Smart city fine management platform based on GIS

Abstract

The invention provides a smart city fine management platform based on a GIS, is applied to the technical field of smart city management, and determines geographical location information of an attacked object by receiving security event data of a honeynet system and extracting attack target information. And then emergency resource data are collected from independent systems of all departments, and standardization processing is carried out. And generating an emergency response scheme by using the standardized emergency resource information according to the hit geographical location information and the attack target information, and distributing the emergency response scheme to a corresponding department. Therefore, the emergency scheme can be effectively executed, and cross-department collaborative response is realized. According to the platform, through integration and cooperation of the modules, an automatic process from security event monitoring to emergency scheme generation and distribution is realized, and the response efficiency of the smart city to the network security event is improved.

Description

Technical Field

[0001] The present application relates to the technical field, and in particular to a GIS-based smart city refined management platform. Background Art

[0002] In the daily operations of smart cities, key areas such as urban infrastructure and public service systems continuously generate massive amounts of operational data. The effective collection, standardized management, and efficient application of this data are fundamental to ensuring the smooth operation of smart cities. GIS technology, with its powerful spatial data management, analysis, and visualization capabilities, plays an indispensable role in smart cities. It is widely used for the spatial presentation of urban management objects, real-time status monitoring, and refined location-based management. For example, it enables the visualization and refined management of transportation networks, underground pipelines, various buildings, and environmental monitoring sites.

[0003] However, with the continuous advancement of urban informatization, cybersecurity threats are becoming increasingly severe. Critical urban infrastructure and important management objects are facing a variety of cyberattack risks. To effectively monitor and respond to these potential threats, large-scale distributed honeynet systems are being deployed within smart city networks. These honeynet systems simulate real-world system environments to entrap attackers and record detailed attack data, including attack type, source, time of occurrence, and specific targets.

[0004] When the honeynet system successfully detects such a coordinated attack, city managers need to quickly organize a cross-departmental emergency response. However, current emergency response processes often rely heavily on manual coordination and decision-making. However, this rapid, multi-factor, multi-constraint decision-making and resource matching process is prone to information omissions and misjudgment, leading to misallocation of emergency resources or delayed response actions. This highly manual decision-making and coordination model fails to meet the urgent need to quickly generate and effectively execute cross-departmental emergency response plans after a cybersecurity incident occurs, severely limiting the efficiency and effectiveness of smart cities' response to cybersecurity emergencies.

[0005] Therefore, faced with the challenges of complex, heterogeneous data sources and time urgency, achieving rapid and accurate matching of emergency resources based on comprehensive judgment of multiple factors, and automatically generating emergency response plans that can be directly understood and executed by the existing command and dispatch systems of different departments, are key technical problems that need to be urgently solved in the current field of smart city security operations. Summary of the Invention

[0006] In view of the above-mentioned shortcomings of the existing technology, the present application provides a GIS-based smart city refined management platform, which has the beneficial effects of realizing the automated processing of security incident data, determining the geographical location information of the attacked, standardizing emergency resource data, generating emergency response plans, distributing emergency response instructions, and realizing cross-departmental collaborative emergency response.

[0007] In a first aspect, a GIS-based smart city refined management platform is provided, comprising:

[0008] Data acquisition module: used to obtain security event data sent by the honeynet system, analyze the security event data, and extract attack target information;

[0009] Position acquisition module: used to determine the geographical location of the target based on the attack target information;

[0010] Resource collection module: used to collect emergency resource data from the independent systems of various departments, standardize the collected emergency resource data, and obtain emergency resource information in a unified format;

[0011] Resource allocation module: used to allocate the emergency resource information to the attacked object corresponding to the attack target information according to the geographical location information, and generate an emergency response plan;

[0012] Instruction distribution module: used to convert emergency response plans into instruction formats that can be understood and executed by the existing command and dispatch systems of various departments, and distribute them to the corresponding departments.

[0013] Furthermore, the data acquisition module includes:

[0014] Monitoring module: The monitoring module is equipped with a data interface of the honeynet system, which is used to monitor and receive the original data of security events pushed by the honeynet system in real time;

[0015] Data processing module: used to clean the original data of the security incident using multiple preset data cleaning rules to obtain security incident data;

[0016] Extraction module: used to extract initial attack target information based on the security event data;

[0017] Credibility evaluation module: used to compare the initial attack target information with the known threat intelligence library to obtain a credibility evaluation result. When the credibility evaluation meets the preset conditions, the initial attack target information is used as the target attack information.

[0018] Furthermore, the initial attack target information includes at least an IP address, a domain name, and an application service name, and the threat intelligence library includes at least a malicious IP address library, a malicious domain name library, and a malicious application service name library;

[0019] The credibility assessment module includes:

[0020] Query module: used to match the IP address, the domain name and the application service name in the initial attack target information with the malicious IP address library, the malicious domain name library and the malicious application service name library, respectively, to obtain a query result;

[0021] Recording module: for marking the initial attack target information as suspicious and recording the threat type and threat level of the initial attack target information if the query result shows that the initial attack target information exists in the threat intelligence library;

[0022] A calculation module is configured to calculate a credibility score according to the threat type and the threat level, and when the credibility score is greater than or equal to a preset credibility threshold, use the initial attack target information as the target attack information.

[0023] Furthermore, the calculation module includes:

[0024] Construction module: Construct a threat intelligence scoring matrix, wherein the rows of the threat intelligence scoring matrix represent threat types, the columns represent threat levels, and the matrix elements are preset scoring values corresponding to the threat types and threat levels;

[0025] A first scoring acquisition module: searching a corresponding preset scoring value from a threat intelligence scoring matrix according to the threat type and the threat level as the threat intelligence score of the initial attack target information;

[0026] A second scoring acquisition module is used to determine the authority score of the threat intelligence library based on the update frequency, data source and historical accuracy of the threat intelligence library;

[0027] A scoring calculation module is used to calculate a credibility score based on the threat intelligence score and the authority score. The calculation formula is: credibility score = threat intelligence score * (1 + authority score). When the credibility score is greater than or equal to a preset credibility threshold, the initial attack target information is used as the target attack information.

[0028] Furthermore, the location acquisition module includes:

[0029] Parsing module: parses the attack target information to obtain the IP address, domain name and application service name;

[0030] Positioning module: determining the geographical coordinates of the hit location based on the IP address, domain name, or application service name;

[0031] Position query module: Based on the geographic location coordinates, perform spatial query in the GIS geographic information database to determine the buildings, roads, infrastructure and pipe network information associated with the geographic location coordinates, and generate the geographic location information of the affected area.

[0032] Furthermore, the positioning module includes:

[0033] A first positioning query module: queries an IP address database according to the IP address or the domain name or the application service name, and if corresponding coordinates are found in the IP address database, uses the coordinates as the geographic location coordinates;

[0034] The second positioning query module: if no corresponding coordinates are found in the IP address database, the operator base station positioning data is obtained, the coordinates of the base station are determined according to the correspondence between the IP address and the base station, and the coordinates of the base station are used as the geographic location coordinates.

[0035] Furthermore, the resource collection module includes:

[0036] Collection module: used to collect original emergency resource data from independent systems of various departments;

[0037] Cleaning module: used for cleaning the original emergency resource data to obtain cleaned original emergency resource data;

[0038] Standardization module: used to map the cleaned emergency resource data to standard fields, convert the data type to the standard data type, and generate the emergency resource information in a unified format.

[0039] Furthermore, the resource allocation module includes:

[0040] Construction module: used to associate emergency resource nodes and department authority nodes with the affected object as the central node, and build a cross-department emergency resource association map;

[0041] A search module is configured to search, based on the geographic location information, the cross-departmental emergency resource association map for emergency resource nodes and department authority nodes associated with the affected object, to obtain a candidate emergency resource set and a candidate department authority set;

[0042] Resource calculation module: used to calculate the matching degree of each emergency resource node in the candidate emergency resource set according to the resource capability attribute and the resource demand corresponding to the attack target information, and screen the emergency resource nodes that meet the scheduling authority level requirements according to the department authority level attributes in the candidate department authority set to obtain the available emergency resource set;

[0043] Plan generation module: used to generate emergency resource allocation plans based on the location attributes of emergency resource nodes in the available emergency resource set. The emergency resource allocation plan includes cross-departmental task allocation and resource scheduling instructions.

[0044] Furthermore, the resource calculation module includes:

[0045] The first parsing module is used to parse the resource capability attributes of each emergency resource node in the candidate emergency resource set, extract resource type, performance indicators, and applicable scope information, and construct a resource capability vector;

[0046] The second parsing module is used to parse attack target information, identify attack types and affected objects, determine resource types, performance indicators, and applicable scope, and construct resource demand vectors.

[0047] The first calculation module is used to calculate the cosine similarity between the resource capability vector and the resource demand vector as the resource matching score, query the table of correspondence between department authority level and resource schedulability, and determine the actual schedulability score of each department for the emergency resource node;

[0048] The second calculation module is used to multiply the resource matching score by the actual schedulability score to obtain a comprehensive score, and to screen emergency resource nodes whose comprehensive scores are greater than or equal to a preset threshold to form an available emergency resource set.

[0049] Furthermore, the instruction distribution module includes:

[0050] The third parsing module is used to parse the emergency response plan, extract cross-departmental task allocation information and resource scheduling instructions, and determine the types of instructions that each department needs to execute;

[0051] Conversion module: used to obtain the identification of each department, determine the type of command and dispatch system corresponding to each department based on the department identification, determine the instruction format based on the instruction type, and convert cross-departmental task allocation information and resource scheduling instructions into the instruction format corresponding to the command and dispatch system of each department;

[0052] Generation module: used to map the data fields in the emergency response plan to the corresponding fields in the command and dispatch system of each department, and generate instructions that can be understood and executed by the command and dispatch system of each department;

[0053] Distribution module: used to classify the converted instructions according to departments, and distribute the instructions to the corresponding departments through the data interface of the command and dispatch system of each department.

[0054] Beneficial Effects: This application proposes a GIS-based smart city refined management platform. The data acquisition module receives security event data from the honeynet system, parses the data, and extracts attack target information. This serves as the starting point for the emergency response process, providing basic facts about the attack. The location acquisition module uses the attack target information to determine the geographic location of the target. This provides a spatial basis for subsequent location-based resource scheduling. The resource acquisition module collects emergency resource data from independent systems across departments and standardizes it to generate emergency resource information in a unified format. This resolves the problem of heterogeneous data across departments and provides available resource data for resource allocation. The resource allocation module uses standardized emergency resource information based on the location and target information of the target to generate an emergency response plan. This is the platform's core decision-making function, matching available resources with emergency needs. The command distribution module converts the generated emergency response plan into a command format that can be understood and executed by the command and dispatch systems of each department and distributes it to the corresponding department. This ensures the effective implementation of the emergency plan and achieves a coordinated cross-departmental response. Through the integration and collaboration of these modules, the platform implements an automated process from security event monitoring to emergency plan generation and distribution, improving the efficiency of smart city response to cybersecurity incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a structural diagram of a GIS-based smart city refined management platform proposed in this application.

[0056] Figure 2 This is the system block diagram of the GIS-based smart city refined management platform proposed in this application.

[0057] Description of reference numerals: 101, data acquisition module; 102, location acquisition module; 103, resource acquisition module; 104, resource allocation module; 105, instruction distribution module. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and marked in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work fall within the scope of protection of the present application.

[0059] It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0060] Please refer to Figure 1 、 Figure 2 , a GIS-based smart city refined management platform, the platform includes:

[0061] Data acquisition module 101: used to obtain security event data sent by the honeynet system, parse the security event data, and extract attack target information;

[0062] Position acquisition module 102: used to determine the geographical location of the target according to the attack target information;

[0063] Resource collection module 103: used to collect emergency resource data from independent systems of various departments, standardize the collected emergency resource data, and obtain emergency resource information in a unified format;

[0064] Resource allocation module 104: used to allocate emergency resource information to the attacked object corresponding to the attack target information according to the geographical location information, and generate an emergency response plan;

[0065] Instruction distribution module 105: used to convert the emergency response plan into an instruction format that can be understood and executed by the existing command and dispatch system of each department, and distribute it to the corresponding department.

[0066] The data acquisition module 101 may be configured with a data interface connected to the honeynet system, through which the original data of security events may be received in real time, and the original data may be cleaned and analyzed to identify attack target information, such as the IP address or domain name involved in the attack.

[0067] The location acquisition module 102 receives the attack target information, maps the attack target to a specific geographic coordinate by querying the geographic information database or using positioning technology, and queries the city management object and its spatial information associated with the coordinate in the GIS system to generate the geographic location information of the target.

[0068] The resource acquisition module 103 can establish a connection with the independent emergency resource systems of various urban departments, obtain original resource data through data interfaces or file imports, and then apply preset data cleaning rules to remove invalid or duplicate data and perform standardization processing. For example, the resource type, status, location and other fields in different systems are uniformly mapped to standard fields, and the data format is converted into a unified format, thereby solving the problem of heterogeneous data in various departments and providing available data for subsequent resource allocation.

[0069] The resource allocation module 104 receives the geographical location information of the attacked area and the attack target information, and uses the standardized emergency resource information to determine the type, quantity and source of the emergency resources that need to be dispatched through matching algorithms and decision logic, and generates an emergency response plan that includes task allocation and resource scheduling details, thereby improving the accuracy and efficiency of resource matching.

[0070] The instruction distribution module 105 receives the emergency response plan, queries the interface specifications and instruction formats of each department's command and dispatch system according to the department and task type specified in the plan, converts the information in the emergency response plan into an instruction format that can be recognized and executed by the corresponding system, and sends it to each department's system through the interface, thereby realizing the automated execution of the emergency plan and cross-departmental collaboration.

[0071] Specifically, when the honeynet system detects a cyberattack against smart city infrastructure, the security event data is sent to the data acquisition module 101. The data acquisition module 101 parses the data and extracts the attack target, such as the IP address of an attacked substation. The location acquisition module 102 receives the IP address, locates it by the IP address, or queries the asset database to determine the geographic coordinates of the substation, and queries the GIS system for geographic location information such as the building and area corresponding to the coordinates. Simultaneously, the resource acquisition module 103 collects resource data such as emergency repair personnel, vehicles, and equipment from independent systems of departments such as electricity, transportation, and emergency management, and performs cleaning and standardization processing to form a unified emergency resource information database.

[0072] The resource allocation module 104 combines the geographical location of the substation, the type of attack (such as equipment failure) and standardized emergency resource information to evaluate the required emergency resource type (such as power repair vehicles, professional technicians), and searches for qualified resources in the resource library. Taking into account factors such as the distance between the resource and the substation, the current status of the resource, and the authority of the department to which it belongs, it generates an emergency response plan, which may include assigning the nearest power repair team to the scene, coordinating with the transportation department to provide transportation guarantees, etc.

[0073] The instruction distribution module 105 receives the plan, identifies the need to notify the power and transportation departments, queries the instruction formats in the command and dispatch systems of these two departments, converts the tasks and dispatch information in the plan into the emergency repair work order format for the power department and the dispatch instruction format for the transportation department, and sends them through their respective data interfaces, thereby initiating emergency response actions. Through this process, the platform achieves automated and refined management from the occurrence of a security incident to the issuance of emergency resource dispatch instructions, significantly shortening response time and reducing the complexity of manual coordination.

[0074] Furthermore, the data acquisition module includes:

[0075] Monitoring module: The monitoring module is equipped with a data interface of the honeynet system, which is used to monitor in real time and receive the original data of security events pushed by the honeynet system;

[0076] Data processing module: used to clean the original data of security events using multiple preset data cleaning rules to obtain security event data;

[0077] Extraction module: used to extract initial attack target information based on security event data;

[0078] Credibility assessment module: used to compare the initial attack target information with the known threat intelligence library to obtain the credibility assessment result. When the credibility assessment meets the preset conditions, the initial attack target information is used as the target attack information.

[0079] Specifically, the monitoring module establishes a data connection with the honeynet system and continuously receives the raw data stream of security events generated by the honeynet system. The received raw data is transmitted to the data processing module.

[0080] The data processing module applies a series of preset data cleaning rules, such as removing duplicate records, correcting format errors, filtering known false positive patterns, etc., to process the raw data and generate structured and standardized security event data.

[0081] The cleaned security event data is fed into the extraction module, which identifies and extracts preliminary attack target information, such as IP addresses, domain names, and application service names. This initial attack target information is then passed to the credibility assessment module, which compares this initial information with a pre-built or imported threat intelligence library. The threat intelligence library contains a list of known malicious entities and their associated information.

[0082] Through comparison, the credibility assessment module determines whether the initial attack target information exists or is relevant in the threat intelligence library, and generates a credibility assessment based on the comparison results. Only when the assessment result reaches or exceeds the preset credibility threshold is the initial attack target information confirmed as valid and credible target attack information and output for use by subsequent platform modules. Information that fails the credibility assessment is discarded or marked as low priority, effectively filtering out noise and unreliable attack events, ensuring that subsequent emergency response is based on accurate attack target information.

[0083] Furthermore, the initial attack target information includes at least an IP address, a domain name, and an application service name, and the threat intelligence database includes at least a malicious IP address database, a malicious domain name database, and a malicious application service name database;

[0084] The credibility assessment module includes:

[0085] Query module: used to match the IP address, domain name and application service name in the initial attack target information with the malicious IP address database, malicious domain name database and malicious application service name database respectively to obtain the query results;

[0086] Recording module: used to mark the initial attack target information as suspicious if the query result shows that the initial attack target information exists in the threat intelligence library, and record the threat type and threat level of the initial attack target information;

[0087] Calculation module: used to calculate the credibility score according to the threat type and threat level. When the credibility score is greater than or equal to the preset credibility threshold, the initial attack target information is used as the target attack information.

[0088] Specifically, the credibility assessment module receives the initial attack target information extracted by the data processing module. The initial attack target information includes the IP address, domain name, and application service name.

[0089] The query module first queries the IP address against a database of malicious IP addresses. Simultaneously or subsequently, it queries the domain name against a database of malicious domain names and the application service name against a database of malicious application service names. The query results indicate whether the initial attack target information exists in any threat intelligence database. If the query results indicate that the initial attack target information exists in a threat intelligence database, the recording module marks the information as suspicious and retrieves the threat type (e.g., botnet, phishing website, malicious application) and threat level (e.g., high, medium, low) recorded in the threat intelligence database.

[0090] The calculation module calculates a credibility score based on the recorded threat type and threat level using a preset scoring model. For example, initial attack target information with a threat level of "high" and a type of "botnet" may receive a lower credibility score.

[0091] The calculation module compares the calculated credibility score with a preset credibility threshold. If the credibility score is greater than or equal to the preset credibility threshold, the initial attack target information is sufficiently credible to be confirmed as authentic attack target information and passed to subsequent modules for processing. Conversely, if the score is lower than the threshold, the information may be considered a false alarm or low threat and will not be processed as targeted attack information.

[0092] Therefore, through the structured query, recording and calculation process, the quantitative evaluation and screening of the initial attack target information is achieved, and the accuracy of subsequent emergency response is improved.

[0093] Furthermore, the calculation module includes:

[0094] Construction module: Construct a threat intelligence scoring matrix. The rows of the threat intelligence scoring matrix represent threat types, the columns represent threat levels, and the matrix elements are preset scoring values corresponding to threat types and threat levels.

[0095] The first scoring acquisition module searches for a corresponding preset scoring value from the threat intelligence scoring matrix based on the threat type and threat level, and uses this value as the threat intelligence score for the initial attack target information.

[0096] The second scoring module is used to determine the authority score of the threat intelligence library based on its update frequency, data source, and historical accuracy.

[0097] Scoring calculation module: used to calculate the credibility score based on the threat intelligence score and the authority score. The calculation formula is: credibility score = threat intelligence score * (1 + authority score). When the credibility score is greater than or equal to the preset credibility threshold, the initial attack target information is used as the target attack information.

[0098] Specifically, in order to address the possible deficiencies in calculating credibility scores based solely on threat type and threat level, the technical solution of this application improves the accuracy of credibility assessment of attack target information by introducing an assessment of the authority of threat intelligence sources.

[0099] The construction module establishes a threat intelligence scoring matrix to provide basic data for subsequent scoring calculations.

[0100] The first score acquisition module acquires a score based on threat characteristics from the score matrix according to the threat type and threat level of the initial attack target information.

[0101] The second scoring acquisition module evaluates the reliability of the threat intelligence library itself, taking into account factors such as update frequency, data source, and historical accuracy, and calculates the authority score of the threat intelligence library. The scoring calculation module combines the score based on threat characteristics with the score based on the quality of the intelligence source, and calculates the final credibility score through a calculation formula. This formula applies the authority of the intelligence source as a weighting factor to the score based on threat characteristics, so that information from more authoritative intelligence sources obtains a higher credibility score. Only when the calculated credibility score reaches the preset threshold is the initial attack target information confirmed as target attack information. Through the collaborative work of the above modules, this technical solution can more comprehensively and accurately evaluate the credibility of the initial attack target information, thereby improving the reliability of subsequent processing.

[0102] Furthermore, the location acquisition module includes:

[0103] Parsing module: parses attack target information to obtain IP addresses, domain names, and application service names;

[0104] Positioning module: Determines the geographic coordinates of the target location based on the IP address, domain name, or application service name;

[0105] Location query module: Based on the geographic location coordinates, perform spatial query in the GIS geographic information database to determine the buildings, roads, infrastructure and pipeline network information associated with the geographic location coordinates, and generate the geographic location information of the affected area.

[0106] Specifically, in the face of coordinated network attacks against cross-departmental management objects within a specific geographical area, the platform needs to convert the attack target information in the security event data monitored by the honeynet system into geographic location information.

[0107] First, the parsing module receives the target information and extracts key identifiers such as IP addresses, domain names, or application service names that can be used for positioning. The positioning module then uses these extracted identifiers to determine the target's geographic coordinates, such as longitude and latitude, by querying the corresponding positioning database or service.

[0108] The location query module then receives the geographic coordinates and performs a spatial query within the GIS database. This query aims to identify the geographic entities spatially associated with the coordinates, such as the building where the coordinates are located, nearby roads, associated infrastructure, or underground pipe networks. This transforms simple geographic coordinates into geographic location information with rich spatial context, generating the resulting location information containing information about buildings, roads, infrastructure, and pipe networks.

[0109] Through this series of steps, the platform achieves accurate conversion from network-level attack target information to physical space geographic location information, solves the problem of how to accurately convert different forms of attack target information into geographic location coordinates and associate them with specific geographic entities in GIS, and provides a geographic space foundation for subsequent emergency resource allocation and plan generation.

[0110] Furthermore, the positioning module includes:

[0111] The first positioning query module: queries the IP address database according to the IP address, domain name or application service name. If the corresponding coordinates are found in the IP address database, the coordinates are used as the geographic location coordinates;

[0112] Second positioning query module: If no corresponding coordinates are found in the IP address database, the operator's base station positioning data is obtained, and the coordinates of the base station are determined based on the correspondence between the IP address and the base station, and the coordinates of the base station are used as the geographic location coordinates.

[0113] Specifically, in the context of smart city GIS refined management, when faced with coordinated cyberattacks targeting cross-departmental managed objects within a specific geographic area, the honeynet system detects security incidents and provides information on attack targets. To implement location-based emergency response, the precise location of the attacked object must be determined. However, relying solely on a single IP address database query may fail to retrieve coordinates due to incomplete or outdated data, or the obtained coordinates may be insufficiently accurate.

[0114] This solution solves this problem by introducing a hierarchical positioning mechanism. First, the first positioning query module attempts to use the IP address library for rapid positioning. The IP address library usually contains a mapping relationship between IP addresses and geographical areas, which can quickly provide a preliminary geographical location. If the IP address library query is successful, the obtained coordinates are used. If there is no corresponding coordinate information in the IP address library, the system automatically enables the second positioning query module. The second positioning query module uses the base station positioning data provided by the operator. This data is usually associated with a specific network connection point (such as an IP address), and the geographical location of the base station is known. By finding the base station associated with the IP address of the attack target, a more accurate regional location can be determined than the IP address library positioning. The coordinates of the base station are used as the coordinates of the geographical location of the target, providing more reliable geographical basic data for subsequent GIS spatial analysis and emergency resource allocation. This combined method improves the reliability of determining the coordinates of the geographical location of the target in a complex network environment and reduces the risk of emergency response interruption due to positioning failure.

[0115] Furthermore, the resource collection module includes:

[0116] Collection module: used to collect original emergency resource data from independent systems of various departments;

[0117] Cleaning module: used to clean the original emergency resource data to obtain the cleaned original emergency resource data;

[0118] Standardization module: used to map the cleaned emergency resource data to standard fields, convert data types into standard data types, and generate emergency resource information in a unified format.

[0119] Specifically, faced with the problem that the original emergency resource data collected from independent systems of various departments have inconsistent formats, contain invalid or redundant information, and are difficult to directly and effectively standardize, this solution solves this problem by introducing cleaning modules and standardization modules.

[0120] First, the acquisition module is responsible for acquiring raw emergency resource data from independent systems scattered across different departments. This raw data may come from different databases, files, or API interfaces, with different formats and structures.

[0121] Next, the cleansing module processes the collected raw emergency resource data. This cleansing process aims to improve data quality and reliability. For example, it can identify and remove duplicate resource records, correct incorrect contact or location information, address missing key attribute values, and filter out data that doesn't conform to business logic. After cleansing, the data quality is improved and errors and inconsistencies are reduced.

[0122] The standardization module then receives the cleaned data and converts it into a unified format. This includes mapping the different field names used by different departments (e.g., "personnel number," "equipment ID," "vehicle license plate") to standard fields defined within the system (e.g., "resource unique identifier") and converting different data representations (e.g., text status "free," "busy" or numeric codes "0," "1") into a unified standard data type and value range.

[0123] Through the three steps of collection, cleaning, and standardization, this solution ensures that the final emergency resource information generated is in a unified format and reliable, and can be effectively utilized by subsequent resource allocation modules, thereby supporting the rapid and accurate matching and allocation of emergency resources based on this information, and solving the problem of inefficient emergency response caused by data heterogeneity and quality issues.

[0124] Furthermore, the resource allocation module includes:

[0125] Construction module: used to associate emergency resource nodes and department authority nodes with the affected object as the central node, and build a cross-department emergency resource association map;

[0126] Search module: used to search for emergency resource nodes and department authority nodes associated with the affected object in the cross-department emergency resource association map based on geographic location information, and obtain a candidate emergency resource set and a candidate department authority set;

[0127] Resource calculation module: for each emergency resource node in the candidate emergency resource set, it calculates the matching degree based on the resource capability attributes and the resource requirements corresponding to the attack target information, and screens the emergency resource nodes that meet the scheduling authority level requirements based on the department authority level attributes in the candidate department authority set to obtain the available emergency resource set;

[0128] Plan generation module: used to generate emergency resource allocation plans based on the location attributes of emergency resource nodes in the available emergency resource set. The emergency resource allocation plan includes cross-departmental task allocation and resource scheduling instructions.

[0129] Specifically, when the platform receives processed security event data and determined geographical location information of the attacked location, the resource allocation module starts working.

[0130] First, the construction module retrieves relevant emergency resource data and departmental authority data from the system based on the affected object information and constructs a graph structure. In this graph, the affected object is represented as a central node, the emergency resources associated with the object (e.g., emergency personnel, equipment, vehicles) are represented as emergency resource nodes, and the departments that own these resources and their dispatch authority are represented as departmental authority nodes. These nodes are connected by preset relationships (e.g., geographical proximity, business connections, and affiliations), forming a cross-departmental emergency resource association graph.

[0131] Next, the search module uses the geographic location information of the affected object to perform spatial search or association search in the map, quickly identifying emergency resource nodes that are geographically close to the affected area and department authority nodes that have scheduling authority over these resources, and adds these nodes to the candidate emergency resource set and candidate department authority set respectively.

[0132] Furthermore, the resource calculation module traverses each emergency resource node in the candidate emergency resource set. For each node, it analyzes the specific capability attributes of the resource (for example, type, performance, quantity) and compares it with the resource requirements reflected by the attack target information, and calculates the matching score between the resource and the requirements. At the same time, it queries the department authority node associated with the resource to obtain the scheduling authority level of the department for the resource. Then, based on the matching score and the department authority level, a comprehensive evaluation is performed on the emergency resource node. Only when the comprehensive evaluation result meets the preset screening conditions (for example, the matching score reaches the threshold and the department authority level allows scheduling), the emergency resource node is determined to be an available resource and is added to the available emergency resource set.

[0133] From this, the resource calculation module accurately selects suitable and schedulable resources from the candidate pool. Finally, the plan generation module generates a detailed emergency resource allocation plan based on the location information of each emergency resource node in the available emergency resource set and the location information of the affected object, combined with the preset scheduling strategy. This plan specifies which resources will be scheduled, where they will be dispatched, and which departments will be involved.

[0134] The plan was further refined into cross-departmental task allocation and specific resource dispatch instructions for different departments. For example, the power department was instructed to dispatch a repair team with specific skills and emergency generators to the affected substation, and the transportation department was instructed to coordinate and open a safe passage. The entire process, from the occurrence of a security incident to the generation of an executable emergency plan, achieved automated and rapid response, significantly improving the efficiency and accuracy of emergency resource allocation.

[0135] Furthermore, the resource calculation module includes:

[0136] The first parsing module is used to parse the resource capability attributes of each emergency resource node in the candidate emergency resource set, extract resource type, performance indicators, and applicable scope information, and construct a resource capability vector;

[0137] The second parsing module is used to parse attack target information, identify attack types and affected objects, determine resource types, performance indicators, and applicable scope, and construct resource demand vectors.

[0138] The first calculation module is used to calculate the cosine similarity between the resource capability vector and the resource demand vector as the resource matching score, query the table of correspondence between department authority level and resource schedulability, and determine the actual schedulability score of each department for the emergency resource node;

[0139] The second calculation module is used to multiply the resource matching score by the actual schedulability score to obtain a comprehensive score, and to screen emergency resource nodes whose comprehensive scores are greater than or equal to a preset threshold to form an available emergency resource set.

[0140] Specifically, the resource calculation module works by first converting the emergency resource capability attributes and the resource requirements of the attack event into structured vector representations through the first and second parsing modules. The matching degree between resource capabilities and requirements can then be quantified by calculating the cosine similarity of these two vectors, yielding a resource matching score. Furthermore, by querying a pre-set permission correspondence table, the department's actual schedulability score for the resource can be determined based on the department's permission level.

[0141] Furthermore, the resource matching score is multiplied by the actual schedulability score to obtain a comprehensive score that reflects both the resource's applicability and schedulability. Finally, by setting a comprehensive score threshold, emergency resource nodes with a comprehensive score that meets or exceeds this threshold are screened. These nodes are then identified as truly available and suitable for schedulability in this emergency response event, forming the available emergency resource set. This approach overcomes the limitations of considering only resource capacity or departmental authority, providing a comprehensive resource screening mechanism that improves the accuracy and effectiveness of emergency resource allocation.

[0142] Furthermore, the instruction distribution module includes:

[0143] The third parsing module is used to parse the emergency response plan, extract cross-departmental task allocation information and resource scheduling instructions, and determine the types of instructions that each department needs to execute;

[0144] Conversion module: used to obtain the identification of each department, determine the type of command and dispatch system corresponding to each department based on the department identification, determine the instruction format based on the instruction type, and convert cross-departmental task allocation information and resource scheduling instructions into the instruction format corresponding to the command and dispatch system of each department;

[0145] Generation module: used to map the data fields in the emergency response plan to the corresponding fields in the command and dispatch system of each department, and generate instructions that can be understood and executed by the command and dispatch system of each department;

[0146] Distribution module: used to classify the converted instructions according to departments, and distribute the instructions to the corresponding departments through the data interface of the command and dispatch system of each department.

[0147] Specifically, the instruction distribution module receives the emergency response plan. The third parsing module parses the plan, extracting task allocation and resource scheduling instructions for different departments and identifying the operation type of each instruction, such as resource mobilization and information reporting.

[0148] Thus, it is determined which departments need to be sent what type of instructions. Furthermore, the conversion module queries the preset department system configuration information based on the extracted department identifier to determine the type of command and dispatch system used by each department, such as system A, system B, etc. In combination with the instruction type, the conversion module searches for the corresponding conversion rules or templates to convert the instruction data of the unified structure into the specific format required by the target system, such as converting the internal data structure into XML or JSON format. Subsequently, the generation module performs the mapping of data fields. Common data fields in the emergency response plan, such as resource type, quantity, target location, etc., are mapped to the corresponding specific field names and data types in the target command and dispatch system. For example, the common field "target location" may be mapped to the "latitude and longitude coordinates" field of system A or the "geographic name" field of system B.

[0149] This mapping ensures that the information contained in the instructions can be correctly parsed and understood by the receiving system. Finally, the distribution module generates instructions tailored to specific departments and systems and transmits them via data interfaces established with each department's command and dispatch system. Once the instructions are categorized, they are accurately distributed to the appropriate departmental systems through their respective interfaces, enabling the implementation of the emergency response plan.

[0150] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0151] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Persons skilled in the art will readily appreciate that the present application may be modified and altered in various ways. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A GIS-based smart city refined management platform, characterized by: The platform includes: Data acquisition module: used to obtain security event data sent by the honeynet system, analyze the security event data, and extract attack target information; Position acquisition module: used to determine the geographical location of the target based on the attack target information; Resource collection module: used to collect emergency resource data from the independent systems of various departments, standardize the collected emergency resource data, and obtain emergency resource information in a unified format; Resource allocation module: used to allocate the emergency resource information to the attacked object corresponding to the attack target information according to the geographical location information, and generate an emergency response plan; Instruction distribution module: used to convert emergency response plans into instruction formats that can be understood and executed by the existing command and dispatch systems of various departments, and distribute them to the corresponding departments.

2. A GIS-based smart city refined management platform according to claim 1, characterized in that: The data acquisition module includes: Monitoring module: The monitoring module is equipped with a data interface of the honeynet system, which is used to monitor and receive the original data of security events pushed by the honeynet system in real time; Data processing module: used to clean the original data of the security incident using multiple preset data cleaning rules to obtain security incident data; Extraction module: used to extract initial attack target information based on the security event data; Credibility evaluation module: used to compare the initial attack target information with the known threat intelligence library to obtain a credibility evaluation result. When the credibility evaluation meets the preset conditions, the initial attack target information is used as the target attack information.

3. The GIS-based smart city refined management platform according to claim 2 is characterized in that: The initial attack target information includes at least an IP address, a domain name, and an application service name, and the threat intelligence library includes at least a malicious IP address library, a malicious domain name library, and a malicious application service name library; The credibility assessment module includes: Query module: used to match the IP address, the domain name and the application service name in the initial attack target information with the malicious IP address library, the malicious domain name library and the malicious application service name library, respectively, to obtain a query result; Recording module: for marking the initial attack target information as suspicious and recording the threat type and threat level of the initial attack target information if the query result shows that the initial attack target information exists in the threat intelligence library; A calculation module is configured to calculate a credibility score according to the threat type and the threat level, and when the credibility score is greater than or equal to a preset credibility threshold, use the initial attack target information as the target attack information.

4. The GIS-based smart city refined management platform according to claim 3 is characterized in that: The computing module includes: Construction module: Construct a threat intelligence scoring matrix, wherein the rows of the threat intelligence scoring matrix represent threat types, the columns represent threat levels, and the matrix elements are preset scoring values corresponding to the threat types and threat levels; A first scoring acquisition module: searching a corresponding preset scoring value from a threat intelligence scoring matrix according to the threat type and the threat level as the threat intelligence score of the initial attack target information; A second scoring acquisition module is used to determine the authority score of the threat intelligence library based on the update frequency, data source and historical accuracy of the threat intelligence library; A scoring calculation module is used to calculate a credibility score based on the threat intelligence score and the authority score. The calculation formula is: credibility score = threat intelligence score * (1 + authority score). When the credibility score is greater than or equal to a preset credibility threshold, the initial attack target information is used as the target attack information.

5. The GIS-based smart city refined management platform according to claim 1, characterized in that: The location acquisition module includes: Parsing module: parses the attack target information to obtain the IP address, domain name and application service name; Positioning module: determining the geographical coordinates of the hit location based on the IP address, domain name, or application service name; Position query module: Based on the geographic location coordinates, perform spatial query in the GIS geographic information database to determine the buildings, roads, infrastructure and pipe network information associated with the geographic location coordinates, and generate the geographic location information of the affected area.

6. The GIS-based smart city refined management platform according to claim 5, characterized in that: The positioning module includes: A first positioning query module: queries an IP address database according to the IP address or the domain name or the application service name, and if corresponding coordinates are found in the IP address database, uses the coordinates as the geographic location coordinates; The second positioning query module: if no corresponding coordinates are found in the IP address database, the operator base station positioning data is obtained, the coordinates of the base station are determined according to the correspondence between the IP address and the base station, and the coordinates of the base station are used as the geographic location coordinates.

7. The GIS-based smart city refined management platform according to claim 1 is characterized in that: The resource collection module includes: Collection module: used to collect original emergency resource data from independent systems of various departments; Cleaning module: used for cleaning the original emergency resource data to obtain cleaned original emergency resource data; Standardization module: used to map the cleaned emergency resource data to standard fields, convert the data type to the standard data type, and generate the emergency resource information in a unified format.

8. The GIS-based smart city refined management platform according to claim 1 is characterized in that: The resource allocation module includes: Construction module: used to associate emergency resource nodes and department authority nodes with the affected object as the central node, and build a cross-department emergency resource association map; A search module is configured to search, based on the geographic location information, the cross-departmental emergency resource association map for emergency resource nodes and department authority nodes associated with the affected object, to obtain a candidate emergency resource set and a candidate department authority set; Resource calculation module: used to calculate the matching degree of each emergency resource node in the candidate emergency resource set according to the resource capability attribute and the resource demand corresponding to the attack target information, and screen the emergency resource nodes that meet the scheduling authority level requirements according to the department authority level attributes in the candidate department authority set to obtain the available emergency resource set; Plan generation module: used to generate emergency resource allocation plans based on the location attributes of emergency resource nodes in the available emergency resource set. The emergency resource allocation plan includes cross-departmental task allocation and resource scheduling instructions.

9. The GIS-based smart city refined management platform according to claim 8, characterized in that: The resource calculation module includes: The first parsing module is used to parse the resource capability attributes of each emergency resource node in the candidate emergency resource set, extract resource type, performance indicators, and applicable scope information, and construct a resource capability vector; The second parsing module is used to parse attack target information, identify attack types and affected objects, determine resource types, performance indicators, and applicable scope, and construct resource demand vectors. The first calculation module is used to calculate the cosine similarity between the resource capability vector and the resource demand vector as the resource matching score, query the table of correspondence between department authority level and resource schedulability, and determine the actual schedulability score of each department for the emergency resource node; The second calculation module is used to multiply the resource matching score by the actual schedulability score to obtain a comprehensive score, and to screen emergency resource nodes whose comprehensive scores are greater than or equal to a preset threshold to form an available emergency resource set.

10. The GIS-based smart city refined management platform according to claim 1, characterized in that: The instruction distribution module includes: The third parsing module is used to parse the emergency response plan, extract cross-departmental task allocation information and resource scheduling instructions, and determine the types of instructions that each department needs to execute; Conversion module: used to obtain the identification of each department, determine the type of command and dispatch system corresponding to each department based on the department identification, determine the instruction format based on the instruction type, and convert cross-departmental task allocation information and resource scheduling instructions into the instruction format corresponding to the command and dispatch system of each department; Generation module: used to map the data fields in the emergency response plan to the corresponding fields in the command and dispatch system of each department, and generate instructions that can be understood and executed by the command and dispatch system of each department; Distribution module: used to classify the converted instructions according to departments, and distribute the instructions to the corresponding departments through the data interface of the command and dispatch system of each department.

Images