Network security protection management system and method based on big data

Abstract

The invention discloses a network security protection management system and method based on big data, and relates to the technical field of network security management, and the method comprises the steps: collecting industrial protocol layer data, physical sensor data and process parameters, extracting network behavior features, physical features and process correlation features, and constructing an industrial security feature vector; according to the security weight coefficient and the industrial security feature vector of the current process stage, calculating a threat score of the equipment, and dynamically adjusting a threat level through a three-level verification mechanism; constructing an equipment dependency graph, performing risk diffusion calculation based on the adjacent matrix and the attenuation coefficient, and generating a risk diffusion priority list to adjust an isolation strategy; an improved multi-target genetic algorithm is adopted to solve a Pareto optimal solution set, an equipment recovery sequence and a process parameter adjustment scheme are determined, and a recovery instruction is issued to realize safe recovery, so that the dynamic perception and accurate defense capability for industrial network threats is improved, and the safety and stability of industrial production are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, and specifically to a management system and method for network security protection based on big data. Background Art

[0002] Industrial control systems are critical infrastructure for modern industrial production, and their network security issues are receiving increasing attention. Currently, mainstream industrial security defense technologies are mainly based on network traffic monitoring and protocol analysis. For example, deep packet inspection (DPI) is used to identify abnormal instructions in the Modbus / TCP protocol, or network behavior logs are classified through machine learning models to detect attacks. In addition, some studies have attempted to introduce physical sensor data (such as vibration and temperature) to build anomaly detection models, and use thresholds to determine whether the device status deviates from the normal operating range. These technologies have improved the passive defense capabilities of industrial networks to a certain extent.

[0003] However, existing technologies have significant limitations. First, single-modal data analysis methods are difficult to cope with complex cross-domain collaborative attacks. For example, attacks targeting process parameter tampering may appear as legitimate instructions at the network protocol layer, but will cause abnormal fluctuations in physical sensor data. Single-dimensional detection models that only rely on network behavior characteristics or physical characteristics are prone to missed judgments; second, existing methods lack the ability to adapt to the dynamic characteristics of industrial system process stages. The operating status of industrial control systems is closely coupled with the production process (such as the preheating, decomposition, and sintering stages of the cement burning process). There are significant differences in network operation permissions, equipment loads, and security thresholds in different stages, but traditional static defense strategies cannot adjust security weights in real time, resulting in increased false alarm rates or delayed critical alarms.

[0004] In addition, existing risk management mechanisms often adopt fixed isolation strategies, without considering the impact of dependencies between devices on risk diffusion. For example, directly isolating attacked devices may cause chain shutdowns of related devices, disrupting production continuity; and the recovery process lacks a multi-objective trade-off between process parameter adjustment and energy consumption optimization, which can easily lead to production quality loss or energy waste. Summary of the Invention

[0005] (1) Technical problems solved

[0006] In response to the shortcomings of the existing technology, the present invention provides a management system and method for network security protection based on big data. Through multimodal data fusion, dynamic security assessment, risk propagation modeling and multi-objective optimization decision-making, it solves the problems of high concealment of cross-domain attacks, high process coupling and high recovery cost in industrial scenarios.

[0007] (2) Technical solution

[0008] To achieve the above objectives, the present invention is realized through the following technical solutions: A management method for network security protection based on big data, including:

[0009] Collect industrial protocol layer data, physical sensor data, and process parameters, extract network behavior features, physical features, and process correlation features, and construct an industrial security feature vector;

[0010] According to the security weight coefficient of the current process stage and the industrial security feature vector, calculate the threat score of the device, and dynamically adjust the threat level through a three-level verification mechanism;

[0011] Construct a device dependency graph, perform risk diffusion calculation based on the adjacency matrix and attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy;

[0012] Use an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and process parameter adjustment plan, and issue a recovery instruction to achieve safe recovery.

[0013] Furthermore, deploy protocol probes to capture Modbus / TCP communication data in real time, record the function code call frequency, timestamp, and abnormal packet information; collect physical sensor data, including the temperature change rate and vibration spectrum energy, and form physical features through normalization processing; synchronously collect process parameters and network traffic data, and use an improved FastDTW algorithm to calculate the alignment distance and extract process correlation features.

[0014] Furthermore, divide the process stages according to the temperature of the kiln system, and assign a security weight coefficient ω to each stage; the formula for calculating the threat score of the device is: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial security feature vector F; preset a security threshold interval [F1, F2], if the threat score < F1, it is determined that the risk level is low risk or normal; if F1 ≤ threat score < F2, it is determined that the risk level is medium risk; if F2 ≤ threat score, it is determined that the risk level is high risk.

[0015] Furthermore, the three-level verification mechanism includes:

[0016] First-level verification: Check whether the source IP of the instruction is in the trusted list, if the verification fails, determine that the instruction is abnormal;

[0017] Second-level verification: Compare whether the current process stage allows this operation, if the verification fails, determine that the instruction is abnormal;

[0018] Third-level verification: Check whether the sensor data is normal, if the verification fails, determine that there is a physical abnormality;

[0019] If there is an instruction exception or a physical exception, the danger level is determined to be medium risk. If the current threat score < F1, the score is directly increased to F1. If F1 ≤ the current threat score, the current threat score is maintained;

[0020] If an instruction exception and a physical exception occur simultaneously, the danger level is directly determined to be high risk. If the current threat score < F2, the score is directly increased to F2. If F2 ≤ the current threat score, the current threat score is maintained.

[0021] Furthermore, the devices in the industrial control system are defined as graph nodes to construct a device dependency graph. The edge weights are assigned according to the physical connection or data communication relationship between devices. If devices communicate directly or are physically associated, the edge weight is set to 1. If devices are indirectly dependent, the edge weight is set to 0.5. If there is no direct or indirect dependency between devices, the edge weight is set to 0, and the edge weights are filled into the adjacency matrix.

[0022] Furthermore, the initial risk value of the attacked device is set to the current threat score, and the initial risk values of the other nodes are set to 0: Risk 0 = [0,..., 0, Ts, 0,..., 0]; Weighted propagation is adopted, and the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) = Risk (k) ·W + α·Risk (k) , where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the attenuation coefficient, and the termination condition is that the change in the risk value after iteration is less than the termination threshold or the maximum number of iterations is reached.

[0023] Furthermore, all devices are sorted from high to low according to the risk diffusion value to form a risk diffusion priority list. Combining with the threat score, the isolation strategy is adjusted: If the threat score < F1, only the device with the highest risk diffusion value is monitored and the log is recorded; If F1 ≤ the threat score < F2, an alarm is triggered and the operation permissions of the top several devices with the highest risk diffusion value are restricted. If F2 ≤ the current threat score, the top several devices with the highest risk diffusion value are immediately isolated.

[0024] Furthermore, the recovery objectives are defined to include the recovery duration, the quality loss coefficient, and the energy consumption increment; The decision variables are the device recovery order and the adjustment range of process parameters; The multi-objective genetic algorithm is used to solve the Pareto optimal solution set, and 3 representative solutions are selected from the Pareto front: Solution A: The shortest recovery time; Solution B: The smallest quality loss coefficient; Solution C: The smallest energy consumption increment.

[0025] Furthermore, a plan is selected based on production needs, and instructions are issued through the DCS system: start the equipment in the equipment recovery order, delay a certain period of time after starting each equipment to monitor the threat score; adjust the process parameters according to the process parameter adjustment range, and use a ramp function to control the change rate.

[0026] The network security protection management system based on big data includes:

[0027] The data acquisition module collects industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior characteristics, physical characteristics, and process-related characteristics, and constructs industrial security feature vectors;

[0028] The threat assessment module calculates the threat score of the equipment based on the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjusts the threat level through a three-level verification mechanism;

[0029] The risk diffusion analysis module builds a device dependency graph, calculates risk diffusion based on the adjacency matrix and attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy;

[0030] The recovery strategy execution module uses an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the equipment recovery sequence and process parameter adjustment plan, and issue recovery instructions to achieve safe recovery.

[0031] (3) Beneficial effects

[0032] The present invention provides a management system and method for network security protection based on big data, which has the following beneficial effects:

[0033] (1) Through multimodal data collection and feature modeling, integrated industrial protocols, physical sensors and process parameter data, a comprehensive industrial security feature vector was constructed. By integrating multi-dimensional data, the correlation between covert attacks and process anomalies was effectively identified, breaking through the limitations of a single data source, significantly improving the accuracy and comprehensiveness of industrial network security threat detection, and laying a solid foundation for subsequent dynamic threat assessment and defense strategy formulation.

[0034] (2) The process stages are divided by temperature and security weights are assigned. The threat scores are accurately calculated in combination with industrial security feature vectors to achieve dynamic risk assessment. At the same time, through a three-level verification mechanism, instructions are verified from multiple dimensions such as instruction source, process adaptation, and physical state. Anomalies are effectively identified and the threat level is adjusted in a timely manner. This improves the dynamic perception and precise defense capabilities of industrial network threats and ensures the safety and stability of industrial production.

[0035] (3) By constructing a device dependency graph and quantifying risk diffusion, we can accurately assess the impact of the attacked device on other devices. By forming a risk diffusion priority list and dynamically adjusting the isolation strategy based on the threat score, we can achieve differentiated responses, avoiding the impact of excessive isolation on production and effectively controlling the diffusion of high-risk risks in a timely manner, thus ensuring industrial network security while maintaining production continuity.

[0036] (4) By determining the process parameter deviation and defining multi-objective recovery goals, the improved multi-objective genetic algorithm is used to solve the optimal solution set. It can flexibly select the appropriate recovery plan from the Pareto frontier based on production needs, taking into account the recovery time, quality loss and energy consumption increase. It can also accurately issue instructions according to the equipment recovery sequence and parameter adjustment range, ensuring rapid, safe and orderly recovery of production and improving the system's recovery capability after attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of the steps of the management method for network security protection based on big data of the present invention;

[0038] Figure 2 This is a flow chart of a management method for network security protection based on big data according to the present invention;

[0039] Figure 3 This is a schematic diagram of the structure of the management system for network security protection based on big data of the present invention. DETAILED DESCRIPTION

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0041] See also Figures 1 to 2 The present invention provides a management method for network security protection based on big data, comprising the following steps:

[0042] Step 1: Collect industrial protocol layer data, physical sensor data, and process parameters of each device, extract network behavior characteristics, physical characteristics, and process-related characteristics, and construct an industrial security feature vector;

[0043] The step 1 includes the following contents:

[0044] Step 101: Collect industrial protocol layer data, physical sensor data, and process parameters;

[0045] Specifically, a protocol probe is deployed at the core switching node of each device's industrial control network to capture Modbus / TCP communication data in real time. The call frequency and timestamp of function codes (such as 0x03 to read holding registers and 0x10 to write multiple registers) are recorded. The occurrence count of non-standard instructions (such as non-periodic OUT / SET instructions) is also counted. The source IP address, destination IP address, and data payload of abnormal data packets are saved.

[0046] Collect physical sensor data. For example, install a PT100 temperature sensor (accuracy ±0.5°C) at the outlet of the kiln preheater with a sampling interval of 1 second to calculate the temperature change rate. Install a three-axis acceleration sensor on the roller press bearing seat to collect vibration data with a sampling rate of 10kHz and a range of ±50g. Extract the spectral energy of the vibration data using the following calculation formula: Where X(f) is the spectrum of the vibration signal, f is the frequency, and f1 and f2 represent the starting and ending points of the frequency range;

[0047] Collect process parameters, for example, the following parameters are obtained from the distributed control system: raw material feeding rate (unit: tons / hour, sampling interval 1 minute); bucket elevator load (measured by laser level meter, accuracy ±1cm); raw material ratio KH value (measured by X-ray fluorescence analyzer, accuracy ±0.01);

[0048] Step 102: Extracting network behavior features, physical features, and process-related features from industrial protocol layer data, physical sensor data, and process parameters;

[0049] Specifically, network behavior feature extraction: Count the number of calls to function code 0x03 in the past 5 minutes and calculate the percentage of deviation from the baseline, that is, the abnormal function code frequency: N represents the number of calls, normal Indicates the baseline number; calculate the ratio of the number of unauthorized instructions to the total number of instructions, that is, the proportion of unauthorized instructions;

[0050] Physical feature extraction: Extract spectral energy from the vibration data of each device (such as roller press and kiln tail fan) and calculate the health index: Where E is the spectrum energy, E normal This is the energy baseline value when the equipment is operating normally;

[0051] Process-related feature extraction: For example, by synchronously collecting raw material feeding rate time series data (sampling interval 0.3 seconds) and network traffic data, the improved FastDTW algorithm is used to calculate the regularization distance, including:

[0052] The raw material feeding rate time series data R and the network flow data L are synchronized and aligned according to the timestamp to form a data sequence R = [r1, r2, ..., r x] and L=[l1,l2,...,l y ];

[0053] Define path slope constraints: In the cumulative distance matrix of dynamic time warping, constrain path movement directions to be horizontal (x+1, y), vertical (x, y+1), and diagonal (x+1, y+1). Paths with slopes exceeding 45 are prohibited (for example, two consecutive horizontal or vertical movements are prohibited).

[0054] For each alignment point (r x ,l y ) to calculate the local distance: Initialize the cumulative distance matrix D(1,1)=d(1,1), and the recursive formula is:

[0055] After accumulation, the total distance D(R,L) is obtained;

[0056] Calculate the similarity index: Among them, D max Indicates the historical maximum regularization distance value;

[0057] Step 103: Combine network behavior features, physical features, and process-related features into an industrial security feature vector: Among them, F net_func is the frequency of abnormal function code, F non_auth is the proportion of unauthorized instructions, F C is the temperature change rate, H is the equipment health, S is the similarity index, and each feature in the industrial safety feature vector is normalized to [0, 1].

[0058] When using, combine the contents of steps 101 to 103:

[0059] Through multimodal data collection and feature modeling, integrated industrial protocols, physical sensors and process parameter data, a comprehensive industrial security feature vector was constructed. By integrating multi-dimensional data, the correlation between covert attacks and process anomalies was effectively identified, breaking through the limitations of a single data source, significantly improving the accuracy and comprehensiveness of industrial network security threat detection, and laying a solid foundation for subsequent dynamic threat assessment and defense strategy formulation.

[0060] Step 2: Calculate the threat score of the equipment based on the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjust the threat level through a three-level verification mechanism;

[0061] The second step includes the following contents:

[0062] Step 201: Obtain the temperature data of the preheater at the kiln tail collected in Step 1, and divide the process stages according to the current temperature of the kiln system: Preheating stage: temperature ≤ 800°C; Decomposition stage: 800°C < temperature ≤ 1100°C; Sintering stage: 1100°C < temperature ≤ 1450°C; Cooling stage: temperature < 1100°C and continuously decreasing. Assign different safety weight coefficients to each stage, and linearly distribute the weights according to the temperature range: T is the temperature, η1 and η2 are temperature regression coefficients determined based on historical data regression analysis, 0 < η1 < 1, 0 < η2 < 1;

[0063] Step 202: Calculate the threat score of each device through the industrial safety feature vector of each device and the safety weight coefficient of the current process stage: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial safety feature vector F; Preset the safety threshold interval [F1, F2]. If the threat score < F1, determine that the danger level is low risk or normal; if F1 ≤ threat score < F2, determine that the danger level is medium risk; if F2 ≤ threat score, determine that the danger level is high risk. The safety threshold is set based on historical data statistics;

[0064] Step 203: Capture the PLC operation instruction (Programmable Logic Controller), extract the instruction type (such as read / write operation), the target register address, and the data payload. If the instruction belongs to the whitelist (such as regular read / write operations), let it pass; if a non-whitelist instruction (such as non-periodic OUT / SET instruction) is detected, trigger a three-level verification:

[0065] First-level verification: Check whether the source IP of the instruction is in the trusted list. If the verification fails, determine that the instruction is abnormal;

[0066] Second-level verification: Compare whether the operation is allowed in the current process stage (for example, pressure regulation is prohibited in the sintering stage). If the verification fails, determine that the instruction is abnormal;

[0067] Third-level verification: Check whether the sensor data is normal (such as vibration energy > 2 times the reference value, whether the temperature change rate exceeds the temperature change threshold). If the verification fails, determine that there is a physical abnormality;

[0068] If the instruction is abnormal or there is a physical abnormality, determine that the danger level is medium risk. If the current threat score < F1, directly increase the score to F1. If F1 ≤ the current threat score, keep the current threat score;

[0069] If both the instruction abnormality and the physical abnormality (temperature / vibration alarm) occur simultaneously, directly determine that the danger level is high risk. If the current threat score < F2, directly increase the score to F2. If F2 ≤ the current threat score, keep the current threat score;

[0070] When using, combine the contents of step 201 to step 203:

[0071] By dividing the process stages by temperature and assigning security weights, the threat score is accurately calculated in combination with the industrial security feature vector to achieve dynamic risk assessment. At the same time, through a three-level verification mechanism, instructions are verified from multiple dimensions such as instruction source, process adaptation, and physical state, to effectively identify anomalies and adjust the threat level in a timely manner, thereby improving the dynamic perception and precise defense capabilities of industrial network threats and ensuring the safety and stability of industrial production.

[0072] Step 3: Build a device dependency graph, calculate risk diffusion based on the adjacency matrix and attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy;

[0073] The step three includes the following contents:

[0074] Step 301: Define key equipment in the industrial control system (such as kiln, roller press, bucket elevator) as graph nodes, construct a device dependency graph, and assign edge weights based on the physical connection or data communication relationship between the equipment. If the equipment directly communicates or is physically associated (such as mechanical linkage), the edge weight is set to 1. If the equipment is indirectly dependent, the edge weight is set to 0.5. If there is no direct or indirect dependency between the equipment, the edge weight is set to 0. The edge weights are filled into the adjacency matrix. Each element of the adjacency matrix is the edge weight between different nodes. For example, the 2nd row and 3rd column is the edge weight between node 2 and node 3.

[0075] Step 302: Set the initial risk value of the attacked device to the current threat score, and the initial risk values of other nodes to 0: Risk 0 =[0,...,0,Ts,0,...,0]; using weighted propagation, the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) =Risk (k) W+αRisk (k) , where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the attenuation coefficient (ranging from 0.1 to 0.3 to prevent infinite diffusion), and the termination condition is when the risk value change after iteration is less than the termination threshold (such as 0.0.1) or the maximum number of iterations is reached;

[0076] For example, there are three devices A, B, and C, and their dependencies are as follows:

[0077] Device A (the attacked node) is directly dependent on device B (weight 1);

[0078] Device B is indirectly dependent on device C (weight 0.5);

[0079] Device A and device C have no direct dependency (weight 0);

[0080] Initial conditions: The threat score Ts of the attacked device A is 0.8 (after normalization), and the adjacency matrix: The attenuation coefficient α = 0.2;

[0081] Initial risk vector: Risk 0 = [0.8, 0, 0];

[0082] First iteration (k = 0): Risk (1) = Risk (0) ·W + α·Risk (0) = [0.16, 0.8, 0];

[0083] Second iteration (k = 1): Risk (2) = Risk (1) ·W + α·Risk (1) = [0.032, 0.32, 0.4];

[0084] Subsequent iterations, and finally converge;

[0085] Step 303: Sort all devices in descending order of the risk diffusion value to form a risk diffusion priority list. Combine the threat score to adjust the isolation strategy: If the threat score < F1, only monitor the device with the highest risk diffusion value and record the log; If F1 ≤ threat score < F2, trigger an alarm and restrict the operation permissions of the top several devices with the highest risk diffusion value. If F2 ≤ the current threat score, immediately isolate the top several devices with the highest risk diffusion value (such as isolating the top 5 devices with the highest risk diffusion value).

[0086] When in use, combine the content of Steps 301 to 304:

[0087] By constructing a device dependency graph and quantifying risk diffusion, the impact degree of the attacked device on other devices can be accurately evaluated. By forming a risk diffusion priority list and dynamically adjusting the isolation strategy in combination with the threat score, differential response can be achieved, which not only avoids over-isolation from affecting production but also can timely and effectively control the spread of high-risk risks, ensuring industrial network security while maintaining production continuity.

[0088] Step Four: Use an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and the process parameter adjustment plan, and issue a recovery instruction to achieve safe recovery.

[0089] The said Step Four includes the following content:

[0090] Step 401: According to the several devices isolated in Step Three, determine the corresponding process parameter deviations (such as the temperature deviating from the set value by ±50°C, the feeding rate fluctuating > 15%), and define the recovery target:

[0091] Goal 1: The recovery time is less than or equal to three times the current production cycle (for example, if the cement production line cycle is 2 hours, the recovery time is less than 6 hours);

[0092] Objective 2: Mass loss coefficient Where Δp i is the adjustment range of the i-th process parameter (such as KH value, clinker free calcium content), β i is the quality weight, 0<β i <1, n is the number of process parameters;

[0093] Goal 3: The total energy consumption increase is less than 20% of the normal operating energy consumption;

[0094] Step 402: Use the improved multi-objective genetic algorithm (NSGA-II) to solve the Pareto optimal solution set. The model is defined as follows:

[0095] Decision variables: Equipment recovery order G = [g1, g2, ..., g j ], where g j Indicates the recovery sequence number of the jth device. For example, G = [3, 1, 2] indicates that the device recovery sequence is device 2 → device 3 → device 1; the process parameter adjustment range ΔP = [Δp1, Δp2, ..., Δp n ];

[0096] Constraints: Process constraints: (e.g. raw material feeding rate adjustment range ±10%), are the minimum and maximum adjustment ranges of the i-th process parameter respectively; Equipment dependency constraint: If equipment A depends on equipment B, the recovery order must satisfy g B <g A ; Security constraints: Threat scoring during recovery <F1;

[0097] Fitness function: Among them, T recovery Indicates the recovery time, Path q Indicates the qth device dependency path, t k' Indicates Path q The startup time of the k'th device, E add Represents the total energy consumption increment, e j represents the energy consumption increment of the jth device, and m is the number of devices;

[0098] For example, if the device dependency is A→B→C and the recovery order is A→B→C, then the recovery time = t_A + t_B + t_C. If parallel recovery of independent devices is allowed, the total time is the longest path.

[0099] Step 403: Randomly generate an initial population containing several individuals, each representing a recovery solution. Calculate the Pareto rank of each individual, and prioritize non-dominated solutions. Use simulated binary crossover (SBX, with a crossover probability of 0.8) and polynomial mutation (with a mutation probability of 0.1). Merge the parent and child populations, and select the first several elite individuals to advance to the next generation. After several generations of iteration, select three representative solutions from the Pareto front:

[0100] Plan A (time optimal): shortest recovery time, higher quality loss and energy consumption increase;

[0101] Option B (optimal quality): minimum quality loss coefficient, extended recovery time and energy consumption increment;

[0102] Option C (optimal energy consumption): minimum energy consumption increment, allowing higher quality loss and extended recovery time;

[0103] Step 404: Select a plan based on production requirements (e.g., plan A if the order is urgent) and issue instructions through the distributed control (DCS) system:

[0104] Start the devices in the order they need to be restored, and monitor the threat score after a delay of a certain period (e.g., 5 minutes) after each device is started.

[0105] Adjust the process parameters according to the process parameter adjustment range, and use the ramp function to control the rate of change (such as the temperature rising by 100°C per hour);

[0106] When using, combine the contents of step 401 to step 404:

[0107] By determining process parameter deviations and defining multi-objective recovery goals, and using an improved multi-objective genetic algorithm to solve the optimal solution set, we can flexibly select appropriate recovery plans from the Pareto frontier based on production needs, taking into account recovery time, quality loss, and energy consumption increase. We can also accurately issue instructions according to the equipment recovery sequence and parameter adjustment range, ensuring rapid, safe, and orderly recovery of production and improving the system's recovery capabilities after attacks.

[0108] See also Figure 3 , the present invention also provides a management system for network security protection based on big data, including: a data acquisition module, a threat assessment module, a risk diffusion analysis module and a recovery strategy execution module;

[0109] The data acquisition module collects industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior features, physical features, and process-related features, and constructs industrial security feature vectors.

[0110] The threat assessment module calculates the threat score of the equipment based on the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjusts the threat level through a three-level verification mechanism;

[0111] The risk diffusion analysis module builds a device dependency graph, calculates risk diffusion based on the adjacency matrix and attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy;

[0112] The recovery strategy execution module uses an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the equipment recovery sequence and process parameter adjustment plan, and issue recovery instructions to achieve safe recovery.

[0113] In the application, the several formulas involved are all calculated by taking their numerical values after removing the dimensions, and the formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the latest real situation. The coefficients in the formula are set by technical personnel in this field according to actual conditions.

[0114] The above embodiments can be implemented in whole or in part through software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. Those skilled in the art will appreciate that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0115] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, and may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment as needed.

[0116] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A management method for network security protection based on big data, characterized in that: It includes: Collect industrial protocol layer data, physical sensor data and process parameters, extract network behavior features, physical features and process correlation features, and construct an industrial security feature vector; According to the security weight coefficient of the current process stage and the industrial security feature vector, calculate the threat score of the device, and dynamically adjust the threat level through a three-level verification mechanism; Construct a device dependency graph, perform risk diffusion calculation based on the adjacency matrix and attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy; Use an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and process parameter adjustment plan, and issue recovery instructions to achieve safe recovery.

2. The method for managing network security protection based on big data according to claim 1, characterized in that: The collection of industrial protocol layer data, physical sensor data and process parameters, and the extraction of network behavior features, physical features and process correlation features include: Deploy protocol probes to capture Modbus / TCP communication data in real time, record the function code call frequency, timestamp and abnormal packet information; collect physical sensor data, including temperature change rate and vibration spectrum energy, and form physical features through normalization; synchronously collect process parameters and network traffic data, and use an improved FastDTW algorithm to calculate the alignment distance and extract process correlation features.

3. The management method of network security protection based on big data according to claim 1 is characterized in that: The calculation of the threat score of the device according to the security weight coefficient of the current process stage and the industrial security feature vector includes: Divide the process stage according to the temperature of the kiln system, and assign a security weight coefficient ω to each stage; the formula for calculating the threat score of the device is: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial security feature vector F; preset a security threshold interval [F1, F2], if the threat score < F1, it is determined that the danger level is low risk or normal; if F1 ≤ threat score < F2, it is determined that the danger level is medium risk; if F2 ≤ threat score, it is determined that the danger level is high risk.

4. The method for managing network security protection based on big data according to claim 3, characterized in that: The dynamic adjustment of the threat level through a three-level verification mechanism includes: First-level verification: Check whether the source IP of the instruction is in the trusted list. If the verification fails, the instruction is determined to be abnormal; Second-level verification: Compare whether the current process stage allows this operation. If the verification fails, the instruction is determined to be abnormal; Third-level verification: Check whether the sensor data is normal. If the verification fails, physical abnormality is determined; If the instruction is abnormal or physically abnormal, the danger level is determined to be medium risk. If the current threat score < F1, the score is directly increased to F1. If F1 ≤ current threat score, the current threat score is maintained; If the instruction abnormality and physical abnormality occur simultaneously, the danger level is directly determined to be high risk. If the current threat score < F2, the score is directly increased to F2. If F2 ≤ current threat score, the current threat score is maintained.

5. The management method of network security protection based on big data according to claim 1 is characterized in that: The construction of the device dependency graph includes: Define the devices in the industrial control system as graph nodes, construct a device dependency graph, assign edge weights according to the physical connections or data communication relationships between devices. If devices communicate directly or are physically associated, set the edge weight to 1. If devices are indirectly dependent, set the edge weight to 0.

5. If there is no direct or indirect dependency between devices, set the edge weight to 0, and fill the edge weights into the adjacency matrix.

6. The management method of network security protection based on big data according to claim 5 is characterized in that: As described above, it includes: Set the initial risk value of the attacked device to the current threat score, and the initial risk values of other nodes to 0: Risk 0 =[0,...,0,Ts,0,...,0]; using weighted propagation, the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) =Risk (k) W+αRisk (k) , where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the attenuation coefficient, and the termination condition is when the risk value change after iteration is less than the termination threshold or the maximum number of iterations is reached.

7. The management method of network security protection based on big data according to claim 6 is characterized in that: The risk diffusion calculation based on the adjacency matrix and the attenuation coefficient to generate a risk diffusion priority list for adjusting the isolation strategy includes: Sort all devices in descending order of risk diffusion value to form a risk diffusion priority list, and combine the threat score to adjust the isolation strategy: if the threat score < F1, only monitor the device with the highest risk diffusion value and record the log; if F1 ≤ threat score < F2, trigger an alarm and restrict the operation permissions of the top several devices with the highest risk diffusion value; if F2 ≤ the current threat score, immediately isolate the top several devices with the highest risk diffusion value.

8. The management method for network security protection based on big data according to claim 1, characterized in that: Define the recovery objectives including recovery duration, quality loss coefficient, and energy consumption increment; the decision variables are the device recovery order and the adjustment range of process parameters; use a multi-objective genetic algorithm to solve the Pareto optimal solution set, and select 3 representative solutions from the Pareto front: Solution A: the shortest recovery time; Solution B: the smallest quality loss coefficient; Solution C: the smallest energy consumption increment.

9. The management method for network security protection based on big data according to claim 8, characterized in that: Select a solution according to production requirements and issue instructions through the distributed control system: start the devices in the device recovery order, and monitor the threat score after a certain delay after starting each device; adjust the process parameters according to the adjustment range of process parameters, and use a ramp function to control the change rate.

10. A network security protection management system based on big data, used to implement the method according to any one of claims 1 to 9, characterized in that: It includes: A data acquisition module that acquires industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior characteristics, physical characteristics, and process association characteristics, and constructs an industrial security feature vector; A threat assessment module that calculates the threat score of a device according to the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjusts the threat level through a three-level verification mechanism; A risk diffusion analysis module that constructs a device dependency graph, performs risk diffusion calculations based on the adjacency matrix and the attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy; A recovery strategy execution module that uses an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determines the device recovery order and the process parameter adjustment plan, and issues recovery instructions to achieve safe recovery.

Images