Management system and method for network security protection based on big data

Abstract

The application discloses a management system and method for network security protection based on big data, and relates to the technical field of network security management, which comprises the following steps: collecting industrial protocol layer data, physical sensor data and process parameters, extracting network behavior features, physical features and process correlation features, and constructing an industrial security feature vector; calculating the threat score of the equipment according to the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjusting the threat level through a three-level verification mechanism; constructing a device dependency graph, performing risk diffusion calculation based on an adjacency matrix and a decay coefficient, generating a risk diffusion priority list to adjust the isolation strategy; solving the Pareto optimal solution set by using an improved multi-objective genetic algorithm, determining the equipment recovery sequence and the process parameter adjustment scheme, and issuing the recovery instruction to realize the safety recovery and improve the dynamic perception and accurate defense capability of the industrial network threat, thereby ensuring the safety and stability of industrial production.

Description

Technical Field

[0001] This invention relates to the field of network security management technology, specifically to a management system and method for network security protection based on big data. Background Technology

[0002] As a critical infrastructure for modern industrial production, the cybersecurity of industrial control systems is receiving increasing attention. Currently, mainstream industrial security defense technologies are mainly based on network traffic monitoring and protocol analysis. For example, deep packet inspection (DPI) is used to identify abnormal commands in the Modbus / TCP protocol, or machine learning models are used to classify network behavior logs to detect attacks. In addition, some studies have attempted to introduce physical sensor data (such as vibration and temperature) to build anomaly detection models and use thresholds to determine whether the equipment status deviates from the normal operating range. These technologies have improved the passive defense capabilities of industrial networks to some extent.

[0003] However, existing technologies have significant limitations. First, single-modal data analysis methods are ill-equipped to handle complex cross-domain collaborative attacks. For example, attacks targeting the tampering of process parameters may appear as legitimate commands at the network protocol layer, but they can cause abnormal fluctuations in physical sensor data. Single-dimensional detection models that rely solely on network behavior features or physical features are prone to false negatives. Second, existing methods lack the ability to adapt to the dynamic characteristics of industrial system process stages. The operating state of industrial control systems is closely coupled with the production process (such as the preheating, decomposition, and sintering stages of cement firing). There are significant differences in network operation permissions, equipment load, and security thresholds at different stages. However, traditional static defense strategies cannot adjust security weights in real time, leading to increased false alarm rates or delayed critical alarms.

[0004] In addition, existing risk management mechanisms often adopt fixed isolation strategies without considering the impact of inter-equipment dependencies on risk diffusion. For example, directly isolating attacked equipment may lead to a chain reaction of shutdowns of related equipment, disrupting production continuity. Furthermore, the lack of a multi-objective trade-off between process parameter adjustment and energy consumption optimization during the recovery process can easily result in production quality loss or energy waste. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides a management system and method for network security protection based on big data. By using multimodal data fusion, dynamic security assessment, risk propagation modeling, and multi-objective optimization decision-making, it solves the problems of strong concealment of cross-domain attacks, high process coupling, and high recovery costs in industrial scenarios.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention is realized through the following technical solutions: A management method for network security protection based on big data, including:

[0009] Collect industrial protocol layer data, physical sensor data and process parameters, extract network behavior characteristics, physical characteristics and process correlation characteristics, and construct an industrial security feature vector;

[0010] According to the security weight coefficient of the current process stage and the industrial security feature vector, calculate the threat score of the device, and dynamically adjust the threat level through a three-level verification mechanism;

[0011] Construct a device dependency graph, perform risk diffusion calculation based on the adjacency matrix and attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy;

[0012] Adopt an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and process parameter adjustment plan, and issue a recovery instruction to achieve safe recovery.

[0013] Furthermore, deploy protocol probes to capture Modbus / TCP communication data in real time, record the function code call frequency, timestamp and abnormal packet information; collect physical sensor data, including temperature change rate and vibration spectrum energy, and form physical characteristics through normalization processing; synchronously collect process parameters and network traffic data, and use an improved FastDTW algorithm to calculate the alignment distance and extract process correlation characteristics.

[0014] Furthermore, divide the process stages according to the temperature of the kiln system, and assign a security weight coefficient ω to each stage; the formula for calculating the threat score of the device is: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial security feature vector F; preset a security threshold interval [F1, F2], if the threat score < F1, it is determined that the danger level is low risk or normal; if F1 ≤ threat score < F2, it is determined that the danger level is medium risk; if F2 ≤ threat score, it is determined that the danger level is high risk.

[0015] Furthermore, the three-level verification mechanism includes:

[0016] First-level verification: Check whether the source IP of the instruction is in the trusted list, if the verification fails, determine that the instruction is abnormal;

[0017] Second-level verification: Compare whether the current process stage allows this operation, if the verification fails, determine that the instruction is abnormal;

[0018] Third-level verification: Check whether the sensor data is normal, if the verification fails, determine that there is a physical abnormality;

[0019] If there is an instruction exception or a physical exception, the danger level is determined to be medium risk. If the current threat score < F1, the score is directly increased to F1. If F1 ≤ the current threat score, the current threat score is maintained.

[0020] If an instruction exception and a physical exception occur simultaneously, the danger level is directly determined to be high risk. If the current threat score < F2, the score is directly increased to F2. If F2 ≤ the current threat score, the current threat score is maintained.

[0021] Furthermore, the devices in the industrial control system are defined as graph nodes, and a device dependency graph is constructed. The edge weights are assigned according to the physical connection or data communication relationship between devices. If devices communicate directly or are physically associated, the edge weight is set to 1. If devices are indirectly dependent, the edge weight is set to 0.5. If there is no direct or indirect dependency between devices, the edge weight is set to 0, and the edge weights are filled into the adjacency matrix.

[0022] Furthermore, the initial risk value of the attacked device is set to the current threat score, and the initial risk values of the remaining nodes are set to 0: Risk ,

[0025] ,

[0024] ,

[0023] , , = [0,..., 0, Ts, 0,..., 0]; Weighted propagation is adopted, and the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) = Risk (k) ·W + α·Risk (k) , where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the attenuation coefficient, and the termination condition is that when the change in the risk value after iteration is less than the termination threshold or the maximum number of iterations is reached.

[0023] Furthermore, all devices are sorted from high to low according to the risk diffusion value, forming a risk diffusion priority list. Combining with the threat score, the isolation strategy is adjusted: If the threat score < F1, only the device with the highest risk diffusion value is monitored and the log is recorded; If F1 ≤ the threat score < F2, an alarm is triggered and the operation permissions of the top several devices with the highest risk diffusion value are restricted. If F2 ≤ the current threat score, the top several devices with the highest risk diffusion value are immediately isolated.

[0024] Furthermore, the recovery objectives are defined to include the recovery duration, the quality loss coefficient, and the energy consumption increment; the decision variables are the device recovery order and the adjustment amplitude of the process parameters; the multi-objective genetic algorithm is used to solve the Pareto optimal solution set, and 3 representative solutions are selected from the Pareto front: Solution A: the shortest recovery time; Solution B: the smallest quality loss coefficient; Solution C: the smallest energy consumption increment.

[0025] Furthermore, based on production needs, select a solution and issue instructions through the DCS system: start the equipment in the order of equipment recovery, and monitor the threat score after a certain delay after each equipment is started; adjust the process parameters according to the adjustment range of the process parameters, and use a ramp function to control the rate of change.

[0026] A big data-based network security protection management system includes:

[0027] The data acquisition module collects industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior features, physical features, and process correlation features, and constructs an industrial security feature vector.

[0028] The threat assessment module calculates the threat score of the equipment based on the safety weight coefficient of the current process stage and the industrial safety feature vector, and dynamically adjusts the threat level through a three-level verification mechanism.

[0029] The risk diffusion analysis module constructs a device dependency graph, performs risk diffusion calculations based on the adjacency matrix and attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy.

[0030] The recovery strategy execution module uses an improved multi-objective genetic algorithm to solve for the Pareto optimal solution set, determine the equipment recovery sequence and process parameter adjustment scheme, and issue recovery commands to achieve safe recovery.

[0031] (III) Beneficial Effects

[0032] This invention provides a management system and method for network security protection based on big data, which has the following beneficial effects:

[0033] (1) By collecting multimodal data and modeling features, and integrating industrial protocols, physical sensors and process parameter data, a comprehensive industrial security feature vector was constructed. By integrating multi-dimensional data, the correlation between covert attacks and process anomalies was effectively identified. This broke through the limitations of a single data source and significantly improved the accuracy and comprehensiveness of industrial network security threat detection, laying a solid foundation for subsequent dynamic threat assessment and defense strategy formulation.

[0034] (2) By dividing the process stages by temperature and assigning safety weights, and combining industrial security feature vectors to accurately calculate threat scores, dynamic risk assessment is achieved. At the same time, through a three-level verification mechanism, instructions are verified from multiple dimensions such as instruction source, process adaptation and physical status, effectively identifying anomalies and adjusting threat levels in a timely manner, thereby improving the dynamic perception and precise defense capabilities against industrial network threats and ensuring the safety and stability of industrial production.

[0035] (3) By constructing a device dependency graph and quantifying risk diffusion, the impact of attacked devices on other devices can be accurately assessed. By forming a risk diffusion priority list and dynamically adjusting the isolation strategy in conjunction with threat scores, differentiated responses can be achieved. This avoids excessive isolation from affecting production and can effectively control the diffusion of high-risk risks in a timely manner, ensuring industrial network security while maintaining production continuity.

[0036] (4) By determining the deviation of process parameters and defining multi-objective recovery objectives, the optimal solution set is solved by using an improved multi-objective genetic algorithm. It can flexibly select appropriate recovery schemes from the Pareto frontier in combination with production needs, taking into account recovery time, quality loss and energy consumption increment. It can also accurately issue instructions according to the equipment recovery sequence and parameter adjustment range, ensuring rapid, safe and orderly production recovery and improving the system's recovery capability after an attack. Attached Figure Description

[0037] Figure 1 This is a schematic diagram illustrating the steps of the big data-based network security protection management method of the present invention;

[0038] Figure 2 This is a schematic diagram of the management method for network security protection based on big data according to the present invention.

[0039] Figure 3 This is a schematic diagram of the management system structure for big data-based network security protection according to the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Please see Figures 1 to 2 This invention provides a management method for network security protection based on big data, comprising the following steps:

[0042] Step 1: Collect industrial protocol layer data, physical sensor data, and process parameters for each device, extract network behavior features, physical features, and process correlation features, and construct an industrial security feature vector;

[0043] Step one includes the following:

[0044] Step 101: Collect industrial protocol layer data, physical sensor data, and process parameters;

[0045] Specifically, a protocol probe is deployed at the core switching node of the industrial control network of each device to capture Modbus / TCP communication data in real time, record the call frequency and timestamp of function codes (such as 0x03 reading holding registers, 0x10 writing multiple registers), count the number of occurrences of non-standard instructions (such as non-periodic OUT / SET instructions), and save the source IP, destination IP and data payload of abnormal data packets.

[0046] Collect data from physical sensors. For example, install a PT100 temperature sensor (accuracy ±0.5℃) at the kiln tail preheater outlet, with a sampling interval of 1 second, and calculate the temperature change rate; install a triaxial accelerometer on the roller press bearing housing to collect vibration data, with a sampling rate of 10kHz and a range of ±50g, extract the spectral energy of the vibration data, and calculate the formula as follows: Where X(f) is the spectrum of the vibration signal, f is the frequency, and f1 and f2 represent the start and end points of the frequency range;

[0047] Collect process parameters, such as the following parameters obtained from the distributed control system: raw material feeding rate (unit: tons / hour, sampling interval 1 minute); bucket elevator carrying capacity (measured by laser level gauge, accuracy ±1cm); raw material ratio KH value (measured by X-ray fluorescence analyzer, accuracy ±0.01).

[0048] Step 102: Extract network behavior features, physical features, and process correlation features from industrial protocol layer data, physical sensor data, and process parameters;

[0049] Specifically, network behavior feature extraction involves: counting the number of times function code 0x03 was called in the past 5 minutes, calculating the percentage deviation from the baseline, i.e., the frequency of abnormal function codes. N represents the number of calls, N normal Indicates the baseline count; calculates the proportion of unauthorized instructions to the total number of instructions, i.e., the percentage of unauthorized instructions;

[0050] Physical feature extraction: Extract spectral energy from the vibration data of each piece of equipment (such as roller press, kiln tail fan) and calculate health indicators. Where E is the spectral energy, E normal This is the energy baseline value when the equipment is operating normally;

[0051] Process-related feature extraction: For example, synchronously collect time-series data of raw material feeding rate (sampling interval 0.3 seconds) and network traffic data, and use the improved FastDTW algorithm to calculate the normalization distance, specifically including:

[0052] The raw material feeding rate time-series data R and network traffic data L are synchronized and aligned according to timestamps to form a data sequence R = [r1, r2, ..., r x] and L = [l1,l2,...,l y ];

[0053] Define path slope constraints: In the dynamic time-warped cumulative distance matrix, constrain the path movement direction to the horizontal direction (x+1,y), the vertical direction (x,y+1), and the diagonal direction (x+1,y+1), and prohibit paths with a slope exceeding 45 (e.g., prohibit two consecutive horizontal or vertical movements).

[0054] For each alignment point (r) x ,l y For calculating local distances: Initialize the cumulative distance matrix D(1,1)=d(1,1), and use the recursive formula:

[0055] The total distance D(R,L) is obtained after accumulation;

[0056] Calculate the similarity index: Among them, D max This represents the historical maximum normalized distance value;

[0057] Step 103: Combine network behavior features, physical features, and process-related features into an industrial safety feature vector: Among them, F net_func For the frequency of abnormal function codes, F non_auth F represents the percentage of unauthorized instructions. C H represents the temperature change rate, H represents the equipment health status, and S represents the similarity index. All features in the industrial safety feature vector have been normalized to [0, 1].

[0058] When using this method, refer to the content of steps 101 to 103:

[0059] By integrating multimodal data acquisition and feature modeling, and combining industrial protocol, physical sensor, and process parameter data, a comprehensive industrial security feature vector was constructed. By fusing multi-dimensional data, the correlation between covert attacks and process anomalies was effectively identified, overcoming the limitations of a single data source. This significantly improved the accuracy and comprehensiveness of industrial network security threat detection, laying a solid foundation for subsequent dynamic threat assessment and defense strategy formulation.

[0060] Step 2: Calculate the threat score of the equipment based on the safety weight coefficient and industrial safety feature vector of the current process stage, and dynamically adjust the threat level through a three-level verification mechanism;

[0061] Step two includes the following:

[0062] Step 201: Obtain the temperature data of the preheater at the kiln tail collected in Step 1, and divide the process stages according to the current temperature of the kiln system: Preheating stage: temperature ≤ 800°C; Decomposition stage: 800°C < temperature ≤ 1100°C; Sintering stage: 1100°C < temperature ≤ 1450°C; Cooling stage: temperature < 1100°C and continuously decreasing. Assign different safety weight coefficients to each stage, and linearly distribute the weights according to the temperature range: T is the temperature, η1 and η2 are temperature regression coefficients determined based on historical data regression analysis, 0 < η1 < 1, 0 < η2 < 1;

[0063] Step 202: Calculate the threat score of each device through the industrial safety feature vector of each device and the safety weight coefficient of the current process stage: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial safety feature vector F; Preset a safety threshold range [F1, F2]. If the threat score < F1, determine that the risk level is low risk or normal; if F1 ≤ threat score < F2, determine that the risk level is medium risk; if F2 ≤ threat score, determine that the risk level is high risk. The safety threshold is set based on historical data statistics;

[0064] Step 203: Capture the PLC operation instruction (Programmable Logic Controller), extract the instruction type (such as read / write operation), target register address, and data payload. If the instruction belongs to the whitelist (such as regular read / write operations), release it; if a non-whitelist instruction (such as non-periodic OUT / SET instruction) is detected, trigger a three-level verification:

[0065] First-level verification: Check whether the IP address of the instruction source is in the trusted list. If the verification fails, determine that the instruction is abnormal;

[0066] Second-level verification: Compare whether this operation is allowed in the current process stage (for example, pressure adjustment is prohibited in the sintering stage). If the verification fails, determine that the instruction is abnormal;

[0067] Third-level verification: Check whether the sensor data is normal (such as vibration energy > 2 times the reference value, whether the temperature change rate exceeds the temperature change threshold). If the verification fails, determine that there is a physical abnormality;

[0068] If the instruction is abnormal or there is a physical abnormality, determine that the risk level is medium risk. If the current threat score < F1, directly increase the score to F1. If F1 ≤ the current threat score, keep the current threat score;

[0069] If an instruction abnormality and a physical abnormality (temperature / vibration alarm) occur simultaneously, directly determine that the risk level is high risk. If the current threat score < F2, directly increase the score to F2. If F2 ≤ the current threat score, keep the current threat score;<00​When using this method, refer to steps 201 to 203:

[0071] By dividing the process into stages based on temperature and assigning safety weights, and combining this with industrial security feature vectors to accurately calculate threat scores, dynamic risk assessment is achieved. At the same time, through a three-level verification mechanism, instructions are verified from multiple dimensions, including the source of the instruction, process adaptation, and physical status, effectively identifying anomalies and adjusting threat levels in a timely manner. This enhances the dynamic perception and precise defense capabilities against industrial network threats, ensuring the safety and stability of industrial production.

[0072] Step 3: Construct a device dependency graph, perform risk diffusion calculations based on the adjacency matrix and attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy;

[0073] Step three includes the following:

[0074] Step 301: Define the key equipment in the industrial control system (such as kiln body, roller press, bucket elevator) as graph nodes, construct the equipment dependency graph, and assign edge weights according to the physical connection or data communication relationship between the equipment. If the equipment communicates directly or is physically associated (such as mechanical linkage), set the edge weight to 1. If the equipment is indirectly dependent, set the edge weight to 0.5. If the equipment has no direct or indirect dependency, set the edge weight to 0. Fill the edge weights into the adjacency matrix. Each element of the adjacency matrix is ​​the edge weight between different nodes. For example, the second row and third column is the edge weight between node 2 and node 3.

[0075] Step 302: Set the initial risk value of the attacked device to the current threat score, and set the initial risk value of the remaining nodes to 0: Risk 0 =[0,...,0,Ts,0,...,0]; Using weighted propagation, the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) =Risk (k) ·W+α·Risk (k) Where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the decay coefficient (ranging from 0.1 to 0.3 to prevent infinite diffusion), and the termination condition is when the change in risk value after iteration is less than the termination threshold (e.g., 0.0.1) or the maximum number of iterations is reached.

[0076] For example, there are 3 devices A, B, and C, with the following dependencies:

[0077] Device A (the attacked node) is directly dependent on Device B (weight 1);

[0078] Device B and Device C are indirectly dependent (weight 0.5);

[0079] Device A and Device C have no direct dependency (weight 0);

[0080] Initial conditions: The threat score Ts of the attacked device A is 0.8 (after normalization), and the adjacency matrix: Decay coefficient α = 0.2;

[0081] Initial risk vector: Risk 0 = [0.8, 0, 0];

[0082] First iteration (k = 0): Risk (1) = Risk (0) ·W + α·Risk (0) = [0.16, 0.8, 0];

[0083] Second iteration (k = 1): Risk (2) = Risk (1) ·W + α·Risk (1) = [0.032, 0.32, 0.4];

[0084] Subsequent iterations, and finally converge;

[0085] Step 303: Sort all devices in descending order of the risk diffusion value to form a risk diffusion priority list. Combine the threat score and adjust the isolation strategy: If the threat score < F1, only monitor the device with the highest risk diffusion value and record the log; If F1 ≤ threat score < F2, trigger an alarm and restrict the operation permissions of the top several devices with the highest risk diffusion value. If F2 ≤ the current threat score, immediately isolate the top several devices with the highest risk diffusion value (such as isolating the top 5 devices with the highest risk diffusion value).

[0086] When in use, combine the content of Steps 301 to 304:

[0087] By constructing a device dependency graph and quantifying risk diffusion, the impact degree of the attacked device on other devices can be accurately evaluated. By forming a risk diffusion priority list and dynamically adjusting the isolation strategy in combination with the threat score, differential response can be achieved, which can avoid over-isolation affecting production and timely and effectively control the spread of high-risk risks while ensuring industrial network security and maintaining production continuity.

[0088] Step Four: Use an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and process parameter adjustment plan, and issue a recovery instruction to achieve safe recovery.

[0089] The said Step Four includes the following content:

[0090] Step 401: According to the several devices isolated in Step Three, determine the corresponding process parameter deviations (such as the temperature deviating from the set value by ±50°C, the feeding rate fluctuating > 15%), and define the recovery target:

[0091] Objective 1: The recovery time should be less than or equal to three times the current production cycle time (for example, if the cycle time of a cement production line is 2 hours, then the recovery time should be less than 6 hours).

[0092] Objective 2: Mass Loss Coefficient Where, Δp i β represents the adjustment range of the i-th process parameter (such as KH value, clinker free calcium content). i For quality weights, 0 < β i <1, where n is the number of process parameters;

[0093] Objective 3: The total energy consumption increase is less than 20% of the energy consumption under normal operating conditions;

[0094] Step 402: Use the improved multi-objective genetic algorithm (NSGA-II) to solve for the Pareto optimal solution set. The model is defined as follows:

[0095] Decision variable: Equipment recovery order G = [g1, g2, ..., g j ], where g j This represents the recovery sequence number of the j-th device. For example, G = [3, 1, 2] indicates that the recovery sequence is device 2 → device 3 → device 1; the process parameter adjustment range ΔP = [Δp1, Δp2, ..., Δp n ];

[0096] Constraints: Process constraints: (e.g., raw material feeding rate adjustment range ±10%) These represent the minimum and maximum adjustment ranges for the i-th process parameter, respectively; Equipment dependency constraint: If equipment A depends on equipment B, the recovery order must satisfy g. B <g A Security constraints: Threat score during recovery process <F1;

[0097] Fitness function: Among them, T recovery Indicates recovery time, Path q Let t represent the dependency path of the q-th device. k' Represents Path q The startup time of the k'th device, E add e represents the total energy consumption increment. j This represents the energy consumption increment of the j-th device, where m is the number of devices;

[0098] For example, if the device dependency is A→B→C and the recovery order is A→B→C, then the recovery time = t_A + t_B + t_C; if parallel recovery of dependent devices is allowed, the total time is taken as the longest path.

[0099] Step 403: Randomly generate an initial population containing several individuals, each representing a recovery scheme. Calculate the Pareto rank of each individual, prioritizing non-dominated solutions. Employ simulated binary crossover (SBX, crossover probability 0.8) and polynomial mutation (mutation probability 0.1). Merge the parent and offspring populations, selecting the top few elite individuals to advance to the next generation. After several iterations, select three representative schemes from the Pareto front:

[0100] Option A (Time-optimal): Shortest recovery time, but higher quality loss and energy consumption increase;

[0101] Option B (Optimal Quality): Minimum quality loss coefficient, extended recovery time, and increased energy consumption;

[0102] Option C (Optimal Energy Consumption): Minimal energy consumption increment, allowing for higher mass loss and extended recovery time;

[0103] Step 404: Select a solution based on production needs (e.g., select solution A if the order is urgent), and issue instructions through the Distributed Control System (DCS):

[0104] Start the devices in the order they are restored, and monitor the threat score after a certain delay (e.g., 5 minutes) after each device is started.

[0105] Adjust the process parameters according to the adjustment range, and use a ramp function to control the rate of change (e.g., the temperature rises by 100°C per hour);

[0106] When using this method, please refer to the content of steps 401 to 404:

[0107] By determining process parameter deviations and defining multi-objective recovery objectives, and using an improved multi-objective genetic algorithm to solve for the optimal solution set, the system can flexibly select appropriate recovery schemes from the Pareto frontier based on production needs, taking into account recovery time, quality loss, and energy consumption increments. It can also accurately issue instructions according to the equipment recovery sequence and parameter adjustment range, ensuring rapid, safe, and orderly production recovery and improving the system's recovery capability after attacks.

[0108] Please see Figure 3 The present invention also provides a network security protection management system based on big data, including: a data acquisition module, a threat assessment module, a risk diffusion analysis module, and a recovery strategy execution module;

[0109] The data acquisition module collects industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior features, physical features, and process correlation features, and constructs an industrial security feature vector.

[0110] The threat assessment module calculates the threat score of the equipment based on the safety weight coefficient of the current process stage and the industrial safety feature vector, and dynamically adjusts the threat level through a three-level verification mechanism.

[0111] The risk diffusion analysis module constructs a device dependency graph, performs risk diffusion calculations based on the adjacency matrix and attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy.

[0112] The recovery strategy execution module uses an improved multi-objective genetic algorithm to solve for the Pareto optimal solution set, determine the equipment recovery sequence and process parameter adjustment scheme, and issue recovery commands to achieve safe recovery.

[0113] In the application, the various formulas mentioned are all calculated by removing dimensions and taking their numerical values. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The coefficients in the formulas are set by those skilled in the art according to the actual situation.

[0114] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, and combinations thereof. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0115] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0116] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A management method for network security protection based on big data, characterized in that, It includes: Collect industrial protocol layer data, physical sensor data and process parameters, extract network behavior features, physical features and process correlation features, and construct an industrial security feature vector; According to the security weight coefficient of the current process stage and the industrial security feature vector, calculate the threat score of the device, and dynamically adjust the threat level through a three-level verification mechanism, including: First-level verification: Check whether the source IP of the instruction is in the trusted list. If the verification fails, determine that the instruction is abnormal; Second-level verification: Compare whether the current process stage allows this operation. If the verification fails, determine that the instruction is abnormal; Third-level verification: Check whether the sensor data is normal. If the verification fails, determine that the physical condition is abnormal; Preset a security threshold range [F1, F2]. If the instruction is abnormal or the physical condition is abnormal, determine that the danger level is medium risk. If the current threat score < F1, directly increase the score to F1. If F1 ≤ the current threat score, keep the current threat score; If the instruction abnormality and the physical abnormality occur simultaneously, directly determine that the danger level is high risk. If the current threat score < F2, directly increase the score to F2. If F2 ≤ the current threat score, keep the current threat score; Construct a device dependency graph, perform risk diffusion calculation based on the adjacency matrix and the attenuation coefficient, and generate a risk diffusion priority list to adjust the isolation strategy; Use an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determine the device recovery order and the process parameter adjustment plan, and issue a recovery instruction to achieve safe recovery.

2. The management method for network security protection based on big data according to claim 1, characterized in that, The collection of industrial protocol layer data, physical sensor data and process parameters, and the extraction of network behavior features, physical features and process correlation features include: Deploy protocol probes to capture Modbus / TCP communication data in real time, record the function code call frequency, timestamp and abnormal packet information; collect physical sensor data, including the temperature change rate and vibration spectrum energy, and form physical features through normalization processing; synchronously collect process parameters and network traffic data, and use an improved FastDTW algorithm to calculate the alignment distance and extract process correlation features.

3. The management method for network security protection based on big data according to claim 1, characterized in that, The calculation of the threat score of the device according to the security weight coefficient of the current process stage and the industrial security feature vector includes: Divide the process stage according to the temperature of the kiln system, and assign a security weight coefficient ω to each stage; the threat score calculation formula of the device is: Ts = ω·||F||2, where ||F||2 represents the L2 norm of the industrial security feature vector F; if the threat score < F1, determine that the danger level is low risk or normal; if F1 ≤ the threat score < F2, determine that the danger level is medium risk; if F2 ≤ the threat score, determine that the danger level is high risk.

4. The management method for network security protection based on big data according to claim 1, characterized in that, The construction of the device dependency graph includes: Define the devices in the industrial control system as graph nodes, construct a device dependency graph, assign edge weights according to the physical connection or data communication relationship between devices. If devices communicate directly or are physically associated, set the edge weight to 1. If devices are indirectly dependent, set the edge weight to 0.

5. If there is no direct or indirect dependence between devices, set the edge weight to 0, and fill the edge weights into the adjacency matrix.

5. The management method for network security protection based on big data according to claim 4, characterized in that, Performing risk diffusion calculation based on the adjacency matrix and attenuation coefficient, including: Set the initial risk value of the attacked device to the current threat score, and set the initial risk value of all other nodes to 0: Risk 0 =[0,...,0,Ts,0,…,0]; Using weighted propagation, the risk diffusion value is calculated through the adjacency matrix: Risk (k+1) =Risk (k) ·W+α·Risk (k) Where Risk represents the risk diffusion value, k represents the number of iterations, W is the adjacency matrix, α is the decay coefficient, and the termination condition is when the change in risk value after iteration is less than the termination threshold or the maximum number of iterations is reached.

6. The management method for network security protection based on big data according to claim 5, characterized in that, Generating a risk diffusion priority list to adjust the isolation strategy, including: Sorting all devices according to the risk diffusion value from high to low to form a risk diffusion priority list, and combining the threat score to adjust the isolation strategy: If the threat score < F1, only monitor the device with the highest risk diffusion value and record the log; if F1 ≤ threat score < F2, trigger an alarm and restrict the operation permissions of the top several devices with the highest risk diffusion values; if F2 ≤ the current threat score, immediately isolate the top several devices with the highest risk diffusion values.

7. The management method for network security protection based on big data according to claim 1, characterized in that: Defining the recovery objectives including recovery duration, quality loss coefficient, and energy consumption increment; the decision variables are the device recovery order and the adjustment range of process parameters; using a multi-objective genetic algorithm to solve the Pareto optimal solution set, and selecting 3 representative solutions from the Pareto front: Solution A: the shortest recovery time; Solution B: the smallest quality loss coefficient; Solution C: the smallest energy consumption increment.

8. The management method for network security protection based on big data according to claim 7, characterized in that: Selecting a solution according to production requirements and issuing instructions through the distributed control system: starting devices in the device recovery order, and delaying for a certain time to monitor the threat score after starting each device; adjusting the process parameters according to the adjustment range of process parameters, and using a ramp function to control the change rate.

9. A management system for network security protection based on big data, used to implement the method described in any one of claims 1 to 8, characterized in that: Including: A data acquisition module that acquires industrial protocol layer data, physical sensor data, and process parameters, extracts network behavior characteristics, physical characteristics, and process correlation characteristics, and constructs an industrial security feature vector; A threat assessment module that calculates the threat score of the device according to the security weight coefficient of the current process stage and the industrial security feature vector, and dynamically adjusts the threat level through a three-level verification mechanism; A risk diffusion analysis module that constructs a device dependency graph, performs risk diffusion calculation based on the adjacency matrix and attenuation coefficient, and generates a risk diffusion priority list to adjust the isolation strategy; A recovery strategy execution module that uses an improved multi-objective genetic algorithm to solve the Pareto optimal solution set, determines the device recovery order and the process parameter adjustment plan, and issues a recovery instruction to achieve a safe recovery.

Images