Corresponding real-time phase angle , and get the deviation: ;in, Indicates the The real-time phase angle of the instruction, Indicates the drum reference phase angle recorded in the beat data block, Represents the conversion function that maps timestamps to phase angles.

[0096] If the current device pressure value Exceeding the rated value , then the angle tolerance is automatically expanded:

[0097] .

[0098] S22, hash chain consistency and pressure mapping verification: perform block hashing on the encrypted payload of the current beat data block to generate the current hash chain value :

[0099] ;

[0100] in, Indicates the last two digits of the hash value of the previous data block. is the pressure value of this block, The current encrypted data payload content, represents a cryptographic hash function such as SHA-256, Indicates hash string concatenation; query by table lookup Corresponding theoretical hash value , calculate the bit-level difference: ;in, express and The same number of digits in a binary string, is the total number of hash bits (256), is the hash chain association difference value, ranging from [0,1], and the larger the value, the more obvious the difference.

[0101] S23, calculation and determination of abnormal weight coefficient:

[0102] Calculate the abnormal weight coefficient based on the above results : ; The dynamic weight factor is calculated as follows: ;in, is the current speed, is the rated speed of the equipment, is the weight factor of phase deviation and hash difference, satisfying .

[0103] The judgment rules are:

[0104] like : Mark as a valid exception and submit to the next step to perform reverse control instruction injection;

[0105] like : Marked as normal or slight disturbance, no control is triggered;

[0106] Special circumstances (such as fluctuation Stable): If , it is still regarded as environmental noise to avoid misjudgment.

[0107] Mapping Function It is established based on the drum speed and encoder pulse period, as follows:

[0108] 1. Define the required variables:

[0109] : No. Timestamp of the instruction (absolute time);

[0110] : The time (period) for the current drum to rotate one circle;

[0111] : The number of pulses output by the encoder per revolution;

[0112] : Current roller angular velocity;

[0113] : The timestamp reference point of the most recent full rotation of the current roller (the most recent pulse time can be taken).

[0114] 2. Mapping function formula:

[0115] The formula for the drum phase angle is as follows: ;

[0116] That is: the instruction timestamp With the current reference start time Subtract and divide by the rotation time of one circle , get the progress of the current roller circle (a decimal, range 0-1), and finally multiply it by 360° to get the current angle of the roller, and take the modulus of 360° to ensure that the phase angle result is within Within the range.

[0117] 3. Drum cycle Solution: It can be estimated from the encoder pulse interval and number:

[0118] ;in, The time interval between adjacent encoder pulses. If the sampling interval is stable, the average interval of a pulse can also be multiplied by It turns out that: ;this By speed value The inverse of is deduced, Indicates the average interval time of encoder pulses, which is the average of several pulse intervals.

[0119] 4. Encoder pulse auxiliary mode (enhanced accuracy): based on the encoder pulse sampling, the pulse number and the time it happened Precise positioning.

[0120] five, ;in, is the encoder pulse number, is the starting pulse timestamp of the current circle, is the angular displacement per unit time.

[0121] Summarize the mapping logic flow chart:

[0122] 1. Collect the current drum speed Derivation ;

[0123] 2. Determine the reference time point (Starting point of the full circle);

[0124] 3. Input command timestamp ;

[0125] 4. Apply the mapping function ;

[0126] 5. Output phase angle .

[0127] S3 specifically includes:

[0128] S31, dynamic beat tolerance threshold calculation: calculate the beat tolerance threshold based on the safety level of the current work order and the real-time speed of the printing cylinder : ;in, The reference threshold value of the beat abnormality weight calibrated by the equipment manufacturer (the unit consistency is the same as , value 1), represents the speed compensation factor, ,in, is the real-time drum speed; is the rated drum speed, Indicates the safety level coefficient, which is defined according to the work order type:

[0129] .

[0130] S32, rest gap determination and command suspension control continuously monitors the drum phase angle , when satisfying:

[0131] When it is determined to be an injection window, the abnormal control instruction is suspended and sent when entering the final stage of the interval.

[0132] S33, reverse balance instruction parameter calculation: when the abnormal weight coefficient in S2 When extracting:

[0133] Phase deviation value , hash difference value , current pressure value and the current speed ;

[0134] And calculate the following two control parameters:

[0135] (1) Pressure compensation : ,in, is the circumference of the printing cylinder.

[0136] (2) Speed ​​correction : ; Among them, ln is a natural logarithmic function (smoothly adjust the speed);

[0137] Restrictions: ; Indicates the rated pressure value of the equipment.

[0138] S34, reverse balance instruction injection control: and Encapsulated as a control instruction packet:

[0139] Instruction Packet CMD_REV , check code ; and sent to the printing device controller within the last 5ms time window of the currently detected pause:

[0140] The command packet is only sent within the window period to ensure no interference with the printing cycle;

[0141] After injection, the same type of instruction injection requests in the following three cycles are locked to prevent cumulative overcompensation.

[0142] The present invention further includes a terminal device, including a processor and a memory, wherein the processor is coupled to the memory, and the processor is used to execute a computer program stored in the memory to perform the above security monitoring method.

[0143] The present invention also includes a medium including a computer program or instructions, which executes the above security monitoring method when the computer program or instructions are run on a computer.

[0144] The present invention encompasses any alternatives, modifications, equivalents, and solutions that fall within the spirit and scope of the present invention. To provide a thorough understanding of the present invention, specific details are described in detail below in connection with the preferred embodiments of the present invention, but those skilled in the art will be able to fully understand the present invention without these detailed descriptions. Furthermore, to avoid unnecessary confusion regarding the essence of the present invention, well-known methods, processes, procedures, components, and circuits have not been described in detail.

[0145] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A data flow security monitoring method, characterized in that: The following steps are involved: S1: Synchronously collects the data stream and physical status sensor signals of the printing equipment, cuts the data stream into beat-synchronized data blocks according to the rotation cycle of the printing cylinder, and binds each data block to the equipment pressure value and speed value within the corresponding cycle; S1 specifically includes: S11: Generate a pulse signal through the photoelectric encoder installed on the main shaft of the printing cylinder, use the rising edge of the pulse as the synchronous trigger signal, and obtain the network message in the buffer area of ​​the data stream acquisition card and the analog signal of the pressure sensor in real time; S12: According to the preset number of pulses N included in the printing cycle, the N consecutive pulse intervals are used as time windows to cut the data stream into beat synchronization data blocks; S13: At the end of each time window, the arithmetic mean of the pressure sensor signal waveform within the time window is extracted as the device pressure value, the inverse of the encoder pulse interval is extracted as the speed value, and a metadata area is created at the head of the beat synchronization data block to store the pressure value, speed value and corresponding roller phase angle; S2: Double-verify the beat synchronization data block. First, verify the deviation between the timestamp of the instruction sequence in the data block and the drum rotation phase. Then, verify the correlation difference between the hash chain of the encrypted data payload and the device pressure value to generate an abnormal weight coefficient. The S2 includes parsing the instruction sequence in the beat synchronization data block, extracting the timestamp of each instruction, establishing a timestamp-phase mapping table according to the drum phase angle in the metadata area, and calculating the maximum deviation value between the real-time phase angle corresponding to each instruction timestamp and the metadata recorded phase angle. ; The S2 also includes performing a hash operation on the encrypted data payload according to a preset block rule to generate the current hash chain. ; Based on the device pressure value, query the pre-stored pressure-hash mapping table to obtain the theoretical hash chain , calculate the hash association difference value ; S3: When the abnormal weight coefficient exceeds the beat tolerance threshold, the reverse balance instruction is injected into the printing device controller after a delay until the rest interval at the end of the current printing cycle. The parameter value of the reverse balance instruction is calculated and generated based on the deviation value and dynamic correlation in S2.

2. A data flow security monitoring method according to claim 1, characterized in that: The pulse number N is calculated as: N=P×C; where P represents the number of encoder pulses generated by one rotation of the drum, and C represents the number of printing colors set in the current work order. The beat synchronization window is automatically adjusted according to the work order configuration.

3. The data flow security monitoring method according to claim 1, characterized in that: The anomaly weight coefficient is calculated as: ;in, is the abnormal weight coefficient, are the weight factors of phase deviation and hash difference, respectively, satisfying , is the difference value of the hash chain association degree; The judgment rules are: like : Mark as a valid exception and submit to the next step to execute reverse balance control instruction injection; like : Marked as normal or slight disturbance, no control is triggered.

4. A data stream security monitoring method according to claim 3, characterized in that: The S3 specifically includes: S31, calculating the beat tolerance threshold T based on the safety level coefficient corresponding to the current work order type and the real-time speed of the printing cylinder; S32, monitoring the phase angle change of the printing cylinder, determining that a rest gap triggers a window when the phase angle enters a preset threshold range, and suspending the blocking instruction queue during the window period; S33, when K≥T, extract the and , calculate the reverse balance instruction parameters, including pressure compensation and speed correction; S34, encapsulate the pressure compensation amount and the speed correction amount into a reverse balance instruction, send it to the device controller within the last time window of the rest interval trigger window, and lock the same instruction injection in the subsequent three cycles.

5. A data stream security monitoring method according to claim 4, characterized in that: The beat tolerance threshold Calculated as: ;in, is the reference threshold value of the calibrated beat abnormality weight, Indicates the safety level coefficient, defined according to the work order type. represents the speed compensation factor, , is the real-time drum speed; is the rated drum speed.

6. A terminal device, characterized in that: The system comprises a processor and a memory, wherein the processor is coupled to the memory; the processor is used to execute a computer program stored in the memory to execute the security monitoring method according to any one of claims 1 to 5.

7. A medium, characterized in that The method comprises a computer program or an instruction, which, when run on a computer, executes the security monitoring method according to any one of claims 1 to 5.

Images