An intrusion protection method and system of a warehouse logistics automatic sorting system

Abstract

The application provides an intrusion protection method and system for a warehouse logistics automatic sorting system. By obtaining sensor data, network traffic logs and device operating status in the system, a multi-dimensional feature extraction algorithm is used to decompose and obtain feature combination patterns of intrusion behaviors. For these patterns, the application uses a preset threshold to judge abnormalities, and uses clustering algorithms to identify physical intrusion and network intrusion respectively. Combined with historical data, the application evaluates the severity of the threat and generates a set of targeted defense rules. Through a fusion algorithm, physical and network protection measures are integrated to form a unified hierarchical response execution plan. The application can also monitor the system status in real time, dynamically adjust the defense strategy, and continuously optimize the intrusion protection model through machine learning. The application can effectively deal with intrusion threats in complex scenarios and improve the security and reliability of the warehouse logistics automatic sorting system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to an intrusion protection method and system for a warehouse logistics automatic sorting system. BACKGROUND

[0002] The research field of warehouse logistics automatic sorting system plays a crucial role in modern supply chain management, which is directly related to the improvement of logistics efficiency, the reduction of cost and the enhancement of enterprise competitiveness. With the rapid development of e-commerce and globalization trade, automation technology has become the core driving force to promote the intelligentization of warehouse logistics. However, this field is not without challenges, especially in ensuring the security and stable operation of the system, the identification and prevention of intrusion behavior become a key link that cannot be ignored.

[0003] Currently, many solutions still have significant limitations in intrusion detection and prevention. Traditional methods often rely too much on single-dimensional feature analysis, such as only focusing on abnormal behavior or network traffic data at the physical layer, which is difficult to fully capture the diversity and concealment of complex intrusion behaviors. In addition, most systems lack flexible hierarchical response capabilities when dealing with intrusions, resulting in low efficiency in handling different types of threats, and even may affect normal operation due to overreaction or insufficient reaction.

[0004] In-depth, the core challenges in this field mainly focus on two technical factors: one is how to achieve accurate decomposition and identification of intrusion behavior based on multi-dimensional feature analysis, and the other is how to effectively integrate the protection mechanisms of physical intrusion and network intrusion. The first factor is not solved, which makes it difficult for the system to decompose the intrusion behavior into identifiable combination patterns, thereby affecting the accuracy and real-time of detection; the lack of the second factor makes the prevention measures fragmented when facing complex threats, making it difficult to form a coordinated defense effect. These two technical problems interweave each other, further exacerbating the vulnerability of the system in complex scenarios.

[0005] Therefore, how to accurately decompose the combination pattern of intrusion behavior through multi-dimensional feature analysis in the warehouse logistics automatic sorting system, and on this basis, build a hierarchical response mechanism to seamlessly integrate the protection of physical intrusion and network intrusion, has become a key problem to be solved. SUMMARY

[0006] To solve the technical problems raised in the background art, the first aspect of the present application provides an intrusion protection method for a warehouse logistics automatic sorting system, the method comprising

[0007] S1, obtaining sensor data, network traffic logs and device running status in the warehouse logistics automatic sorting system, using a multi-dimensional feature extraction algorithm to decompose the data, and obtaining a feature combination pattern of intrusion behavior;

[0008] S2, judging whether there is an anomaly by a feature threshold value for the feature combination mode, and if the anomaly value exceeds the feature threshold value, determining as a potential intrusion behavior, and generating a preliminary intrusion behavior classification table;

[0009] S3, extracting physical layer anomaly features and network layer anomaly features from the preliminary intrusion behavior classification table, grouping the two types of features by using a clustering algorithm, and obtaining independent mode sets of physical intrusion and network intrusion;

[0010] S4, obtaining a matching degree of historical intrusion data and a current mode according to the independent mode sets, judging a hierarchical severity of an intrusion type by similarity calculation, and generating a hierarchical threat evaluation table;

[0011] S5, matching physical intrusion and network intrusion protection measures by a response strategy library established in advance for the hierarchical threat evaluation table, and obtaining a targeted defense rule set;

[0012] S6, integrating physical intrusion protection measures and network intrusion protection measures by a fusion algorithm according to the defense rule set, and generating a unified hierarchical response execution scheme;

[0013] S7, monitoring a system running state in real time by the hierarchical response execution scheme, adjusting response scheme parameters if a composite threat is detected, and obtaining an optimized defense execution sequence;

[0014] S8, obtaining system feedback data according to the optimized defense execution sequence, judging an execution effect of a defense measure by an anomaly detection algorithm, and generating a dynamic update table of intrusion prevention and control;

[0015] S9, iteratively training a feature decomposition model and a response strategy library by a machine learning algorithm for the dynamic update table, and obtaining an intrusion prevention enhancement model adapted to a complex scenario.

[0016] Optionally, the step S1, obtaining sensor data, network traffic logs and device running states in a warehouse logistics automatic sorting system, decomposing data by a multi-dimensional feature extraction algorithm, and obtaining a feature combination mode of an intrusion behavior, including:

[0017] Step S11, obtaining sensor data, network traffic and device states, decomposing data by a common feature extraction method such as Fourier transform or wavelet transform, and obtaining a preliminary feature set;

[0018] Step S12, processing sensor data and network traffic by a principal component analysis algorithm for the preliminary feature set, and obtaining a dimension-reduced feature matrix;

[0019] Step S13, from the reduced feature matrix, use a statistical-based outlier detection method to extract the anomaly points of intrusion behavior, judge whether the anomaly points exceed the anomaly threshold, and determine the potential intrusion features;

[0020] Step S14, group the potential intrusion features by clustering analysis algorithm to obtain the combined mode of intrusion behavior;

[0021] Step S15, according to the matching of the combined mode and the device state, use cosine similarity to calculate the matching degree, if the matching degree is lower than the set value, mark it as an abnormal behavior mode;

[0022] Step S16, compare the abnormal behavior mode with the log record, use a rule-based log matching method to judge the abnormal source in network traffic, and obtain the specific distribution of intrusion behavior;

[0023] Step S17, by associating the distribution of intrusion behavior with the system running state, use time series-based correlation analysis to determine the abnormal link in the automatic sorting system.

[0024] Optionally, in step S2, for the feature combination mode, determine whether there is an anomaly by a feature threshold, if the anomaly value exceeds the feature threshold, determine it as a potential intrusion behavior, and generate a preliminary intrusion behavior classification table, including:

[0025] Step S21, obtain the mode analysis result from the feature combination, use K-means clustering algorithm to divide the data into several clusters, and extract the points farthest from the cluster center as anomaly values;

[0026] Step S22, compare the anomaly value with the feature threshold, if the anomaly value exceeds the feature threshold, mark it as a feature threshold exceeding;

[0027] Step S23, for the data exceeding the feature threshold, match it through the pre-established rule base to confirm whether there is a potential intrusion behavior;

[0028] Step S24, use the decision tree algorithm to generate a preliminary classification table by taking the matched potential intrusion behavior data as input, and clearly define the corresponding relationship between different feature combinations and intrusion behaviors;

[0029] Step S25, according to the preliminary classification table, statistic the correlation between feature combinations and intrusion behaviors, and update the feature threshold;

[0030] Step S26, use the updated feature threshold to analyze the mode of new data, extract anomaly values and judge whether they meet the intrusion behavior characteristics.

[0031] Optionally, the step S3 extracts the physical layer abnormal features and the network layer abnormal features from the preliminary intrusion behavior classification table, adopts a clustering algorithm to group the two types of features, and obtains independent mode sets of the physical intrusion and the network intrusion, including:

[0032] The step S31 obtains the physical layer abnormality and the network layer abnormality from a pre-established classification table, the classification table is constructed based on historical data and contains abnormal labels of the physical layer and the network layer;

[0033] The step S32 separates the physical layer abnormal features and the network layer abnormal features from the obtained abnormal features by adopting principal component analysis, and obtains independent feature sets;

[0034] The step S33 inputs the independent feature sets into a K-means clustering tool for grouping processing, sets the clustering number to 2, and obtains a physical intrusion mode set and a network intrusion mode set;

[0035] The step S34 determines independent modes by using a support vector machine tool to perform boundary division if there is an overlapping mode in the physical intrusion mode set;

[0036] The step S35 determines independent modes by using a kernel density estimation tool according to distribution characteristics if there is a cross mode in the network intrusion mode set;

[0037] The step S36 obtains independent mode feature distributions of the physical intrusion and the network intrusion according to the mode sets after grouping processing, and inputs a histogram tool to count the feature distributions;

[0038] The step S37 compares the independent mode feature distributions with the intrusion behaviors, calculates the matching degree by using a cosine similarity tool, and judges the matching relationship between the abnormal features and the intrusion modes.

[0039] Optionally, the step S4 obtains the matching degree of the historical intrusion data and the current mode according to the independent mode set, judges the hierarchical severity of the intrusion type by similarity calculation, generates a hierarchical threat evaluation table, including:

[0040] The step S41 extracts mode features from the historical data by the independent mode set, and calculates the matching degree of the historical data and the current mode by using a cosine similarity;

[0041] The step S42 determines high matching according to a matching threshold if the similarity value exceeds the matching threshold, and obtains a preliminary intrusion type set;

[0042] The step S43 groups the intrusion types by using a K-means algorithm for the preliminary intrusion type set;

[0043] The step S44 determines the initial clustering center by random selection, and sets the iteration number to 100 times;

[0044] Step S45, calculate the Euclidean distance of each data point to the cluster center, assign the data point to the nearest cluster center, update the cluster center, repeat the above steps until the cluster center no longer changes or the number of iterations is reached;

[0045] Step S46, obtain the threat distribution characteristics between types according to the severity level distribution, judge the hierarchical boundary of the intrusion type by calculating the Euclidean distance between the cluster centers, and obtain the hierarchical intrusion type set;

[0046] Step S47, in the hierarchical intrusion type set, obtain the mean value of the similarity value of each intrusion type, and determine the central tendency of the threat distribution;

[0047] Step S48, match the central tendency with the pre-established evaluation table template, and generate a hierarchical threat evaluation table using the table filling tool of Excel;

[0048] Step S49, copy the central tendency data to the evaluation table template, and generate a hierarchical threat evaluation table using the automatic filling function of Excel;

[0049] Step S410, extract the boundary features of the threat distribution from the final output, and judge the dynamic change trend of the potential intrusion type by comparing the boundary features with the current mode.

[0050] Optionally, for the hierarchical threat evaluation table, the step S5 matches the protection measures for physical intrusion and network intrusion with the pre-established response strategy library to obtain a set of targeted defense rules, including:

[0051] Step S51, obtain an initial strategy set from the pre-established response strategy library, and compare the strategy set with the hierarchical evaluation results in the threat evaluation table, if the protection measures in the strategy set are consistent with the protection requirements of the corresponding level in the threat evaluation table, then determine the protection measures for physical intrusion and network intrusion;

[0052] Step S52, extract the feature data of physical intrusion and network intrusion from the hierarchical evaluation results of the threat evaluation table, use the feature extraction tool to process the data, input the processed feature data into the Drools rule engine, and use the pre-defined rule template to match to obtain the corresponding protection measure set;

[0053] Step S53, perform attribute analysis on the protection measure set, extract the common attributes of physical intrusion features and network intrusion features, and if there are overlapping attributes, use a logical judgment tool to generate targeted defense rules;

[0054] Step S54, obtain a preliminary set of defense rules, optimize the rule set using a genetic algorithm, set the optimization goal as the coverage and execution efficiency of the rule set, and obtain a simplified defense rule set through iterative optimization;

[0055] Step S55, match the simplified defense rule set with the hierarchical evaluation results in the threat evaluation table, verify the applicability of each rule using the evaluation table matching tool, and if the rule set matches the hierarchical evaluation in the threat evaluation table, determine the final defense rule set;

[0056] Step S56, according to the final defense rule set, analyze the historical data using the SPSS tool, set the priority threshold of the rule execution priority, and sort the rules based on the priority threshold to obtain a hierarchical protection scheme;

[0057] Step S57, extract the execution sequence from the hierarchical protection scheme, convert the execution sequence into an automated deployment instruction set using a serialization tool, and complete the deployment of the protection measures.

[0058] Optionally, according to the defense rule set, the step S6 integrates the physical intrusion protection measures and the network intrusion protection measures using a fusion algorithm to generate a unified hierarchical response execution scheme, including:

[0059] Step S61, obtain protection measure data from physical intrusion and network intrusion, and fuse the data using a weighted average method to generate a preliminary protection set;

[0060] Step S62, use a logistic regression algorithm to classify the preliminary protection set with the preliminary protection set as input, and output the intrusion detection result;

[0061] Step S63, according to the pre-established defense rule library, judge the intrusion detection result, if the intrusion detection result exceeds the intrusion threshold, enter the hierarchical processing flow;

[0062] Step S64, use fuzzy comprehensive evaluation method to classify the intrusion detection result, and determine the unified classification standard;

[0063] Step S65, according to the unified classification standard, generate a response execution sequence using a priority sorting algorithm;

[0064] Step S66, use the support vector machine algorithm to judge the correlation strength of physical intrusion and network intrusion by taking the feature vector in the execution sequence as input, and output the optimized weight value;

[0065] Step S67, according to the optimized weight value, integrate the protection measures using a weighted average method to generate a final hierarchical response execution scheme.

[0066] Optionally, the step S7, through the hierarchical response execution scheme, the system running state is monitored in real time, if the composite threat influence is detected, the response scheme parameter is adjusted, and the optimized defense execution sequence is obtained, including:

[0067] Step S71, the system running data is classified by the preset rule, the state change characteristics are obtained, and the preliminary monitoring result is obtained;

[0068] Step S72, if the state change characteristics exceed the state threshold, the feature vector is extracted from the state change characteristics, the random forest algorithm is used for classifying the feature vector, and the threat interference range is determined;

[0069] Step S73, according to the threat interference range, the parameter value in the response scheme is adjusted, the optimized response configuration is generated, and the adjusted parameter set is obtained;

[0070] Step S74, the rule set of the defense strategy is constructed by using the adjusted parameter set, the support vector machine algorithm is used for evaluating the rule set, and the feasible sequence set is obtained;

[0071] Step S75, the feasible sequence set is implemented in real time, the dynamic change trend in the execution process is extracted from the monitoring log, and the sequence execution state is obtained;

[0072] Step S76, if the sequence execution state shows abnormal, the related log is extracted from the historical data, the threat interference source is compared and analyzed, the abnormal correction scheme is obtained, and the corrected execution sequence is obtained;

[0073] Step S77, according to the corrected execution sequence, the system running configuration is updated, the configuration is periodically verified by using the cycle detection mechanism, and the final running state is obtained.

[0074] Optionally, the step S9, for the dynamic update table, the feature decomposition model and the response strategy library are iteratively trained by using the machine learning algorithm, and the intrusion protection enhancement model suitable for complex scenes is obtained, including:

[0075] Step S91, after the data table content is obtained from the dynamic update table, the PCA tool is used for dimension reduction of the data table, and the preliminary feature set is extracted;

[0076] Step S92, based on the preliminary feature set, the importance score of each feature is calculated by using the random forest algorithm, the features with scores higher than the optimization threshold are reserved, and the optimized feature set is generated;

[0077] Step S93, according to the optimized feature set, the response strategy model is trained by using the logistic regression algorithm, and the strategy update set is generated;

[0078] Step S94, based on the policy update set, using the K-means clustering algorithm to analyze the clustering of complex scenes, divide the scene categories and calculate the adaptability parameters of each category;

[0079] Step S95, apply the adaptability parameters to the weight adjustment of the intrusion protection rule, generate a protection enhancement set;

[0080] Step S96, calculate the performance indicators of the protection enhancement set, if the indicator value is higher than the model performance threshold, determine the final model;

[0081] Step S97, extract the scene adaptability from the final model, complete the construction of the intrusion protection enhancement model.

[0082] The second aspect of the application provides an intrusion protection system of a warehouse logistics automatic sorting system, which adopts the method described above for intrusion protection, and the system comprises:

[0083] The data acquisition module is used for acquiring sensor data, network traffic logs and device running states in the warehouse logistics automatic sorting system, decomposing the data by using a multi-dimensional feature extraction algorithm, and obtaining a feature combination mode of intrusion behavior;

[0084] The anomaly detection module is used for judging whether there is an anomaly by a feature threshold value for the feature combination mode, and if the anomaly value exceeds the feature threshold value, determining it as a potential intrusion behavior and generating a preliminary intrusion behavior classification table;

[0085] The feature extraction module is used for extracting physical layer anomaly features and network layer anomaly features from the preliminary intrusion behavior classification table, grouping the two types of features by using a clustering algorithm, and obtaining an independent mode set of physical intrusion and network intrusion;

[0086] The threat assessment module is used for obtaining a matching degree of historical intrusion data and a current mode according to the independent mode set, judging the hierarchical severity of the intrusion type by similarity calculation, and generating a hierarchical threat assessment table;

[0087] The response strategy module is used for matching physical intrusion and network intrusion protection measures by a pre-established response strategy library for the hierarchical threat assessment table, and obtaining a targeted defense rule set;

[0088] The defense integration module is used for integrating the physical intrusion protection measures and the network intrusion protection measures by a fusion algorithm according to the defense rule set, and generating a unified hierarchical response execution scheme;

[0089] The monitoring and adjusting module is used for monitoring the system running state in real time by the hierarchical response execution scheme, adjusting the response scheme parameters if a composite threat is detected, and obtaining an optimized defense execution sequence;

[0090] An effect evaluation module is configured to obtain system feedback data according to the optimized defense execution sequence, judge the execution effect of the defense measures by an anomaly detection algorithm, and generate a dynamic update table of intrusion prevention and control.

[0091] A model enhancement module is configured to iteratively train the feature decomposition model and the response strategy library by a machine learning algorithm for the dynamic update table, and obtain an intrusion protection enhancement model adapted to complex scenarios.

[0092] The application provides an intrusion protection method and system for a warehouse logistics automatic sorting system, which obtains sensor data, network traffic logs and device running states in the system, decomposes the data by a multi-dimensional feature extraction algorithm to obtain a feature combination mode of intrusion behaviors. For these modes, the application judges anomalies by a preset threshold, and identifies physical intrusion and network intrusion by a clustering algorithm. In combination with historical data, the application evaluates threat severity, generates a set of targeted defense rules, integrates physical and network protection measures by a fusion algorithm, and forms a unified hierarchical response execution scheme. The application can also monitor system states in real time, dynamically adjust defense strategies, and continuously optimize the intrusion protection model by machine learning. The application can effectively cope with intrusion threats in complex scenarios, and improve the security and reliability of the warehouse logistics automatic sorting system. BRIEF DESCRIPTION OF DRAWINGS

[0093] Figure 1 A flowchart of an intrusion protection method for a warehouse logistics automatic sorting system according to the application.

[0094] Figure 2 A structural schematic diagram of an intrusion protection system for a warehouse logistics automatic sorting system according to the application. DETAILED DESCRIPTION

[0095] In order to enable personnel in the art to better understand the technical solutions in the specification, the technical solutions in the specification will be described clearly and completely in conjunction with the drawings in the specification. Obviously, the described embodiments are only some of the embodiments of the specification, not all. Based on the embodiments in the specification, all other embodiments obtained by those of ordinary skill in the art without creative labor should be within the scope of protection of the specification.

[0096] As shown in Figure 1 The first aspect of the application provides an intrusion protection method for a warehouse logistics automatic sorting system, which specifically comprises:

[0097] S1, obtaining sensor data, network traffic logs and device running states in the warehouse logistics automatic sorting system, decomposing the data by a multi-dimensional feature extraction algorithm to obtain a feature combination mode of intrusion behaviors.

[0098] Optionally, this step also includes:

[0099] Step S11, obtain sensor data, network traffic and device status, decompose the data through common feature extraction methods such as Fourier transform or wavelet transform to obtain a preliminary feature set. Step S12, for the preliminary feature set, use principal component analysis algorithm to process sensor data and network traffic to obtain a reduced dimension feature matrix:

[0100]

[0101] Wherein, X represents the original data matrix, n represents the sample number, p represents the feature dimension, X aj represents the jth feature value of the ath sample, a = 1 … n, j = 1 … p.

[0102] Step S13, from the reduced dimension feature matrix, use statistical based outlier detection method to extract the anomaly points of intrusion behavior, judge whether the anomaly points exceed the anomaly threshold, and determine the potential intrusion features.

[0103] Step S14, group the potential intrusion features by clustering analysis algorithm to obtain the combination mode of intrusion behavior.

[0104] Step S15, according to the matching situation of combination mode and device status, use cosine similarity to calculate the matching degree, if the matching degree is lower than the set value, mark it as abnormal behavior mode.

[0105] Step S16, compare the abnormal behavior mode with the log record, use rule based log matching method to judge the abnormal source in network traffic, and obtain the specific distribution of intrusion behavior. Step S17, through the correlation between the distribution of intrusion behavior and the running state of the system, use time series based correlation analysis to determine the abnormal link in the automatic sorting system.

[0106] Specifically, after obtaining sensor data, network traffic and device status, the data can be decomposed by Fourier transform or wavelet transform.

[0107] For example, in an automatic sorting system, the sensor records the fluctuation data of the conveyor belt speed. Fourier transform can decompose these fluctuations into different frequency sine wave components, revealing periodic interference signals, such as 10 times per minute high frequency vibration, which may point to mechanical component failure. Wavelet transform is more suitable for capturing transient anomalies, such as a short traffic peak in a certain sorting task. These preliminary feature sets lay the foundation for subsequent analysis and help to extract key patterns from massive data. For the preliminary feature set, principal component analysis algorithm can be used for dimension reduction processing.

[0108] Exemplarily, it is assumed that the sensor data contains three dimensions of temperature, humidity, and flow, and the number of samples is 1000. Through principal component analysis, the three dimensions can be compressed into two principal components, retaining 90% of the information amount. The feature matrix after dimension reduction reduces redundancy, for example, temperature and humidity can be highly correlated, and after merging, the system state can be more clearly reflected. This method improves the calculation efficiency while retaining the core features, facilitating subsequent anomaly detection.

[0109] In one possible implementation, from the feature matrix after dimension reduction, a statistical outlier detection method is used to extract abnormal points.

[0110] Specifically, it is assumed that the flow feature mean of a sorting node is 50, and the standard deviation is 5. If the flow value detected at a certain time is 80, which exceeds the preset abnormal threshold of 3 times the standard deviation, it is marked as abnormal. This anomaly can correspond to network intrusion or device overload. Setting a reasonable abnormal threshold can effectively distinguish between normal fluctuations and potential threats, improving system security. Through clustering analysis algorithm, the combination mode of intrusion behavior can be obtained.

[0111] For example, abnormal points can be divided into two categories: one is a surge in flow accompanied by an increase in delay, and the other is a sudden change in sensor data but normal flow. The former can be directed to a distributed denial of service attack, and the latter can be related to sensor failure. The clustering result clearly shows the feature distribution of different intrusion types, providing a basis for subsequent matching. According to the matching of the combination mode and the device state, the cosine similarity can be used to calculate the matching degree.

[0112] In one embodiment, it is assumed that the similarity between flow and device running state in normal mode is 0.95, and if the calculation result is 0.6, which is lower than the set value of 0.8, it is marked as an abnormal behavior pattern. This method quantifies the deviation of the pattern from the expected value and accurately identifies potential risks.

[0113] It should be noted that when comparing abnormal behavior patterns with log records, a rule-based log matching method can be used.

[0114] For example, the log shows that a certain IP address frequently accesses the sorting control interface during the abnormal time period, combined with the flow peak, it can be judged that the IP is the source of intrusion. This method traces the specific distribution of anomalies, improving the accuracy of problem positioning.

[0115] Preferably, by associating the distribution of intrusion behavior with the system running state, the time series correlation analysis is used to determine the abnormal link.

[0116] It can be understood that if the flow anomaly is highly correlated with the decline in sorting efficiency in time, such as the efficiency dropping to 70% within 5 minutes after the anomaly occurs, the related link can be locked. This analysis reveals the cause and effect, which helps to quickly repair the system and reduce downtime losses.

[0117] Optionally, the step S13 extracts the anomaly points of the intrusion behavior from the feature matrix after dimension reduction using a statistical-based outlier detection method, judges whether the anomaly points exceed the anomaly threshold, determines the potential intrusion features, and further comprises:

[0118] Step S131 obtains the data after dimension reduction from the feature matrix, and uses principal component analysis to reduce the high-dimensional features to two dimensions.

[0119] Step S132 calculates the local outlier factor of each point according to the two-dimensional data after dimension reduction, and obtains a preliminary set of outlier detection.

[0120] Step S133 uses the Isolation Forest algorithm to judge whether the anomaly points exceed the anomaly threshold calculated based on three standard deviations for the preliminary set, and determines the candidate points of potential intrusion.

[0121] Step S134 compares the candidate points with the row vectors of the feature matrix, calculates the grouping features of the candidate points and normal behavior patterns using cosine similarity, and obtains a classification set of anomaly extraction.

[0122] Step S135 extracts the data points with continuous timestamps in each category according to the classification set, forms the time series data of potential intrusion, and uses the sliding window method to judge the change trend of the behavior pattern.

[0123] Step S136 extracts the time window with more than five consecutive anomaly points from the change trend as the key time window, and uses the autoregressive integrated moving average model to determine the active interval of the anomaly points.

[0124] Step S137 generates the distribution path of the intrusion behavior through the intersection of the active interval and the isolation forest detection result, and determines the abnormal link in the system.

[0125] Step S138 uses the ELK log analysis tool to match the network flow log for the distribution path, compares the access frequency of the source IP address, and obtains the specific location of the intrusion source.

[0126] Specifically, the data after dimension reduction is obtained from the feature matrix, and principal component analysis is a common dimension reduction method that can compress high-dimensional features to two-dimensional space.

[0127] For example, in a warehouse logistics automatic sorting system, sensor data may contain multi-dimensional information such as temperature, humidity, equipment vibration, etc. Through principal component analysis, the two most significant change directions in the data can be retained to form a two-dimensional coordinate point, facilitating subsequent analysis.

[0128] In one possible implementation, when calculating the local outlier factor of each point, the difference in density of each point in the two-dimensional data and its neighbors can be used to determine the anomaly.

[0129] For example, assuming that the data point of a certain sorting device shows a sudden increase in vibration frequency, while the surrounding neighbor points remain stable, the local outlier factor will significantly increase, preliminarily screening out an abnormal set.

[0130] Specifically, the isolation forest algorithm isolates abnormal points by randomly dividing the data space.

[0131] For example, in a sorting system, if the two-dimensional data point of a certain device is always isolated first in multiple random divisions, and exceeds the abnormal threshold based on three standard deviations, such as a normal range of 0 to 2, and the point reaches 6, it can be marked as a potential intrusion candidate point. This method is fast and efficient, especially suitable for high-frequency data stream scenarios.

[0132] Preferably, when comparing the candidate point with the grouping features of the normal behavior mode by cosine similarity, it can be understood as calculating the angle between vectors.

[0133] For example, the feature vector direction of a normal sorting device is concentrated, while the direction of an abnormal point deviates greatly, and the similarity may decrease from 0.9 to 0.2, thereby dividing an abnormal classification set. This comparison intuitively reflects the degree of behavior deviation.

[0134] In one embodiment, when extracting data points with continuous timestamps from the classification set, assuming that a certain abnormal category appears 8 times continuously within 10 minutes, forming a time series. The sliding window method can set 5 minutes as the window, and gradually scan to find the trend of dense distribution of abnormal points, which helps to capture the dynamic evolution of intrusion behavior.

[0135] It should be noted that the autoregressive integrated moving average model is suitable for analyzing the stationarity of time series.

[0136] For example, within the key time window, if 5 consecutive abnormal points appear at a certain link of the sorting line, such as a conveyor belt failure, the model can predict that the abnormal active interval is 15:00 to 15:20. This prediction helps to quickly locate the root cause of the problem.

[0137] For example, by intersecting the active interval with the isolation forest result, the distribution path of the intrusion behavior is generated, and it may be found that the anomalies are concentrated in a certain device at the end of the sorting line. Combined with the ELK log analysis tool matching the network traffic log, the source IP address access frequency is analyzed, such as a certain IP accessing 100 times within 5 minutes, far exceeding the normal frequency of 10 times, accurately locating the source of the intrusion. This multi-dimensional verification improves the reliability of the analysis.

[0138] It can be understood that the above method is progressive from dimension reduction to path generation, ensuring that the identification of abnormal links is both comprehensive and specific.

[0139] For example, from finding abnormal points in two-dimensional data to confirming trends in time series, and finally locating the source through logs, a complete technical chain is formed. This way effectively improves the accuracy of intrusion detection, and facilitates system administrators to quickly respond to abnormal situations.

[0140] Optionally, the step S14, grouping the potential intrusion features by a clustering analysis algorithm to obtain a combined mode of the intrusion behavior, further comprises:

[0141] Step S141, performing dimension reduction processing on the data by principal component analysis to obtain the dimension-reduced data.

[0142] Step S142, processing the dimension-reduced data using a K-means clustering algorithm to obtain a preliminary grouping result.

[0143] Step S143, according to the grouping result, calculating the density of data points in each cluster using kernel density estimation method to obtain density distribution characteristics.

[0144] Step S144, extracting inter-cluster difference features by Euclidean distance to determine significant abnormal clusters.

[0145] Step S145, for the significant abnormal clusters, obtaining corresponding time series data to judge the behavior change trend.

[0146] Step S146, according to the behavior change trend, using a sliding window method to analyze the time series, setting the window size to 10 and the step size to 5 to obtain continuous abnormal segments.

[0147] Step S147, through the continuous abnormal segments, using regular expression to match the network traffic log to determine the distribution path of the intrusion behavior.

[0148] Step S148, for the distribution path, using ELKStack to extract the source address frequency to obtain the intrusion source location.

[0149] Specifically, by performing dimension reduction processing on the data by principal component analysis, high-dimensional data can be compressed into a lower-dimensional form that is easier to analyze.

[0150] Exemplarily, in a warehouse logistics automatic sorting system, the data collected by the sensor includes multi-dimensional information such as equipment rotation speed, current intensity and environmental noise, and the principal component analysis can extract two main directions that can best reflect the data changes to form two-dimensional data points for subsequent processing. Then, the K-means clustering algorithm is used to group the data after dimension reduction. In a possible implementation, assuming that there are 1000 data points in the sorting system and the K value is set to 5, the algorithm will group them into 5 clusters according to the distance between the data points, and each cluster represents a device operation mode, such as normal operation, slight jitter or abnormal stop, etc.

[0151] Specifically, the kernel density estimation method can be used to analyze the density distribution characteristics of the data points in each cluster.

[0152] For example, the data points in a cluster are dense and the density peak is high, indicating that the equipment is running smoothly; while the density of another cluster is sparse and the distribution is flat, which may imply an abnormal state.

[0153] Preferably, when the difference characteristics between clusters are extracted by the Euclidean distance, the distance between the cluster centers can be compared. Assuming that the distance between the normal cluster center and the abnormal cluster center is 10 units, and the distance between the normal clusters is only 2 units, this significant difference can be used to screen out abnormal clusters. This method intuitively reflects the discrete degree of data distribution.

[0154] In an embodiment, after extracting time series data for a significantly abnormal cluster, the trend of behavior change can be observed.

[0155] For example, the equipment corresponding to a certain abnormal cluster has multiple short shutdowns within a day, and the timestamp shows that the abnormality is concentrated in the peak period. The sliding window method further analyzes this trend, with a window size of 10 minutes and a step size of 5 minutes.

[0156] Exemplarily, if the proportion of abnormal points in the last three windows exceeds 80%, such as 8 times of abnormality concentrated in 15 minutes, it can be marked as a continuous abnormal segment. This way helps to capture the persistence characteristics of the abnormality.

[0157] It should be noted that when matching network traffic logs by regular expressions, key information can be extracted from continuous abnormal segments.

[0158] For example, the abnormal request mode recorded in the log is "ERROR.*timeout", and the matching result shows that a certain device frequently times out. Combined with the distribution path analysis, the abnormality may propagate along the sorting line from the starting point to the end.

[0159] In an embodiment, when using ELKStack to extract the frequency of source addresses, it is found that a certain IP address accesses 50 times within 10 minutes, far exceeding the normal frequency of 5 times, indicating that it may be an intrusion source. This multi-level verification improves the accuracy of positioning.

[0160] It can be understood that the above method is progressive from dimension reduction to path analysis, ensuring the comprehensiveness of anomaly identification.

[0161] For example, after K-means clustering preliminary grouping, kernel density estimation refines the characteristics, sliding window captures dynamic trends, and finally through log analysis to lock the source. This chain analysis facilitates rapid positioning of problem sources and provides clear decision-making basis for administrators.

[0162] Preferably, if the time series shows that the abnormal trend is increasing, early warning can effectively reduce system loss.

[0163] S2, for feature combination mode, determine whether there is an anomaly by feature threshold, if the abnormal value exceeds the feature threshold, determine as potential intrusion behavior, generate a preliminary intrusion behavior classification table.

[0164] Optionally, this step further comprises:

[0165] Step S21, obtain mode analysis results from feature combination, divide data into several clusters using K-means clustering algorithm, and extract the points farthest from the cluster center as abnormal values.

[0166] Step S22, compare the abnormal value with the feature threshold, if the abnormal value exceeds the feature threshold, mark as feature threshold exceeding.

[0167] Step S23, for data exceeding the feature threshold, match through the pre-established rule base to confirm whether there is a potential intrusion behavior.

[0168] Step S24, take the matched potential intrusion behavior data as input, generate a preliminary classification table using decision tree algorithm, and clearly define the correspondence between different feature combinations and intrusion behaviors.

[0169] Step S25, according to the preliminary classification table, statistic the correlation between feature combination and intrusion behavior, update the feature threshold.

[0170] Step S26, use the updated feature threshold to analyze the new data, extract abnormal values and judge whether they meet the characteristics of intrusion behavior.

[0171] Specifically, when obtaining mode analysis results from feature combination, K-means clustering algorithm can be used to divide data into several clusters.

[0172] For example, in the warehouse logistics automatic sorting system, sensor data and network traffic logs generate a combination of multi-dimensional features including speed, traffic, delay, etc. K-means algorithm divides these data into 3 clusters, one of which represents normal operation state, and the other two clusters may contain abnormal patterns. Extract the points farthest from the cluster center as abnormal values.

[0173] Specifically, assume the flow value of a point reaches 100, while the cluster center mean is 40, which is obviously far away, which may indicate a potential problem. Such division facilitates quick locking of abnormal ranges.

[0174] In one possible implementation, the abnormal value is compared with a preset feature threshold to mark an over-standard.

[0175] Exemplarily, the preset flow threshold is 80, and if the flow value of a certain abnormal point reaches 100, it is marked as over-standard. This method intuitively distinguishes normal and abnormal through numerical comparison.

[0176] It can be understood that the selection of the feature threshold is based on historical data statistics, such as taking twice the normal value, to ensure the balance of sensitivity and false alarm rate. After marking the over-standard, the system can quickly focus on high-risk data. For data over the feature threshold, the pre-established rule library is matched to confirm the potential intrusion.

[0177] For example, the rule library defines “flow over-standard and delay surge” as an intrusion feature. Assume that the flow is 100 and the delay is increased from 5 seconds to 20 seconds, which matches the rule and points to a possible network attack. This way uses the existing knowledge base to improve the judgment efficiency.

[0178] Preferably, the rule library can be updated regularly to adapt to new threats. The matched potential intrusion behavior data is input into a decision tree algorithm to generate a preliminary classification table.

[0179] Specifically, the decision tree splits nodes according to features such as “flow peak value” and “delay change”, and finally outputs a classification result: a certain data is classified as “network intrusion”, and another data is classified as “device anomaly”.

[0180] For example, data with a flow of 100 and a delay of 20 seconds is classified as intrusion, while data with a flow of 90 and a delay of 5 seconds is classified as device problem. This classification table clearly maps the corresponding relationship between features and behaviors. According to the preliminary classification table, the correlation between feature combinations and intrusion behaviors is counted and the feature threshold is updated.

[0181] In one embodiment, analysis finds that 90% of samples with flow over 90 and delay over 15 seconds are related to intrusion, and the original feature threshold 80 is adjusted to 85. Such update makes the feature threshold closer to the actual risk distribution.

[0182] It should be noted that the statistical process can be accumulated through historical data to ensure the reliability of the results. The new data is analyzed using the updated feature threshold, and the abnormal value is extracted and the intrusion feature is judged.

[0183] For example, the flow 87 and the delay 18 seconds exceed the threshold 85 and 15 seconds in the new data, which are marked as abnormal. Further analysis of the pattern shows that it is consistent with the "network intrusion" feature in the classification table. This cyclic optimization method enhances the adaptability of the system.

[0184] In an embodiment, the new data analysis can also combine time series to reveal the regularity of abnormal occurrence, such as the peak period of intrusion every day, which provides a basis for subsequent protection.

[0185] S3, extracting physical layer abnormal features and network layer abnormal features from the preliminary intrusion behavior classification table, using clustering algorithm to group the two types of features, and obtaining independent mode sets of physical intrusion and network intrusion.

[0186] Optionally, this step further includes:

[0187] Step S31, obtaining physical layer abnormalities and network layer abnormalities from the pre-established classification table, which is based on historical data and contains abnormal labels of physical layer and network layer.

[0188] Step S32, using principal component analysis to separate the physical layer abnormal features and the network layer abnormal features from the obtained abnormal features, and obtaining independent feature sets.

[0189] Step S33, inputting the independent feature sets into the K-means clustering tool for grouping processing, setting the clustering number to 2, and obtaining the physical intrusion mode set and the network intrusion mode set.

[0190] Step S34, if there is an overlapping mode in the physical intrusion mode set, using the support vector machine tool to perform boundary division to determine the independent mode.

[0191] Step S35, if there is a cross-mode in the network intrusion mode set, using the kernel density estimation tool to determine the independent mode according to the distribution characteristics.

[0192] Step S36, according to the mode set after grouping processing, obtaining the independent mode feature distribution of physical intrusion and network intrusion, and inputting the histogram tool to count the feature distribution.

[0193] Step S37, comparing the independent mode feature distribution with the intrusion behavior, using the cosine similarity tool to calculate the matching degree, and judging the matching relationship between the abnormal features and the intrusion mode.

[0194] Optionally, the cosine similarity calculation is performed using the following formula:

[0195]

[0196] wherein V1 and V2 represent two feature vectors, V 1i and V 2iwherein x represents the feature value at the corresponding position, n represents the number of feature dimensions.

[0197] Specifically, when obtaining abnormal data from a pre-established classification table, it can be understood that the classification table is constructed based on historical data and contains abnormal labels of the physical layer and the network layer.

[0198] For example, in a warehouse logistics sorting system, historical data can record physical layer abnormalities caused by sensor failure, such as excessive equipment vibration, and network layer abnormalities caused by network traffic surge, such as data packet loss. These labels provide a basis for subsequent analysis.

[0199] In one possible implementation, when principal component analysis is used to separate abnormal features, key information can be extracted from multi-dimensional data.

[0200] Specifically, assuming that the data contains three-dimensional features of vibration amplitude, network traffic, and delay, principal component analysis separates these features into physical layer related features, such as vibration amplitude, and network layer related features, such as the combination of traffic and delay, by reducing the dimension.

[0201] For example, vibration amplitude can be separated alone, while traffic and delay form another independent feature set, which facilitates separate processing. When the independent feature sets are input into a K-means clustering tool for grouping, the number of clusters is set to 2.

[0202] For example, the physical layer feature set can include samples with vibration values of 5, 6, and 50, which are clustered into normal mode clusters, such as a mean value of about 5, and abnormal mode clusters, such as a value of 50. The network layer feature set is similar, and samples with traffic values of 40, 45, and 100 can be divided into normal and abnormal clusters. This grouping clearly distinguishes the pattern sets of physical intrusion and network intrusion. If there are overlapping patterns in the physical intrusion pattern set, a support vector machine tool can be used for boundary division.

[0203] For example, assuming that samples with vibration values of 20 and 25 are difficult to classify, a support vector machine classifies 20 as normal and 25 as abnormal by finding the optimal boundary. This method improves the independence of the patterns. For cross patterns in the network intrusion pattern set, a kernel density estimation tool can be used.

[0204] Preferably, if samples with traffic values of 80 and 90 are distributed ambiguously, kernel density estimation determines 80 as the edge of the normal mode and 90 as the start of the abnormal mode according to the peak value of data density. This distribution characteristic analysis ensures accurate division of the patterns. According to the grouped pattern sets, a histogram tool can count the feature distribution.

[0205] Specifically, the frequency of the vibration value 50 is the highest in the physical intrusion mode, and the traffic 100 appears more frequently in the network intrusion mode. This distribution intuitively shows the concentration trend of abnormal characteristics, facilitating subsequent comparison.

[0206] In an embodiment, when calculating the matching degree using the cosine similarity tool, it is assumed that the physical intrusion mode feature distribution is vibration 50, the network intrusion is traffic 100 and delay 20, and compared with the actual abnormal data such as vibration 48, traffic 105 and delay 22. If the similarity is high, it is determined to be matched. This comparison method efficiently determines the relationship between the anomaly and the intrusion mode, which helps to quickly locate the problem source.

[0207] It should be noted that the above method forms a complete analysis chain from data to mode through step-by-step separation, grouping and matching, ensuring the rigor of anomaly determination.

[0208] For example, in a warehouse sorting system, vibration anomalies may indicate equipment failure, and traffic anomalies may indicate network attacks. This clear classification provides a basis for subsequent response.

[0209] S4, according to the independent mode set, the matching degree of the historical intrusion data and the current mode is obtained, the similarity calculation is used to determine the hierarchical severity of the intrusion type, and a hierarchical threat assessment table is generated.

[0210] Optionally, this step further includes:

[0211] Step S41, mode features are extracted from historical data by the independent mode set, and the cosine similarity is used to calculate the matching degree of the historical data and the current mode.

[0212] Optionally, the cosine similarity formula is that the similarity value is equal to the dot product of the historical data vector and the current mode vector divided by the product of the modulus of the historical data vector and the modulus of the current mode vector.

[0213] Step S42, according to the matching threshold 8, if the similarity value exceeds the matching threshold, it is determined to be high matching, and a preliminary intrusion type set is obtained.

[0214] Step S43, for the preliminary intrusion type set, the K-means algorithm is used to group the intrusion types.

[0215] Step S44, the initial clustering center is determined by random selection, and the iteration number is set to 100 times.

[0216] Step S45, the Euclidean distance of each data point to the clustering center is calculated, the data points are assigned to the nearest clustering center, the clustering center is updated, and the above steps are repeated until the clustering center no longer changes or the iteration number is reached.

[0217] In step S46, the threat distribution characteristics between types are obtained according to the severity level distribution, the hierarchical boundaries of the intrusion types are determined by calculating the Euclidean distance between the cluster centers, and the hierarchical intrusion type set is obtained, wherein the Euclidean distance formula is that the Euclidean distance is equal to the square root of the sum of squares of the coordinate differences of two cluster centers.

[0218] In step S47, the average value of the similarity value of each intrusion type in the hierarchical intrusion type set is obtained, and the concentration trend of the threat distribution is determined.

[0219] In step S48, the concentration trend is matched with the pre-established evaluation table template, and the hierarchical threat evaluation table is generated using the table filling tool of Excel.

[0220] In step S49, the concentration trend data is copied into the evaluation table template, and the hierarchical threat evaluation table is generated using the automatic filling function of Excel.

[0221] In step S410, the boundary features of the threat distribution are extracted from the final output, and the dynamic change trend of the potential intrusion type is determined by comparing the boundary features with the current mode.

[0222] In one possible implementation, when extracting the mode features from the historical data, it can be understood that the existing independent mode set is used as a reference.

[0223] For example, in a warehouse logistics sorting system, the historical data records various states of the equipment during operation. When extracting features, it may be the running time of the equipment, the fluctuation range of the sensor reading or the response time of the network connection, etc. These features are represented in the form of vectors and compared with the current mode. When calculating the matching degree using the cosine similarity, the historical data vector may be running time 100, fluctuation range 10, and the current mode vector is running time 95, fluctuation range 12. The concept of dot product and module is embodied as the consistency of the direction of the vector. After calculation, the similarity value is obtained, which reflects the closeness of the two.

[0224] Specifically, if the preset matching threshold is 8, the similarity value exceeding this value is determined as high matching.

[0225] For example, the feature of a certain equipment anomaly in the historical data is fluctuation range 50, compared with the current mode fluctuation 48, the similarity value may reach 9, indicating that there may be similar anomalies, and it is preliminarily classified as an equipment intrusion type. For these preliminary type set, the K-means algorithm is used for grouping.

[0226] It can be understood that after the initial cluster center is randomly selected, the iteration process gradually classifies the data points.

[0227] For example, samples of fluctuation range 10, 12, 50 can be divided into a group of 10 and 12, and a group of 50 alone, reflecting the difference between normal and abnormal.

[0228] In an embodiment, when calculating the Euclidean distance of data points to cluster centers, assuming the centers are fluctuation 11 and 50 respectively, the distance of a sample fluctuation 15 to the two centers is calculated in turn, and it is assigned to the cluster of fluctuation 11. After 100 iterations, the centers are stable, and clear grouping is obtained.

[0229] It should be noted that the threat distribution characteristics are judged by the distance between the cluster centers to determine the classification boundary.

[0230] For example, the distance between the centers of fluctuation 11 and 50 is large, indicating that the difference in abnormality is obvious, and can be divided into two levels of slight and severe.

[0231] Preferably, the mean value of the similarity value of each type of intrusion reflects the clustering trend.

[0232] For example, the mean value of the similarity of the slight abnormal group is 8.5, and the severe group is 9.2, indicating that the severe abnormality is closer to the current pattern.

[0233] Illustratively, these mean values are filled into an Excel template, and an evaluation table is automatically generated to intuitively display the threat distribution.

[0234] In a possible implementation, the boundary feature is extracted from the final output, for example, fluctuation range 40 as the boundary between slight and severe, compared with the current pattern fluctuation 45, to judge its trend of leaning towards the severe type. This method clearly locates the threat changes.

[0235] For example, in the warehouse sorting scene, the runtime anomaly may be due to equipment aging, the fluctuation anomaly may be due to mechanical failure, and the response time anomaly may be due to network delay. Through matching and grouping, the source of the problem can be quickly distinguished. This analysis chain from feature extraction to threat evaluation forms a complete logic, which helps to adjust the response strategy in time.

[0236] It should be noted that the combination of clustering trend and boundary feature ensures the accuracy of dynamic trend judgment.

[0237] For example, if fluctuation 45 continues to rise, it may indicate a more serious potential problem. This way provides data support for system maintenance.

[0238] S5, for the classified threat evaluation table, match the protection measures of physical intrusion and network intrusion through the pre-established response strategy library, and obtain a set of targeted defense rules.

[0239] Optionally, this step further includes:

[0240] Step S51, an initial strategy set is obtained from a pre-established response strategy library, the strategy set is compared with the hierarchical evaluation results in the threat evaluation table, if the protection measures in the strategy set are consistent with the protection requirements of the corresponding level in the threat evaluation table, the protection measures for physical intrusion and network intrusion are determined. Step S52, the feature data of physical intrusion and network intrusion is extracted from the hierarchical evaluation results in the threat evaluation table, the feature extraction tool is used for standardization processing of the data, the processed feature data is input into the Drools rule engine, the pre-defined rule template is matched, and the corresponding protection measure set is obtained. Step S53, the attribute analysis is performed on the protection measure set, the common attributes of the physical intrusion features and the network intrusion features are extracted, if there are overlapping attributes, the targeted defense rules are generated by using the logical judgment tool. Step S54, the preliminary set of defense rules is obtained, the genetic algorithm is used for optimization of the rule set, the optimization target is set as the coverage rate and the execution efficiency of the rule set, and the simplified defense rule set is obtained through iterative optimization. Step S55, the simplified defense rule set is matched with the hierarchical evaluation results in the threat evaluation table, the applicability of the rules is verified by using the evaluation table matching tool, if the rule set matches the hierarchical evaluation in the threat evaluation table, the final defense rule set is determined. Step S56, according to the final defense rule set, the historical data is analyzed by using the SPSS tool, the priority threshold of the rule execution priority is set, the rules are hierarchically sorted based on the priority threshold, and the hierarchical protection scheme is obtained. Step S57, the execution sequence is extracted from the hierarchical protection scheme, the serialization tool is used to convert the execution sequence into an automatic deployment instruction set, and the deployment of the protection measures is completed.

[0241] Specifically, when the initial strategy set is obtained from the pre-established response strategy library, it can be understood that data is called from a database containing multiple plans.

[0242] For example, in a warehouse logistics sorting system, the strategy library may record the measures for dealing with device abnormalities, network delays and the like. The threat evaluation table shows that a threat is "device fluctuation abnormality, serious level", if there is a measure of "restarting the device and checking the sensor" in the strategy set and it is consistent with the serious level requirement, the protection measure for physical intrusion is preliminarily determined.

[0243] Preferably, if there is "network delay, medium level" in the threat table, and "increasing bandwidth and checking firewall" in the strategy set matches it, the network intrusion protection measure is determined. This way of comparison ensures the pertinence of the strategy.

[0244] In a possible implementation manner, after the feature data is extracted from the threat evaluation table, standardization processing is required.

[0245] For example, the physical intrusion feature can be 100 hours of device runtime, and the network intrusion feature can be 200 milliseconds of latency. The standardization tool converts them into a unified dimension, such as a range of 0 to 1. The processed data is input into the Drools rule engine, and the template can be "if the runtime is greater than 90, trigger device inspection."

[0246] Specifically, the engine outputs "check device hardware" as a protective measure after matching. This method quickly generates a set of measures through regularized logic.

[0247] For example, when performing attribute analysis on the set of protective measures, the physical intrusion feature can be "device temperature too high", and the network intrusion feature can be "high data packet loss rate". The common attribute of the two can be "system stability decline". Using a logical judgment tool, if the attribute is detected, a defense rule such as "prioritize system stability" is generated.

[0248] It should be noted that the identification of such overlapping attributes helps to integrate resources and improve defense efficiency. After obtaining the preliminary set of defense rules, a genetic algorithm optimizes the rule set.

[0249] For example, the initial rules have 10 rules, with a coverage rate of 80%, and the execution efficiency is low. After setting the optimization target, iterating 50 times, redundant rules such as "repeatedly check the device" can be eliminated, and finally a set of 6 refined rules is obtained, with the coverage rate improved to 90%.

[0250] In one embodiment, this optimization ensures the efficiency of the rule set. When the refined rule set is matched with the threat assessment table, the assessment table matching tool verifies each rule.

[0251] For example, the threat table shows "abnormal fluctuations, severe", and the rule set has "replace sensor", if the applicability is consistent, it is included in the final defense rule set. This verification process ensures the practicality of the rules. According to the final rule set, when using SPSS to analyze historical data, a priority threshold can be set.

[0252] For example, in the historical data, the success rate of "device reboot" is 95%, which exceeds the priority threshold of 90%, and has the highest priority. After sorting, the hierarchical protection scheme can be "first reboot, then check the network". This hierarchical sorting improves the orderliness of execution. After extracting the execution sequence from the hierarchical protection scheme, the serialization tool converts it into an automated deployment instruction set.

[0253] For example, "reboot device" is converted to a specific instruction "rebootdevice_A" and directly deployed to the system.

[0254] For example, such automated deployment greatly improves response speed and provides stable protection for warehouse logistics systems.

[0255] S6, according to the defense rule set, the physical intrusion protection measures and network intrusion protection measures are integrated by using a fusion algorithm to generate a unified hierarchical response execution scheme.

[0256] Optionally, this step further includes:

[0257] Step S61, defense measure data is obtained from physical intrusion and network intrusion, and a weighted average method is used to fuse the data to generate a preliminary defense set. Step S62, the preliminary defense set is used as input, and a logistic regression algorithm is used to classify it, and an intrusion detection result is output. Step S63, according to the pre-established defense rule base, the intrusion detection result is judged, if the intrusion detection result exceeds the preset intrusion threshold, the hierarchical processing flow is entered. Step S64, the fuzzy comprehensive evaluation method is used to classify the intrusion detection result, and a unified classification standard is determined. Step S65, according to the unified classification standard, a priority sorting algorithm is used to generate a response execution sequence. Step S66, the feature vector in the execution sequence is used as input, and a support vector machine algorithm is used to judge the correlation strength of physical intrusion and network intrusion, and an optimized weight value is output. Step S67, according to the optimized weight value, a weighted average method is used to integrate the defense measures to generate a final hierarchical response execution scheme.

[0258] Specifically, when obtaining defense measure data from physical intrusion and network intrusion, it can be understood as collecting relevant information from the actual scene.

[0259] For example, in an enterprise security system, physical intrusion data may include the number of times the access control is pried, the number of times the camera captures abnormal movement, etc., and network intrusion data may be abnormal traffic in the firewall log or the number of login failures. When these data are fused by using the weighted average method, weights can be assigned according to the importance of the threat source, such as 0.4 for physical intrusion and 0.6 for network intrusion, to generate a preliminary defense set. The advantage of this method is that it can integrate multi-dimensional data to form a more comprehensive defense foundation.

[0260] In one possible implementation, when the preliminary defense set is input into the logistic regression algorithm for classification, it is assumed that the set contains 100 data, of which 70 are marked as normal and 30 are marked as abnormal. The logistic regression will judge the intrusion possibility of each data based on features such as "intrusion frequency" and "time distribution", and output the detection result. The advantage of this classification method is that it can quickly distinguish potential threats for subsequent processing.

[0261] For example, when judging the intrusion detection result according to the pre-established defense rule library, the rule library can set "if the abnormal traffic exceeds 100 times per second, trigger high-level early warning". If the detection result shows that the traffic of a certain node reaches 150 times per second, it exceeds the intrusion threshold and enters the hierarchical processing flow. This judgment mechanism can effectively screen high-risk events and improve response efficiency.

[0262] Specifically, when classifying the intrusion detection result by using the fuzzy comprehensive evaluation method, the threat can be classified into three levels of "low", "medium" and "high". Assuming that a certain intrusion event involves multiple unauthorized accesses and is accompanied by data leakage signs, through fuzzy evaluation, it can be concluded that the risk is "high". The advantage of this method is that it can integrate multiple fuzzy factors to obtain a unified classification standard and provide a basis for subsequent decision-making.

[0263] Preferably, when generating a response execution sequence according to the unified classification standard, the priority sorting algorithm sorts according to the threat level and the impact range.

[0264] For example, "high-risk" events are handled first, such as blocking abnormal IP first and then checking the physical entry state. This sorting method ensures more reasonable allocation of resources and priority resolution of critical threats.

[0265] When inputting the feature vector of the execution sequence into the support vector machine algorithm, it should be noted that the feature vector can include "intrusion duration", "number of affected devices", etc. Assuming that a physical intrusion lasts for 10 minutes and a network intrusion affects 5 devices, the support vector machine analyzes the correlation strength of the two and outputs an optimized weight value such as 0.7. This analysis can reveal the potential relationship between threats and provide data support for defense integration.

[0266] In one embodiment, when integrating defense measures according to the optimized weight value, if the physical intrusion weight is 0.3 and the network intrusion weight is 0.7, the final solution can be "strengthen the frequency of access control patrol and at the same time improve the level of network traffic monitoring". The advantage of this integration method is that it can generate more accurate hierarchical response execution solutions according to the specific threat characteristics. Through multi-level analysis and optimization, the entire process can significantly improve the pertinence and execution efficiency of defense measures, providing reliable protection for system security.

[0267] S7, through the hierarchical response execution scheme, real-time monitoring of the system running state is performed, and if a composite threat is detected, the response scheme parameters are adjusted to obtain an optimized defense execution sequence.

[0268] Optionally, this step further includes:

[0269] Step S71, the system operation data is classified and responded through a preset rule, a state change feature is obtained, and a preliminary monitoring result is obtained. Step S72, if the state change feature exceeds the state threshold, a feature vector is extracted from the state change feature, a random forest algorithm is used to classify the feature vector, and a threat interference range is determined. Step S73, according to the threat interference range, the parameter value in the response scheme is adjusted, the optimized response configuration is generated, and the adjusted parameter set is obtained. Step S74, using the adjusted parameter set, the rule set of the defense strategy is constructed, and the support vector machine algorithm is used to evaluate the rule set, and the feasible sequence set is obtained. Step S75, the feasible sequence set is implemented in real time, the dynamic change trend in the execution process is extracted from the monitoring log, and the sequence execution state is obtained. Step S76, if the sequence execution state shows an anomaly, the related log is extracted from the historical data, the threat interference source is compared and analyzed, the abnormal correction scheme is obtained, and the corrected execution sequence is obtained. Step S77, according to the corrected execution sequence, the system operation configuration is updated, and the configuration is periodically verified by using a cyclic detection mechanism, and the final running state is obtained.

[0270] Specifically, when the system operation data is classified and responded through a preset rule, it can be understood that different monitoring levels are set according to the running state of the enterprise security system.

[0271] For example, the system operation data can include the CPU usage of the server, the switch times of the access control system, etc.

[0272] For example, if the CPU usage is below 50% under normal circumstances, and the access control switch times are not more than 100 times per day, it is classified as "low-level" monitoring; if the CPU usage rises to 80%, it enters "medium-level". This way, the state is quickly divided by the preset rule, which is convenient for subsequent analysis. If the state change feature exceeds the preset state threshold, a feature vector is extracted from the feature.

[0273] In one possible implementation, assuming that the CPU usage of a server suddenly reaches 90% and the access control switch times surge to 150 times, these data can be part of the feature vector. When using a random forest algorithm for classification, it can be classified into multiple decision trees for judgment.

[0274] For example, from the historical data, high CPU load may be related to network attacks, and access control anomalies may indicate physical interference, and finally determine that the threat interference range involves "network and physical dual threats".

[0275] Specifically, when adjusting the response scheme parameters according to the threat interference range, the monitoring frequency or resource allocation can be adjusted. Assuming that the threat range covers the server and the entrance, the parameter adjustment can shorten the network traffic monitoring interval from 10 minutes to 5 minutes, and increase the access control check frequency from once a day to twice a day.

[0276] Preferably, such adjustment generates an optimized parameter set that more accurately matches the current threat.

[0277] For example, when constructing a defense policy rule set using the adjusted parameter set, a rule can be set as "if the traffic surge to 200 times per second, then limit access."

[0278] It should be noted that when using a support vector machine to evaluate the feasibility of these rules, conflicts or redundancies between rules are analyzed, and finally a feasible sequence set is output.

[0279] For example, it is confirmed that the combination of limiting access and increasing patrol frequency is executable. When implementing real-time monitoring on the feasible sequence set, dynamic change trends are extracted from logs.

[0280] In one embodiment, it is assumed that after executing the limit access, the traffic is reduced to 50 times per second, but the access anomaly still persists, indicating that the physical threat has not been eliminated. Such trends reflect the sequence execution state, helping to determine the effect. If the sequence execution state shows an anomaly, relevant logs are extracted from historical data for comparison.

[0281] For example, historical records show similar traffic reduction but no reduction in physical threats, which may be caused by internal unauthorized operations. After comparison, the anomaly correction scheme can be "temporarily close part of the access permission and notify the security personnel to check", forming a corrected execution sequence. When updating the system running configuration according to the corrected execution sequence, a loop detection mechanism is used to verify the effect.

[0282] For example, the traffic and access state are checked every 1 hour. If the traffic is stable below 50 times per second and the access anomaly disappears, it is considered that the final running state is normal. Such periodic verification ensures the continuous stability of the system.

[0283] S8, according to the optimized defense execution sequence, obtain system feedback data, judge the execution effect of the defense measures through the anomaly detection algorithm, and generate a dynamic update table of intrusion prevention and control.

[0284] Optionally, this step further includes:

[0285] Step S81, after obtaining the defense sequence, the execution optimization is performed through the preset rule to obtain the optimized sequence. Step S82, the optimized sequence extracts data from the system to obtain real-time results. Step S83, for the real-time results, the isolated forest algorithm is used for analysis to determine the abnormal state. Step S84, if the abnormal state exceeds the defense threshold, the abnormal data is input into the K-means clustering algorithm to divide the abnormal type and determine the abnormal classification. Step S85, according to the abnormal classification, the defense sequence parameters are adjusted to generate an updated strategy. Step S86, the updated strategy calculates the intrusion prevention and control coverage range to obtain a dynamic update table. Step S87, the dynamic update table cyclically optimizes the defense sequence to obtain a continuous adjustment result.

[0286] Specifically, after obtaining the defense sequence, the execution optimization is performed through the preset rule to obtain the optimized sequence.

[0287] It can be understood that the preset rule here can be designed based on the historical operation law of the enterprise security system.

[0288] For example, the traffic peak of a certain enterprise server is usually during the day, and is lower at night. The rule can be set to prioritize the optimization of defense resource allocation at night.

[0289] Exemplarily, if the nighttime traffic is usually no more than 100 times per second, the optimized sequence will reduce the monitoring frequency at night to release resources to the peak period during the day. The optimized sequence extracts data from the system to obtain real-time results.

[0290] Specifically, the system will record the real-time server status and access control activity.

[0291] For example, at a certain time, the server traffic reaches 150 times per second, and the access switch frequency is 20 times. These data constitute the basis of real-time results.

[0292] It should be noted that the extracted data needs to cover key indicators for subsequent analysis and use. For the real-time results, the isolated forest algorithm is used for analysis to determine the abnormal state.

[0293] In one possible implementation, the isolated forest identifies problems by quickly isolating abnormal points.

[0294] For example, if the traffic of a certain server suddenly increases to 300 times per second, while the historical average is only 120 times per second, the algorithm will mark it as abnormal. The advantage of this way is that it can quickly locate unusual behavior. If the abnormal state exceeds the preset defense threshold, the abnormal data is input into the K-means clustering algorithm to divide the abnormal type and determine the abnormal classification.

[0295] For example, assume the defense threshold is 200 times per second for traffic and 50 times for access switch. A record shows 250 times per second for traffic and 60 times for access switch, which exceeds the defense threshold. The K-means may classify the anomaly into two categories: "network anomaly" and "physical anomaly".

[0296] Specifically, high traffic may be an external intrusion, and access switch anomaly may be related to internal interference. This classification helps to address the problem more accurately. According to the anomaly classification, adjust the defense sequence parameters to generate an updated strategy.

[0297] Preferably, if it is determined to be a network anomaly, the strategy may increase the traffic filtering frequency from every 10 minutes to every 5 minutes.

[0298] In one embodiment, if it involves a physical anomaly, part of the access switch permission may be temporarily restricted. This adjustment can better match the current threat type. The updated strategy calculates the intrusion prevention coverage to obtain a dynamic update table.

[0299] For example, the adjusted strategy may cover the server cluster and all entry channels. The dynamic update table lists the prevention strength of each area, such as network monitoring coverage 80% and access switch inspection coverage 100%. This tabular presentation facilitates intuitive understanding of the defense layout. The dynamic update table cyclically optimizes the defense sequence to obtain continuous adjustment results.

[0300] In one embodiment, if the table shows that the network monitoring effect is improved but the access switch problem is not weakened, the system will further increase the number of security patrols.

[0301] For example, from 1 time per day to 3 times per day.

[0302] It can be understood that this cyclic optimization can dynamically adapt to changes in threats and ensure that the system is always in a stable state.

[0303] S9, for the dynamic update table, iteratively train the feature decomposition model and response strategy library through a machine learning algorithm to obtain an intrusion protection enhancement model adapted to complex scenarios.

[0304] Optionally, this step further comprises:

[0305] Step S91, after obtaining the data table content from the dynamic update table, the PCA tool is used to reduce the dimension of the data table and extract a preliminary feature set. Step S92, based on the preliminary feature set, the importance score of each feature is calculated using the random forest algorithm, the features with scores higher than the optimization threshold are retained, and an optimized feature set is generated. Step S93, according to the optimized feature set, a response strategy model is trained using a logistic regression algorithm to generate a strategy update set. Step S94, based on the strategy update set, a K-means clustering algorithm is used to perform clustering analysis on the complex scene, and the scene categories are divided and the adaptability parameters of each category are calculated.

[0306] Step S95, the adaptability parameters are applied to the weight adjustment of the intrusion protection rule to generate a protection enhancement set.

[0307] Step S96, the performance indicators of the protection enhancement set are calculated, and if the indicator value is higher than the preset model performance threshold, the final model is determined.

[0308] Step S97, the scene adaptability is extracted from the final model, and the construction of the intrusion protection enhancement model is completed.

[0309] Specifically, after obtaining the data table content from the dynamic update table, the PCA tool is used to reduce the dimension of the data table and extract a preliminary feature set.

[0310] It can be understood that the data table may contain multi-dimensional information such as server traffic and access switch times, and the PCA tool can convert these high-dimensional data into fewer core features.

[0311] For example, the data table of a certain enterprise records the hourly traffic peak and access activities, and the PCA may extract two main features of "network load" and "physical access", reducing redundant information for subsequent analysis. Based on the preliminary feature set, the importance score of each feature is calculated using the random forest algorithm, and the features with scores higher than the preset optimization threshold are retained to generate an optimized feature set.

[0312] Specifically, the random forest evaluates the impact of features on the result by voting multiple decision trees.

[0313] For example, assume that the "network load" score is 0.85, the "physical access" score is 0.65, and the "temperature change" is only 0.2, and the preset optimization threshold is 0.5, then the first two are retained. This screening can focus on key factors and improve model efficiency. According to the optimized feature set, a response strategy model is trained using a logistic regression algorithm to generate a strategy update set.

[0314] In one possible implementation, the logistic regression determines whether a certain feature combination triggers protection adjustment based on historical data.

[0315] For example, if the network load is high and physical access is frequent, the model may predict that the firewall rules need to be strengthened. The generated policy update set after training contains specific response solutions, such as adjusting the monitoring frequency or permissions. Based on the policy update set, the K-means clustering algorithm is used to analyze the clustering of complex scenarios, divide the scenario categories, and calculate the adaptability parameters of each category.

[0316] Preferably, assuming that the data reflects both peak and off-peak scenarios, K-means can divide them into two categories: "high risk" and "low risk". The adaptability parameter may be that the response speed of the high-risk scenario needs to be improved to 5 seconds. This division helps to optimize the protection in a targeted manner. Apply the adaptability parameter to the weight adjustment of the intrusion protection rules to generate a protection enhancement set.

[0317] For example, the traffic filtering weight of the high-risk scenario is increased from 0.3 to 0.7, and the low-risk scenario is reduced to 0.1. This adjustment makes the resource allocation more reasonable and enhances the targeted protection capability. Calculate the performance indicators of the protection enhancement set, if the indicator value is higher than the preset model performance threshold, determine the final model.

[0318] In one embodiment, the performance indicators may be detection accuracy and response time. If the accuracy is 90% and the response time is less than 10 seconds, and the model performance threshold is 85% and 15 seconds respectively, the model is qualified. This verification ensures the practicality of the model. Extract the scenario adaptability from the final model to complete the construction of the intrusion protection enhancement model.

[0319] It should be noted that the scenario adaptability may manifest as the model's rapid response to traffic surges or access anomalies.

[0320] For example, a traffic surge to 200 times per second, the model automatically increases the filtering frequency and restricts part of the access permissions. This ability makes the protection more flexible and can dynamically respond to changes in enterprise security needs.

[0321] Please refer to Figure 2 In the second aspect of the present application, an intrusion protection system for a warehouse logistics automatic sorting system is provided, which uses the method described above for intrusion protection.

[0322] Optionally, the system further comprises:

[0323] A data acquisition module is configured to acquire sensor data, network traffic logs, and device operating states in the warehouse logistics automatic sorting system, decompose the data using a multi-dimensional feature extraction algorithm, and obtain a feature combination mode of intrusion behavior.

[0324] An anomaly detection module is configured to determine whether there is an anomaly based on the feature combination mode by using a feature threshold value. If the anomaly value exceeds the feature threshold value, it is determined to be a potential intrusion behavior, and a preliminary intrusion behavior classification table is generated.

[0325] a feature extraction module configured to extract physical layer anomaly features and network layer anomaly features from the preliminary intrusion behavior classification table, group the two types of features using a clustering algorithm, and obtain independent mode sets of physical intrusion and network intrusion;

[0326] a threat assessment module configured to obtain a matching degree of historical intrusion data and a current mode according to the independent mode sets, judge a hierarchical severity of an intrusion type through similarity calculation, and generate a hierarchical threat assessment table;

[0327] a response strategy module configured to match physical intrusion and network intrusion protection measures through a pre-established response strategy library for the hierarchical threat assessment table, and obtain a set of targeted defense rules;

[0328] a defense integration module configured to integrate the physical intrusion protection measures and the network intrusion protection measures using a fusion algorithm according to the set of defense rules, and generate a unified hierarchical response execution scheme;

[0329] a monitoring adjustment module configured to monitor a system running state in real time through the hierarchical response execution scheme, adjust response scheme parameters if a composite threat is detected, and obtain an optimized defense execution sequence;

[0330] an effect evaluation module configured to obtain system feedback data according to the optimized defense execution sequence, judge an execution effect of the defense measures through an anomaly detection algorithm, and generate a dynamic update table of intrusion prevention and control;

[0331] a model enhancement module configured to perform iterative training on a feature decomposition model and a response strategy library through a machine learning algorithm for the dynamic update table, and obtain an intrusion protection enhancement model adapted to complex scenarios.

[0332] The above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An intrusion protection method for a warehouse logistics automated sorting system, characterized by, The method comprises: S1, obtaining sensor data, network traffic logs and device running status in the warehouse logistics automatic sorting system, decomposing the data by using a multi-dimensional feature extraction algorithm to obtain a feature combination mode of intrusion behavior; This step also includes: Step S11, obtaining sensor data, network traffic and device status, decomposing the data by Fourier transform or wavelet transform to obtain a preliminary feature set; Step S12, for the preliminary feature set, processing the sensor data and network traffic by using a principal component analysis algorithm to obtain a feature matrix after dimension reduction; Step S13, from the feature matrix after dimension reduction, extracting abnormal points of intrusion behavior by using a statistical-based outlier detection method, judging whether the abnormal points exceed the abnormal threshold, and determining the potential intrusion features; This step also includes: Step S131, obtaining the data after dimension reduction from the feature matrix, reducing the high-dimensional features to two dimensions by using principal component analysis, Step S132, calculating the local outlier factor of each point according to the two-dimensional data after dimension reduction to obtain a preliminary set of outlier detection, Step S133, for the preliminary set, judging whether the abnormal points exceed the abnormal threshold calculated based on three standard deviations by using an isolation forest algorithm to determine the candidate points of potential intrusion, Step S134, comparing the candidate points with the row vectors of the feature matrix, calculating the grouping features of the candidate points and normal behavior patterns by using cosine similarity to obtain a classification set of abnormal extraction, Step S135, according to the classification set, extracting the data points with continuous timestamps in each category to form time series data of potential intrusion, and using a sliding window method to judge the trend of behavior pattern, Step S136, extracting the time window with more than five continuous abnormal points from the trend as a key time window, and using an autoregressive integrated moving average model to determine the active interval of the abnormal points, Step S137, generating the distribution path of intrusion behavior by the intersection of the active interval and the isolation forest detection result, and determining the abnormal link in the system, Step S138, for the distribution path, matching the network traffic logs by using an ELK log analysis tool, comparing the access frequency of the source IP address, and obtaining the specific location of the intrusion source; Step S14, grouping the potential intrusion features by using a clustering analysis algorithm to obtain a combination mode of intrusion behavior, Step S15, calculating the matching degree by using cosine similarity according to the matching of the combination mode and the device status, and marking as an abnormal behavior mode if the matching degree is lower than a set value, Step S16, comparing the abnormal behavior mode with the log record, using a rule-based log matching method to judge the abnormal source in the network traffic, and obtaining the specific distribution of intrusion behavior, Step S17, associating the distribution of intrusion behavior with the system running status, and using time series-based correlation analysis to determine the abnormal link in the automatic sorting system; S2, judging whether there is an anomaly according to the feature threshold for the feature combination mode, and determining as a potential intrusion behavior if the abnormal value exceeds the feature threshold, and generating a preliminary intrusion behavior classification table; S3, extracting physical layer abnormal features and network layer abnormal features from the preliminary intrusion behavior classification table, using a clustering algorithm to group the two types of features, obtaining independent mode sets of physical intrusion and network intrusion; S4, according to the independent mode set, obtaining the matching degree of historical intrusion data and the current mode, judging the hierarchical severity of the intrusion type through similarity calculation, and generating a hierarchical threat assessment table; S5, according to the hierarchical threat assessment table, matching the protection measures of physical intrusion and network intrusion through the pre-established response strategy library, obtaining a set of targeted defense rules; S6, according to the defense rule set, using a fusion algorithm to integrate the physical intrusion protection measures and the network intrusion protection measures, and generating a unified hierarchical response execution scheme; This step also includes: Step S61, obtaining protection measure data from physical intrusion and network intrusion, using weighted average method to fuse the data, and generating a preliminary protection set, Step S62, using the logic regression algorithm to classify the preliminary protection set as input, and outputting the intrusion detection result, Step S63, according to the pre-established defense rule library, judging the intrusion detection result, if the intrusion detection result exceeds the intrusion threshold, entering the hierarchical processing flow, Step S64, using fuzzy comprehensive evaluation method to classify the intrusion detection result, and determining the unified hierarchical standard, Step S65, according to the unified hierarchical standard, using priority sorting algorithm to generate response execution sequence, Step S66, using the support vector machine algorithm to judge the correlation strength of physical intrusion and network intrusion by taking the feature vector in the execution sequence as input, and outputting the optimization weight value, Step S67, according to the optimization weight value, using the weighted average method to integrate the protection measures, and generating the final hierarchical response execution scheme; S7, through the hierarchical response execution scheme, real-time monitoring the system running state, if the composite threat is detected, adjusting the response scheme parameters, and obtaining the optimized defense execution sequence; S8, according to the optimized defense execution sequence, obtaining system feedback data, judging the execution effect of the defense measures through the anomaly detection algorithm, and generating a dynamic update table of intrusion prevention and control; S9, according to the dynamic update table, using machine learning algorithm to iteratively train the feature decomposition model and the response strategy library, and obtaining an intrusion protection enhancement model suitable for complex scenarios.

2. The method of claim 1, wherein, The step S2, for the feature combination mode, judging whether there is an anomaly through a feature threshold, if the abnormal value exceeds the feature threshold, determining it as a potential intrusion behavior, and generating a preliminary intrusion behavior classification table, including: Step S21, obtaining mode analysis results from feature combination, using K-means clustering algorithm to divide the data into several clusters, and extracting the points farthest from the cluster center as abnormal values; Step S22, comparing the abnormal value with the feature threshold, if the abnormal value exceeds the feature threshold, marking it as a feature threshold exceeding; Step S23, for the data exceeding the feature threshold, matching through the pre-established rule library, and confirming whether there is a potential intrusion behavior; Step S24, the matched potential intrusion behavior data is taken as input, and a decision tree algorithm is used to generate a preliminary classification table to determine the correspondence between different feature combinations and intrusion behaviors; Step S25, according to the preliminary classification table, the correlation between the feature combination and the intrusion behavior is counted, and the feature threshold is updated; Step S26, using the updated feature threshold, the new data is analyzed, the abnormal value is extracted, and it is judged whether it conforms to the intrusion behavior feature.

3. The method of claim 1, wherein, Step S3, the physical layer abnormal feature and the network layer abnormal feature are extracted from the preliminary intrusion behavior classification table, a clustering algorithm is used to group the two types of features, and independent mode sets of physical intrusion and network intrusion are obtained, including: Step S31, the physical layer abnormality and the network layer abnormality are obtained from the pre-established classification table, the classification table is based on historical data, and contains abnormal labels of the physical layer and the network layer; Step S32, the principal component analysis is used to separate the physical layer abnormal feature and the network layer abnormal feature from the obtained abnormal features, and an independent feature set is obtained; Step S33, the independent feature set is input into the K-means clustering tool for grouping processing, the clustering number is set to 2, and the physical intrusion mode set and the network intrusion mode set are obtained; Step S34, if there is an overlapping mode in the physical intrusion mode set, a support vector machine tool is used for boundary division to determine the independent mode; Step S35, if there is a cross mode in the network intrusion mode set, a kernel density estimation tool is used to determine the independent mode according to the distribution characteristics; Step S36, according to the mode set after grouping processing, the independent mode feature distribution of the physical intrusion and the network intrusion is obtained, and a histogram tool is used to count the feature distribution; Step S37, the independent mode feature distribution is compared with the intrusion behavior, the cosine similarity tool is used to calculate the matching degree, and the matching relationship between the abnormal feature and the intrusion mode is judged.

4. The method of claim 1, wherein, Step S4, according to the independent mode set, the matching degree of the historical intrusion data and the current mode is obtained, the similarity calculation is used to judge the hierarchical severity of the intrusion type, a hierarchical threat evaluation table is generated, including: Step S41, the mode feature is extracted from the historical data through the independent mode set, and the cosine similarity is used to calculate the matching degree of the historical data and the current mode; Step S42, according to the matching threshold, if the similarity value exceeds the matching threshold, it is determined as high matching, and a preliminary intrusion type set is obtained; Step S43, for the preliminary intrusion type set, the K-means algorithm is used to group the intrusion types; Step S44, the initial clustering center is determined by random selection, and the iteration number is set to 100 times; Step S45, the Euclidean distance of each data point to the clustering center is calculated, the data points are distributed to the nearest clustering center, the clustering center is updated, and the above steps are repeated until the clustering center no longer changes or the iteration number is reached; Step S46, according to the severity level distribution, the threat distribution characteristics between types are obtained, the hierarchical boundary of the intrusion type is judged by calculating the Euclidean distance between the clustering centers, and a hierarchical intrusion type set is obtained; Step S47, in the hierarchical intrusion type set, the average value of the similarity value of each intrusion type is obtained, and the central tendency of the threat distribution is determined. Step S48, by matching the centralized trend with the pre-established evaluation form template, using the table filling tool of Excel to generate the graded threat evaluation table; Step S49, copy the centralized trend data into the evaluation form template, use the automatic filling function of Excel to generate the graded threat evaluation table; Step S410, extract the boundary features of threat distribution from the final output, and judge the dynamic change trend of the potential intrusion type by comparing the boundary features with the current mode.

5. The method of claim 1, wherein, Said step S5, for the graded threat evaluation table, match the protection measures of physical intrusion and network intrusion through the pre-established response strategy library to obtain the targeted defense rule set, including: Step S51, obtain the initial strategy set from the pre-established response strategy library, and compare the strategy set with the graded evaluation results in the threat evaluation table item by item. If the protection measures in the strategy set are consistent with the protection requirements of the corresponding level in the threat evaluation table, the protection measures of physical intrusion and network intrusion are determined; Step S52, extract the feature data of physical intrusion and network intrusion from the graded evaluation results of the threat evaluation table, use the feature extraction tool to process the data, input the processed feature data into the Drools rule engine, and match the pre-defined rule template to obtain the corresponding protection measure set; Step S53, attribute analysis is performed on the protection measure set to extract the common attributes of physical intrusion features and network intrusion features. If there are overlapping attributes, use the logical judgment tool to generate targeted defense rules; Step S54, obtain the preliminary set of defense rules, optimize the rule set using genetic algorithm, set the optimization goal as the coverage rate and execution efficiency of the rule set, and obtain the simplified defense rule set through iterative optimization; Step S55, match the simplified defense rule set with the graded evaluation results in the threat evaluation table, and use the evaluation table matching tool to verify the applicability of the rules item by item. If the rule set matches the graded evaluation in the threat evaluation table, the final defense rule set is determined; Step S56, according to the final defense rule set, use SPSS tool to analyze historical data, set the priority threshold of rule execution priority, and sort the rules based on the priority threshold to obtain the graded protection scheme; Step S57, extract the execution sequence from the graded protection scheme, use the serialization tool to convert the execution sequence into an automatic deployment instruction set, and complete the deployment of the protection measures.

6. The method of claim 1, wherein, Said step S7, by the graded response execution scheme, real-time monitoring is performed on the system running state. If a composite threat is detected, the response scheme parameters are adjusted to obtain an optimized defense execution sequence, including: Step S71, by pre-set rules, the system running data is graded to obtain state change features and preliminary monitoring results; Step S72, if the state change features exceed the state threshold, extract the feature vector from the state change features, use the random forest algorithm to classify the feature vector, and determine the threat interference range; Step S73, according to the threat interference range, adjust the parameter values in the response scheme to generate an optimized response configuration and obtain the adjusted parameter set; Step S74, using the adjusted parameter set, constructing the rule set of the defense strategy, using the support vector machine algorithm to evaluate the rule set, and obtaining a feasible sequence set; Step S75, implementing real-time monitoring on the feasible sequence set, extracting the dynamic change trend in the execution process from the monitoring log, and obtaining the sequence execution state; Step S76, if the sequence execution state shows an anomaly, extracting relevant logs from historical data, comparing and analyzing the threat interference source, obtaining an abnormal correction scheme, and obtaining a corrected execution sequence; Step S77, updating the system running configuration according to the corrected execution sequence, periodically verifying the configuration by using a cyclic detection mechanism, and obtaining a final running state.

7. The method of claim 1, wherein, The step S9, for the dynamic update table, iteratively trains the feature decomposition model and the response strategy library by using a machine learning algorithm, and obtains an intrusion protection enhancement model adapted to complex scenarios, including: Step S91, after obtaining the data table content from the dynamic update table, using the PCA tool to reduce the dimension of the data table, and extracting a preliminary feature set; Step S92, based on the preliminary feature set, using the random forest algorithm to calculate the importance score of each feature, retaining the features with a score higher than an optimization threshold, and generating an optimized feature set; Step S93, according to the optimized feature set, using a logistic regression algorithm to train a response strategy model, and generating a strategy update set; Step S94, based on the strategy update set, using a K-means clustering algorithm to perform clustering analysis on complex scenarios, dividing the scenarios into categories and calculating the adaptability parameters of each category; Step S95, applying the adaptability parameters to the weight adjustment of the intrusion protection rules, and generating a protection enhancement set; Step S96, calculating the performance indicators of the protection enhancement set, and if the indicator value is higher than the model performance threshold, determining the final model; Step S97, extracting the scene adaptability from the final model, and completing the construction of the intrusion protection enhancement model.

8. An intrusion protection system for a warehouse logistics automated sorting system, characterized in that, The method of any one of claims 1 to 7 is used for intrusion protection, and the system comprises: A data acquisition module is configured to acquire sensor data, network traffic logs, and device running states in a warehouse logistics automatic sorting system, decompose the data by using a multi-dimensional feature extraction algorithm, and obtain a feature combination mode of intrusion behavior; An anomaly detection module is configured to determine whether there is an anomaly by using a feature threshold for the feature combination mode, and if the anomaly value exceeds the feature threshold, determine that it is a potential intrusion behavior, and generate a preliminary intrusion behavior classification table; A feature extraction module is configured to extract physical layer anomaly features and network layer anomaly features from the preliminary intrusion behavior classification table, group the two types of features by using a clustering algorithm, and obtain independent mode sets of physical intrusion and network intrusion; A threat assessment module is configured to obtain a matching degree of historical intrusion data and a current mode according to the independent mode sets, determine the hierarchical severity of the intrusion type by similarity calculation, and generate a hierarchical threat assessment table; A response strategy module is configured to match the defense measures for physical intrusion and network intrusion by using a pre-established response strategy library for the hierarchical threat assessment table, and obtain a targeted defense rule set. The defense integration module is configured to integrate the physical intrusion protection measure and the network intrusion protection measure according to the defense rule set by using a fusion algorithm to generate a unified hierarchical response execution scheme. The monitoring adjustment module is configured to monitor the system running state in real time through the hierarchical response execution scheme, and if a composite threat is detected, adjust the response scheme parameters to obtain an optimized defense execution sequence. The effect evaluation module is configured to obtain system feedback data according to the optimized defense execution sequence, judge the execution effect of the defense measure by using an anomaly detection algorithm, and generate a dynamic update table of the intrusion prevention and control. The model enhancement module is configured to iteratively train the feature decomposition model and the response strategy library by using a machine learning algorithm according to the dynamic update table, and obtain an intrusion protection enhancement model adapted to a complex scene.

Images