Security and protection remote monitoring system based on industrial internet

Abstract

The invention discloses a security remote monitoring system based on an industrial internet, and relates to the technical field of remote monitoring. Acquiring a monitoring level regional network corresponding to the industrial site through an acquisition frequency adjusting unit, and acquiring a current acquisition frequency corresponding to the monitoring level regional network; acquiring equipment data corresponding to the industrial site in real time according to the current acquisition frequency; identifying the equipment data through an abnormal data identification pool constructed by a data identification module to obtain an identification result; generating a log file corresponding to the equipment according to the identification result; the identification result is layered through a layered transmission mechanism set by the data distribution module to obtain corresponding layered data; and finally, receiving and managing the hierarchical data through the management module. And the remote security monitoring speed is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of remote monitoring, and specifically to a security remote monitoring system based on the industrial Internet. Background Art

[0002] Existing industrial security systems mostly adopt local deployment solutions and rely on traditional network protocols for remote data transmission, which have significant technical bottlenecks. First, the collection of device data is usually carried out by sensors according to the collection period, but the collection period is usually fixed and unchanged, and there is a possibility of missed reports for devices that often have abnormalities. Second, during the data transmission process, especially in complex network environments or when the transmission distance is far, there may be a delay phenomenon. Multi-source data is usually directly transmitted to the monitoring terminal through the transmission protocol, resulting in emergencies not being received in a timely manner. Therefore, in order to solve the above technical problems, the present invention provides a security remote monitoring system based on the industrial Internet; Summary of the Invention

[0003] In order to solve the above technical problems, the present invention provides a security remote monitoring system based on the industrial Internet; The object of the present invention can be achieved through the following technical solutions: A security remote monitoring system based on the industrial Internet, the system includes a security data collection module, a data identification module, a visualization module, a data shunt module, and a management module; The security data collection module is provided with a collection frequency adjustment unit and a real-time collection unit; the collection frequency adjustment unit is used to obtain the monitoring level area network corresponding to the industrial site and obtain the current collection frequency corresponding to the monitoring level area network; the real-time collection unit is used to collect the device data corresponding to the industrial site in real time according to the current collection frequency; The data identification module constructs an abnormal data identification pool, and identifies the device data through the abnormal data identification pool to obtain an identification result; The visualization module is used to generate a log file corresponding to the device from the identification result; The data shunt module is provided with a hierarchical transmission mechanism, and obtains corresponding hierarchical data by layering the identification result according to the hierarchical transmission mechanism; The management module is used to receive the hierarchical data and manage it.

[0004] Further, the process by which the collection frequency adjustment unit obtains the monitoring level area network corresponding to the industrial site includes: Set the acquisition period T, collect multi-source historical data of corresponding devices at each acquisition period in the industrial field based on big data, and number the devices, denoted as i, where i = 1, 2, .., m, and m is a positive integer; connect the device numbers with the corresponding multi-source historical data to generate a device multi-source historical database; Obtain the historical abnormal quantity of historical abnormal device data in each device multi-source historical database; generate an abnormal quantity change data set corresponding to the device number based on the historical abnormal quantity in the acquisition period corresponding to the device number; pass through Obtain the abnormal frequency f of the device number corresponding to the abnormal quantity change data set i ; where, Q ij表示 The historical abnormal quantity corresponding to device number i in the jth acquisition period, and j = 1, 2, ..., n, where n is a positive integer; Set the threshold range corresponding to the risk monitoring level, and the risk monitoring level includes a high-risk monitoring level, a medium-risk monitoring level, and a low-risk monitoring level; compare the abnormal frequency with the threshold range to obtain the risk monitoring level corresponding to the device; Generate device nodes for the devices, and connect the device nodes with the same risk monitoring level to form a monitoring level area network.

[0005] Further, the process of obtaining the current acquisition frequency corresponding to the monitoring level area network includes: Pass through Obtain the current acquisition frequency f of the multi-modal sensor nodes deployed corresponding to the monitoring level area network L , where L represents the risk monitoring level corresponding to the monitoring level area network; Represents the adjustment coefficient; R represents the number of device nodes corresponding to the monitoring level area network, f 原 Represents the same original acquisition frequency corresponding to the multi-modal sensor nodes.

[0006] Further, the process of the real-time acquisition unit collecting device data corresponding to the industrial field according to the current acquisition frequency includes: Align and connect the collected device data with the acquisition time point to generate a device data chain for each device data.

[0007] Further, the process of the data recognition module recognizing the device data to obtain the recognition result includes: The abnormal data recognition pool is divided into a first recognition pool, a second recognition pool, and a third recognition pool according to the risk monitoring level; all data types corresponding to the device data are obtained, and a type instruction corresponding to the data type is set; furthermore, a corresponding abnormal threshold range is set according to the data type; the type instruction and the abnormal threshold range are connected to generate an abnormal data instruction data chain, and all the abnormal data instruction data chains are merged to generate an abnormal data instruction data set, which is wirelessly communicatively connected to the abnormal data recognition pool; Obtain the data types of the device data corresponding to the monitoring level area network, mark them as the data types to be monitored, and send them to the abnormal data recognition pool corresponding to the risk monitoring level of the monitoring level area network; send a type instruction to the abnormal data instruction data set according to the data types to be monitored, and schedule the corresponding abnormal data instruction data chain to be sent to the corresponding abnormal data recognition pool; Identify the device data corresponding to the abnormal data recognition pool with the corresponding abnormal threshold range to obtain a recognition result, where the recognition result includes abnormal device data, normal device data, and device data to be confirmed; and mark the abnormal device data as emergency warning data.

[0008] Furthermore, the process by which the visualization module generates a log file corresponding to the device according to the recognition result includes: Set a log generation period, and obtain the historical device data of each device according to the log generation period; and generate a device data change curve corresponding to the data type in the log generation period based on the acquisition time points of the device data chains corresponding to the devices; obtain the device numbers corresponding to the emergency warning data and connect them with the corresponding device data chains to generate an emergency device data chain; furthermore, generate a log file corresponding to the device from the device data change curve and the emergency device data chain.

[0009] Furthermore, the process by which the data shunt module obtains corresponding stratified data by stratifying the recognition result includes: Set a real-time type, where the real-time type includes emergency warning data, time-limited data, and periodic data; The time-limited data includes normal device data and device data to be confirmed; the periodic data includes historical device data and log files; Set a transmission level layer; the transmission level layer includes a first-level transmission layer, a second-level transmission layer, and a third-level transmission layer; connect the real-time type with the transmission level through a protocol to generate a stratified transmission mechanism; the stratified transmission mechanism includes that the emergency warning data is transmitted through the first-level transmission layer, the time-limited data is transmitted through the second-level transmission layer, and the periodic data is transmitted through the third-level transmission layer; Obtain stratified data of corresponding first-level data, second-level data, and third-level data through the first-level transmission layer, the second-level transmission layer, and the third-level transmission layer corresponding to the stratified transmission mechanism.

[0010] Further, the process of the management module receiving and managing hierarchical data includes: The management module sets up level management terminals; the level management terminals include a first-level management terminal, a second-level management terminal, a third-level management terminal, and a fourth-level management terminal; Send the first-level data, second-level data, and third-level data corresponding to the hierarchical data to the first-level management terminal, second-level management terminal, and third-level management terminal respectively for management.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: The monitoring level area network corresponding to the industrial site is obtained through the acquisition frequency adjustment unit, and the current acquisition frequency corresponding to the monitoring level area network is obtained; the device data corresponding to the industrial site is collected in real time according to the current acquisition frequency; the device data is identified through the abnormal data identification pool constructed by the data identification module to obtain the identification result; the identification result is generated into a log file corresponding to the device; furthermore, the hierarchical transmission mechanism set by the data shunting module is used to perform layering on the identification result to obtain the corresponding hierarchical data; finally, the management module receives the hierarchical data and performs management; effectively improving the speed of security remote monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required to be used in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0013] Figure 1 It is the schematic diagram of the system of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0014] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts belong to the scope of protection of the present invention.

[0015] As Figure 1 shown, a security remote monitoring system based on the industrial Internet, the system includes a security data acquisition module, a data identification module, a visualization module, a data shunting module, and a management module; The security data acquisition module is provided with an acquisition frequency adjustment unit and a real-time acquisition unit; the acquisition frequency adjustment unit is used to obtain the monitoring level area network corresponding to the industrial site and obtain the current acquisition frequency corresponding to the monitoring level area network; the real-time acquisition unit is used to collect the device data corresponding to the industrial site in real time according to the current acquisition frequency; The data identification module constructs an abnormal data identification pool, and identifies the device data through the abnormal data identification pool to obtain an identification result; The visualization module is used to generate a log file corresponding to the device from the identification result; The data shunting module is provided with a hierarchical transmission mechanism, and obtains corresponding hierarchical data by layering the identification result according to the hierarchical transmission mechanism; The management module is used to receive the hierarchical data and manage it.

[0016] It should be further noted that the acquisition frequency adjustment unit deploys multi-modal sensor nodes at the industrial site and obtains the current acquisition frequency corresponding to the multi-modal sensor nodes; including: Set the acquisition period T, collect multi-source historical data of the corresponding devices at the industrial site in each acquisition period based on big data, and number the devices, denoted as i, i = 1, 2,.., m, and m is a positive integer; connect the device number with the corresponding multi-source historical data to generate a device multi-source historical database; Obtain the historical abnormal quantity of historical abnormal device data in each device multi-source historical database; generate an abnormal quantity change data set corresponding to the device number based on the historical abnormal quantity in the acquisition period corresponding to the device number; through Obtain the abnormal frequency f of the device number corresponding to the abnormal quantity change data set i ; where Q ij表示 The historical abnormal quantity corresponding to the device number i in the jth acquisition period, and j = 1, 2,..., n, n is a positive integer; Set the threshold range corresponding to the risk monitoring level, and the risk monitoring level includes a high-risk monitoring level, a medium-risk monitoring level, and a low-risk monitoring level; compare the abnormal frequency with the threshold range to obtain the risk monitoring level corresponding to the device; Generate device nodes for the devices, and connect the device nodes with the same risk monitoring level to generate a monitoring level area network; Through Obtain the current acquisition frequency f of the multi-modal sensor nodes deployed corresponding to the monitoring level area network L , where L represents the risk monitoring level corresponding to the monitoring level area network; Represents the adjustment coefficient; R represents the number of device nodes corresponding to the monitoring level area network, f 原It is expressed that the multi-modal sensor nodes correspond to the same original acquisition frequency; In the above embodiments, it should be further noted that in the prior art, the acquisition frequency set by the acquisition sensor is usually used for acquisition, without considering the influence of the change of the abnormal frequency of the device on the acquisition frequency. Therefore, in order to accurately acquire the device data, it is necessary to adjust the acquisition frequency to ensure the acquisition accuracy; It should be further noted that the real-time acquisition unit acquires the device data corresponding to the industrial site in real time according to the current acquisition frequency; including: Align and connect the acquired device data with the acquisition time point to generate a device data chain for each device data.

[0017] It should be further noted that the data recognition module constructs an abnormal data recognition pool, and recognizes the device data through the abnormal data recognition pool to obtain a recognition result; including: Divide the abnormal data recognition pool into a first recognition pool, a second recognition pool and a third recognition pool according to the risk monitoring level; obtain all data types corresponding to the device data, and set type instructions corresponding to the data types; furthermore, set corresponding abnormal threshold ranges according to the data types; connect the type instructions and the abnormal threshold ranges to generate an abnormal data instruction data chain, and merge all abnormal data instruction data chains to generate an abnormal data instruction data set, and perform a wireless communication connection with the abnormal data recognition pool; Obtain the data types of the device data corresponding to the monitoring level area network, mark them as the data types to be monitored, and send them to the abnormal data recognition pool corresponding to the risk monitoring level of the monitoring level area network; send type instructions to the abnormal data instruction data set according to the data types to be monitored, and schedule the corresponding abnormal data instruction data chain to be sent to the corresponding abnormal data recognition pool; Recognize the device data corresponding to the abnormal data recognition pool with the corresponding abnormal threshold range to obtain a recognition result, where the recognition result includes abnormal device data, normal device data and device data to be confirmed; and mark the abnormal device data as emergency warning data; In the above embodiments, it should be further noted that classifying and monitoring the device data of different monitoring level area networks can improve the monitoring efficiency.

[0018] It should be further noted that the visualization module generates a log file corresponding to the device according to the recognition result; including: Set the log generation period, and obtain the historical device data of each device according to the log generation period; and generate a device data change curve corresponding to the data type in the log generation period based on the acquisition time points of the device data chains corresponding to the devices; obtain the device numbers corresponding to the emergency warning data and connect them with the corresponding device data chains to generate an emergency device data chain; and then generate a log file corresponding to the device based on the device data change curve and the emergency device data chain. It should be further noted that the data shunting module is provided with a hierarchical transmission mechanism, and obtains corresponding hierarchical data by layering the recognition results according to the hierarchical transmission mechanism; including: Set the real-time types, and the real-time types include emergency warning data, time-limited data, and periodic data; The time-limited data includes normal device data and device data to be confirmed; the periodic data includes historical device data and log files; Set a transmission level layer; the transmission level layer includes a first-level transmission layer, a second-level transmission layer, and a third-level transmission layer; connect the real-time types with the transmission levels through protocols to generate a hierarchical transmission mechanism; the hierarchical transmission mechanism includes that the emergency warning data is transmitted through the first-level transmission layer, the time-limited data is transmitted through the second-level transmission layer, and the periodic data is transmitted through the third-level transmission layer; Obtain hierarchical data of corresponding first-layer data, second-layer data, and third-layer data through the first-level transmission layer, the second-level transmission layer, and the third-level transmission layer corresponding to the hierarchical transmission mechanism; In the above embodiment, it should be further noted that by hierarchically transmitting the device data through the hierarchical transmission mechanism, the efficiency of data transmission can be improved, and the loss rate of device data can be reduced.

[0019] It should be further noted that the management module receives the hierarchical data and manages it; including: The management module sets up level management terminals; the level management terminals include a first-level management terminal, a second-level management terminal, a third-level management terminal, and a fourth-level management terminal; Send the first-layer data, second-layer data, and third-layer data corresponding to the hierarchical data to the first-level management terminal, the second-level management terminal, and the third-level management terminal respectively; The first-level management terminal receives the first-layer data, and then obtains the acquisition time points and device numbers of the device data chains corresponding to the emergency warning data, and regulates the abnormal device data according to the device numbers; The second-level management terminal receives the second-layer data, and then eliminates the normal device data, obtains the acquisition time points and device numbers of the device data chains corresponding to the device data to be confirmed, and confirms the abnormal device data according to the device numbers; The three - level management terminal receives the three - layer data and then stores the historical device data and log files; The first - level management terminal receives the first - layer data, and then obtains the collection time point and device number of the device data chain corresponding to the emergency warning data, and controls the abnormal device data according to the device number; The second - level management terminal receives the second - layer data, then eliminates the normal device data, obtains the collection time point and device number of the device data chain corresponding to the device data to be confirmed, and confirms the abnormal device data according to the device number; The three - level management terminal receives the three - layer data and then stores the historical device data and log files.

[0020] The features and exemplary embodiments of various aspects of the present application will be described in detail below. To make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail with reference to the accompanying drawings and specific embodiments; it should be understood that the specific embodiments described here are only intended to explain the present application, rather than limiting the present application; for those skilled in the art, the present application can be implemented without some of these specific details; the above description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application.

[0021] The above embodiments are only used to illustrate the technical method of the present invention and not to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical method of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical method of the present invention.

Claims

1. An industrial Internet-based security remote monitoring system, characterized in that, The system includes a security data collection module, a data identification module, a visualization module, a data shunt module, and a management module; The security data collection module is provided with a collection frequency adjustment unit and a real-time collection unit; the collection frequency adjustment unit is used to obtain the monitoring level area network corresponding to the industrial site and obtain the current collection frequency corresponding to the monitoring level area network; the real-time collection unit is used to collect the device data corresponding to the industrial site in real time according to the current collection frequency; The data identification module constructs an abnormal data identification pool, and identifies the device data through the abnormal data identification pool to obtain an identification result; The visualization module is used to generate a log file corresponding to the device from the identification result; The data shunt module is provided with a hierarchical transmission mechanism, and obtains corresponding hierarchical data by layering the identification result according to the hierarchical transmission mechanism; The management module is used to receive the hierarchical data and manage it.

2. The security remote monitoring system based on industrial Internet according to claim 1, wherein The process by which the collection frequency adjustment unit obtains the monitoring level area network corresponding to the industrial site includes: Set the collection period T, collect the multi-source historical data of the corresponding devices at each collection period in the industrial site based on big data, and number the devices, denoted as i, i = 1, 2,.., m, and m takes positive integer values; connect the device number with the corresponding multi-source historical data to generate a device multi-source historical database; Obtain the historical abnormal quantity of historical abnormal device data in the multi-source historical databases of each device; generate an abnormal quantity change data set corresponding to the device number from the historical abnormal quantity of the collection period corresponding to the device number; pass through Obtain the abnormal frequency f of the device number corresponding to the abnormal quantity change data set i ; where Q ij表示 is the historical abnormal quantity corresponding to the device number i in the jth collection period, and j = 1, 2,..., n, and n takes positive integers; Set the threshold range corresponding to the risk monitoring level, and the risk monitoring level includes a high-risk monitoring level, a medium-risk monitoring level, and a low-risk monitoring level; compare the abnormal frequency with the threshold range to obtain the risk monitoring level corresponding to the device; Generate device nodes for the devices, and connect the device nodes with the same risk monitoring level to generate a monitoring level area network.

3. An industrial Internet-based security remote monitoring system according to claim 2, characterized in that, The process of obtaining the current collection frequency corresponding to the monitoring level area network includes: By obtaining the current acquisition frequency f of the multimodal sensor nodes corresponding to the network deployment of the monitored level area L , where L represents the risk monitoring level corresponding to the network of the monitored level area; represents the adjustment coefficient; R represents the number of device nodes corresponding to the network of the monitored level area, and f 原 represents the same original acquisition frequency corresponding to the multimodal sensor nodes.

4. An industrial Internet-based security remote monitoring system according to claim 3, characterized in that, The process by which the real-time collection unit collects the device data corresponding to the industrial site in real time according to the current collection frequency includes: Align and connect the collected device data with the collection time point to generate a device data chain for each device data.

5. An industrial Internet-based security remote monitoring system according to claim 4, characterized in that, The process by which the data identification module identifies the device data to obtain an identification result includes: Divide the abnormal data identification pool into a first identification pool, a second identification pool, and a third identification pool according to the risk monitoring level; obtain all data types corresponding to the device data, and set the type instructions corresponding to the data types; further set the corresponding abnormal threshold range according to the data type; connect the type instructions and the abnormal threshold range to generate an abnormal data instruction data chain, and merge all the abnormal data instruction data chains to generate an abnormal data instruction data set, and perform a wireless communication connection with the abnormal data identification pool; Obtain the data types of the device data corresponding to the monitoring level area network, mark them as the data types to be monitored, and send them to the abnormal data identification pool corresponding to the risk monitoring level of the monitoring level area network; send type instructions to the abnormal data instruction data set according to the data types to be monitored, and schedule the corresponding abnormal data instruction data chains to be sent to the corresponding abnormal data identification pools; Identify the device data corresponding to the abnormal data recognition pool with the corresponding abnormal threshold range to obtain the recognition result, where the recognition result includes abnormal device data, normal device data, and device data to be confirmed; and mark the abnormal device data as emergency warning data.

6. An industrial Internet-based security remote monitoring system according to claim 5, characterized in that, The process by which the visualization module generates a log file corresponding to the device according to the recognition result includes: Set the log generation period, and obtain the historical device data of each device according to the log generation period; and generate a device data change curve corresponding to the data type in the log generation period based on the acquisition time points of the device data chain of the device; obtain the device number corresponding to the emergency warning data and connect it with the corresponding device data chain to generate an emergency device data chain; and then generate a log file corresponding to the device from the device data change curve and the emergency device data chain.

7. The security remote monitoring system based on industrial Internet according to claim 6, characterized in that, The process by which the data shunting module obtains the corresponding hierarchical data by layering the recognition result includes: Set the real-time type, where the real-time type includes emergency warning data, time-limited data, and periodic data; The time-limited data includes normal device data and device data to be confirmed; the periodic data includes historical device data and log files; Set the transmission level layer; the transmission level layer includes a first-level transmission layer, a second-level transmission layer, and a third-level transmission layer; connect the real-time type with the transmission level through a protocol to generate a hierarchical transmission mechanism; the hierarchical transmission mechanism includes that the emergency warning data is transmitted through the first-level transmission layer, the time-limited data is transmitted through the second-level transmission layer, and the periodic data is transmitted through the third-level transmission layer; Obtain the hierarchical data of the corresponding first-level data, second-level data, and third-level data through the first-level transmission layer, second-level transmission layer, and third-level transmission layer corresponding to the hierarchical transmission mechanism.

8. An industrial Internet-based security remote monitoring system according to claim 7, characterized in that, The process by which the management module receives and manages the hierarchical data includes: The management module sets up a hierarchical management terminal; the hierarchical management terminal includes a first-level management terminal, a second-level management terminal, a third-level management terminal, and a fourth-level management terminal; Send the corresponding first-level data, second-level data, and third-level data of the hierarchical data to the first-level management terminal, second-level management terminal, and third-level management terminal for management respectively.

Images