Industrial internet security situation analysis method and system based on support vector regression

Abstract

This invention provides a method and system for industrial internet security situation analysis based on support vector regression, relating to the field of industrial internet security technology. The method includes collecting alarm data; identifying alarm events from the same source using a sliding time window method; establishing a time-series propagation matrix to calculate propagation probability; constructing an attack scenario graph and extracting features; calculating a security situation index using a support vector regression model; and selecting the optimal combination of protection nodes based on node centrality and a protection decision tree. This invention can accurately identify threat propagation paths, quantify security situation, and achieve precise protection of the industrial internet environment.

Description

Technical Field

[0001] This invention relates to industrial internet security technology, and in particular to an industrial internet security situation analysis method and system based on support vector regression. Background Technology

[0002] Existing industrial internet security posture analysis methods mainly rely on expert experience and static rules, lacking the ability to deeply mine and correlate alarm data, making it difficult to accurately identify alarm events with causal relationships. Furthermore, traditional methods fail to fully consider network topology and alarm propagation characteristics when constructing attack scenario diagrams and assessing security posture, resulting in insufficient accuracy of posture assessment results and weak targeting of protection strategies.

[0003] In the industrial internet environment, the complex interconnections between devices and diverse attack methods make security posture assessment and protection decisions extremely complex. Existing technologies cannot effectively quantify the security posture and automatically generate targeted protection strategies, making it difficult to achieve rapid response and proactive defense against attacks. Furthermore, optimizing the selection of protection nodes to maximize protection effectiveness under limited protection resources remains a pressing issue. Therefore, there is an urgent need for a method that can intelligently analyze alarm data, accurately assess the security posture, and automatically generate protection strategies to improve the security protection capabilities of the industrial internet. Summary of the Invention

[0004] This invention provides a method and system for analyzing the security situation of the industrial internet based on support vector regression, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a method for analyzing the security posture of an industrial internet based on support vector regression, comprising:

[0006] Collect alarm data from industrial internet devices, and based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, use a time window sliding method to perform correlation analysis on the alarm data to identify alarm events with causal relationships.

[0007] A time-series propagation matrix is ​​established based on alarm events from the same source. The alarm propagation probability between industrial internet devices is calculated, and a diffusion path is constructed. An attack scenario graph is constructed based on the overlap and coverage of multiple diffusion paths. The propagation characteristics of alarm data and the number of affected devices are extracted from the attack scenario graph to generate a situation assessment dataset.

[0008] The situation assessment dataset is input into a pre-trained support vector regression model to calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph.

[0009] The node centrality of each industrial internet device is calculated based on the attack scenario graph. A protection decision tree is constructed in combination with the protection strategy. The optimal combination of protection nodes is selected according to the node centrality and the protection decision tree. Protection instructions are generated and sent to the affected industrial internet devices to implement proactive protection.

[0010] In one alternative embodiment,

[0011] Alarm data from industrial internet devices is collected. Based on the temporal attributes of the alarm data and the network topology between industrial internet devices, a sliding time window approach is used to perform correlation analysis on the alarm data to identify causally related alarm events from the same source, including:

[0012] Collect alarm data from industrial internet devices, set corresponding baseline time windows based on the alarm levels of the alarm data, and construct a network connection diagram based on the network topology between industrial internet devices. The network connection diagram includes device nodes and communication links.

[0013] The alarm density of the alarm data is calculated using a density clustering algorithm based on an attention mechanism. Based on the alarm density and the shortest path hop count between device nodes in the network connection graph, the baseline time window is adaptively adjusted to obtain the time window.

[0014] Within the time window, time series similarity is calculated based on the time series attributes of alarm data, path similarity is calculated based on the shortest path between device nodes in the network connection graph, and feature similarity is calculated based on the attribute features of alarm data.

[0015] Calculate the propagation weight coefficient of the alarm data, and use the propagation weight coefficient to weight and combine the temporal similarity, path similarity and feature similarity to obtain the alarm propagation probability. Construct an alarm propagation graph, where nodes are alarm data and edges are alarm propagation relationships with alarm propagation probabilities.

[0016] The alarm propagation graph is dynamically verified based on a recursive search algorithm. Alarm propagation relationships that do not meet the propagation timing constraints are identified and eliminated, resulting in multiple connected subgraphs. The timing consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

[0017] In one alternative embodiment,

[0018] A recursive search algorithm is used to perform dynamic path verification on the alarm propagation graph, identifying and eliminating alarm propagation relationships that do not meet propagation timing constraints, resulting in multiple connected subgraphs. Timing consistency verification is then performed on these connected subgraphs, identifying causally related alarm events originating from the same source, including:

[0019] Calculate the propagation delay attenuation coefficient based on the network hop count between alarm data, and determine the propagation timing constraints between adjacent alarm data based on the propagation delay attenuation coefficient;

[0020] Based on the alarm types in the alarm data, alarm propagation rules are constructed. The alarm propagation graph is preprocessed according to the alarm propagation rules, and alarm propagation relationships that do not meet the alarm propagation rules are deleted to obtain the preprocessed alarm propagation graph.

[0021] A depth-first search is performed on the source alarm data in the preprocessed alarm propagation graph. During the search, it is determined whether the time interval between adjacent alarm data meets the propagation timing constraints. Alarm data that violates the propagation timing constraints are marked as invalid alarm data.

[0022] Skip path search starting from invalid alarm data, update the reachability marker of the alarm data, and save the alarm propagation relationship that satisfies the propagation timing constraint as a valid alarm propagation relationship;

[0023] Based on the connectivity of effective alarm propagation relationships, the preprocessed alarm propagation graph is decomposed into multiple connected subgraphs. The propagation probability of alarm propagation relationships in the connected subgraphs and the temporal consistency index of alarm timestamps are calculated. Based on the temporal consistency index, the temporal consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

[0024] In one alternative embodiment,

[0025] Based on alarm events originating from the same source, a time-series propagation matrix is ​​established to calculate the alarm propagation probability among industrial internet devices and construct the diffusion path, including:

[0026] An initial time-series propagation matrix is ​​constructed based on the same source alarm events. The industrial internet devices in the same source alarm events are used as row vectors and column vectors. The number of alarm propagation times between each pair of devices is counted within a specified time window. For any two industrial internet devices, the alarm propagation probability is obtained by the ratio of the number of times the target device generates an alarm after the source device generates an alarm to the total number of alarms of the source device. The alarm propagation probability is filled into the corresponding matrix element positions to generate the time-series propagation matrix.

[0027] The alarm propagation probability of devices less than a preset probability threshold is set to zero to obtain a filtered time-series propagation matrix. Based on the filtered time-series propagation matrix, a depth-first search method is used to search for alarm propagation paths starting from the first alarm device. The alarm propagation probability on each path is multiplied to obtain the path weight. A weight threshold is set for the path weight, and paths with a weight greater than the weight threshold are retained as propagation paths.

[0028] In one alternative embodiment,

[0029] An attack scenario map is constructed based on the overlap and coverage of multiple propagation paths. The propagation characteristics of alarm data and the number of affected devices are extracted from this map to generate a situation assessment dataset, including:

[0030] A path connection table is constructed based on the diffusion path. The path connection table records the sequence of device nodes traversed by each diffusion path. The degree of path overlap is obtained by counting the number of repeated device nodes in the path connection table.

[0031] The total number of accessible nodes along each diffusion path is obtained by traversing the sequence of device nodes. The ratio of the total number of accessible nodes to the total number of network nodes is used as the path coverage.

[0032] Based on the degree of path overlap, diffusion paths with the same repeating nodes are divided into the same group, the coverage of the paths in each group is calculated, and the path with the largest coverage is selected to construct the attack scenario graph.

[0033] Identify propagation feature nodes in the attack scenario graph, extract propagation features based on the connection relationships between the propagation feature nodes, count the number of device nodes reachable by the propagation feature nodes as the number of affected devices, and generate a situation assessment dataset.

[0034] In one alternative embodiment,

[0035] The situation assessment dataset is input into a pre-trained support vector regression model to calculate the security situation index, determine protection priorities, and formulate protection strategies based on the diffusion paths in the attack scenario graph, including:

[0036] Extract alarm propagation feature sequences and affected device number sequences from the situation assessment dataset. Calculate standardized features based on the maximum and minimum values ​​of the alarm propagation feature sequences, and calculate normalized features based on the ratio of the affected device number sequence to the total number of devices.

[0037] A feature matrix is ​​constructed by combining standardized features and normalized features. The mutual information between features in the feature matrix is ​​calculated to obtain the feature redundancy. Features are selected based on the feature redundancy and the information gain is calculated. When the information gain is less than a preset gain threshold, the training features are obtained.

[0038] The training features are divided into training and validation sets and cross-validation is performed to obtain the optimal kernel function parameters. The training features and kernel function parameters are input into the support vector regression model, the error value between the predicted result and the true result is calculated, and the model parameters are updated according to the error value. When the error value is less than a preset error threshold, the trained support vector regression model is obtained.

[0039] The security situation index is obtained by inputting the situation assessment dataset into the trained support vector regression model. The security situation index is then weighted and smoothed within a preset time window to obtain a smoothed situation index.

[0040] The situation change rate is obtained by calculating the difference in the smooth situation index between adjacent time points. The protection priority is determined based on the situation change rate. The node weight is calculated by combining the time order of node access on the diffusion path in the attack scenario diagram. The protection priority is adjusted to obtain the protection node sequence. The protection strategy is formulated based on the protection node sequence and the node access time order of the diffusion path.

[0041] In one alternative embodiment,

[0042] Based on the attack scenario graph, the node centrality of each industrial internet device is calculated. A protection decision tree is constructed by combining the protection strategy. The optimal combination of protection nodes is selected based on the node centrality and the protection decision tree. Protection commands are then generated, including:

[0043] Degree centrality is obtained by calculating the alarm reception and propagation volume of each industrial internet device node in the attack scenario graph, betweenness centrality is obtained by calculating the alarm forwarding count of the node based on the attack scenario graph, and proximity centrality is obtained by calculating the shortest hop count between nodes.

[0044] Extract the alarm processing sequence of nodes in the attack scenario graph, calculate the alarm propagation delay of nodes, and adaptively weight degree centrality, betweenness centrality and proximity centrality based on the propagation delay to obtain node centrality.

[0045] Based on the node centrality, industrial internet devices are classified into importance levels. According to the protection requirements corresponding to the importance level, protection measures are divided into different protection levels. A protection decision tree is constructed, and decision rules based on node centrality and propagation delay are set at the branch nodes of the protection decision tree.

[0046] Based on the decision rules, nodes to be protected are selected at each protection level. The alarm processing efficiency of the selected nodes is statistically analyzed. The protection priority is calculated by combining the position of the node in the attack scenario graph. The protection priority is matched with the protection level to generate a candidate protection node combination.

[0047] Calculate the alarm blocking effect of each candidate protection node combination, select the protection node combination with the best blocking effect and satisfying resource constraints, and generate protection instructions based on the protection node combination.

[0048] A second aspect of this invention provides an industrial internet security situation analysis system based on support vector regression, comprising:

[0049] The first unit is used to collect alarm data from industrial internet devices. Based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, the alarm data is analyzed by using a time window sliding method to identify alarm events with causal relationships.

[0050] The second unit is used to establish a time-series propagation matrix based on alarm events from the same source, calculate the alarm propagation probability between industrial internet devices, construct diffusion paths, construct an attack scenario graph based on the overlap and coverage of multiple diffusion paths, extract the propagation characteristics of alarm data and the number of affected devices in the attack scenario graph, and generate a situation assessment dataset.

[0051] The third unit is used to input the situation assessment dataset into a pre-trained support vector regression model, calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph.

[0052] The fourth unit is used to calculate the node centrality of each industrial internet device based on the attack scenario graph, construct a protection decision tree in combination with the protection strategy, select the optimal combination of protection nodes according to the node centrality and the protection decision tree, generate protection instructions, and send the protection instructions to the affected industrial internet devices to implement proactive protection.

[0053] A third aspect of the present invention provides an electronic device, comprising:

[0054] processor;

[0055] Memory used to store processor-executable instructions;

[0056] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0057] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0058] In this embodiment, a sliding time window approach is used to perform correlation analysis on alarm data, identify alarm events with causal relationships, establish a time-series propagation matrix to calculate alarm propagation probability, construct an attack scenario graph, extract alarm propagation features and the number of affected devices, and generate a situation assessment dataset. This effectively achieves accurate analysis and assessment of the security situation of the Industrial Internet. The situation assessment dataset is input into a trained support vector regression model to calculate a security situation index, determine protection priorities, and formulate protection strategies based on the propagation paths in the attack scenario graph. This achieves data-driven situation assessment and protection decision-making, improving the accuracy of security situation assessment and the effectiveness of protection decisions. Based on the attack scenario graph, node centrality is calculated, and a protection decision tree is constructed in conjunction with the protection strategy. The optimal combination of protection nodes is selected, and protection commands are generated and issued, achieving proactive protection. Compared with traditional passive protection methods, this approach can more accurately identify key nodes, optimize the allocation of protection resources, and improve protection efficiency and overall security. Attached Figure Description

[0059] Figure 1 This is a flowchart illustrating the industrial internet security situation analysis method based on support vector regression, as described in an embodiment of the present invention.

[0060] Figure 2 This is a comparison diagram of the effective alarm propagation relationship before and after alarm propagation rule preprocessing in an embodiment of the present invention;

[0061] Figure 3 A performance heatmap is constructed for the attack scenario diagram in the embodiment of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0064] Figure 1 This is a flowchart illustrating the industrial internet security situation analysis method based on support vector regression, as described in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0065] Collect alarm data from industrial internet devices, and based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, use a time window sliding method to perform correlation analysis on the alarm data to identify alarm events with causal relationships.

[0066] A time-series propagation matrix is ​​established based on alarm events from the same source. The alarm propagation probability between industrial internet devices is calculated, and a diffusion path is constructed. An attack scenario graph is constructed based on the overlap and coverage of multiple diffusion paths. The propagation characteristics of alarm data and the number of affected devices are extracted from the attack scenario graph to generate a situation assessment dataset.

[0067] The situation assessment dataset is input into a pre-trained support vector regression model to calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph.

[0068] The node centrality of each industrial internet device is calculated based on the attack scenario graph. A protection decision tree is constructed in combination with the protection strategy. The optimal combination of protection nodes is selected according to the node centrality and the protection decision tree. Protection instructions are generated and sent to the affected industrial internet devices to implement proactive protection.

[0069] In one optional implementation, alarm data from industrial internet devices is collected. Based on the temporal attributes of the alarm data and the network topology relationships between industrial internet devices, a time window sliding method is used to perform correlation analysis on the alarm data to identify alarm events with causal relationships originating from the same source, including:

[0070] Collect alarm data from industrial internet devices, set corresponding baseline time windows based on the alarm levels of the alarm data, and construct a network connection diagram based on the network topology between industrial internet devices. The network connection diagram includes device nodes and communication links.

[0071] The alarm density of the alarm data is calculated using a density clustering algorithm based on an attention mechanism. Based on the alarm density and the shortest path hop count between device nodes in the network connection graph, the baseline time window is adaptively adjusted to obtain the time window.

[0072] Within the time window, time series similarity is calculated based on the time series attributes of alarm data, path similarity is calculated based on the shortest path between device nodes in the network connection graph, and feature similarity is calculated based on the attribute features of alarm data.

[0073] Calculate the propagation weight coefficient of the alarm data, and use the propagation weight coefficient to weight and combine the temporal similarity, path similarity and feature similarity to obtain the alarm propagation probability. Construct an alarm propagation graph, where nodes are alarm data and edges are alarm propagation relationships with alarm propagation probabilities.

[0074] The alarm propagation graph is dynamically verified based on a recursive search algorithm. Alarm propagation relationships that do not meet the propagation timing constraints are identified and eliminated, resulting in multiple connected subgraphs. The timing consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

[0075] This embodiment provides a method for identifying common-source alarm events based on time-series attributes and network topology relationships. The method first collects alarm data from industrial internet devices. Each alarm data entry includes attributes such as device identifier, alarm time, alarm level, alarm type, and alarm description. A corresponding baseline time window is set according to the alarm level; for example, a 300-second baseline time window is set for emergency alarms, a 180-second baseline time window for important alarms, and a 120-second baseline time window for minor alarms. Simultaneously, a network connection graph is constructed based on the connectivity relationships between industrial internet devices, where nodes represent devices and edges represent communication links between devices. For example, in an industrial production line, the communication connections between PLC controllers, sensors, and actuators are represented as edges in the network connection graph.

[0076] After constructing the network connectivity graph, an attention-based density clustering algorithm is used to calculate the alarm density of the alarm data. Specifically, for each time point t, the number of alarms within a certain time range before and after (e.g., 60 seconds before and after) is counted, and alarms closer to time point t are assigned higher weights. For example, if there are 20 alarms within 60 seconds before and after time point t, and 10 of them appear within 10 seconds before and after t, then the alarm density at time point t will be high. The calculated alarm density reflects the degree of anomaly in the system at a specific time point.

[0077] The baseline time window is adaptively adjusted based on the calculated alarm density and the number of hops in the shortest path between device nodes in the network connection graph. When the alarm density is high, it indicates that system anomalies are concentrated, and the time window can be appropriately shortened; when the alarm density is low, the time window is widened to capture more potentially related alarms. Simultaneously, the number of hops in the shortest path between devices is considered. For alarm correlations between devices with a high number of hops, the time window is appropriately widened to account for alarm propagation delays. For example, for critical alarms with a baseline time window of 180 seconds, if the alarm density is 0.8 (high density) and the shortest path between devices is 1 hop, the time window is adjusted to 150 seconds; if the alarm density is 0.3 (low density) and the shortest path between devices is 3 hops, the time window is adjusted to 220 seconds.

[0078] After determining the time window, three types of similarity are calculated for the alarm data within the window. Temporal similarity measures the proximity of alarm occurrence times, calculating and normalizing the difference between two alarm timestamps. For example, if the time difference between two alarms is 30 seconds and the time window is 180 seconds, the temporal similarity is 1 - 30 / 180 = 0.833. Path similarity is calculated based on the shortest path between device nodes in the network connection graph, using the reciprocal of the shortest path length as the path similarity. For example, if the shortest path length between device A and device B is 2 hops, their path similarity is 1 / 2 = 0.5. Feature similarity is calculated based on the attribute features of the alarm data, comparing the similarity of fields such as alarm type and alarm description. For example, using a text similarity algorithm to calculate the similarity of two alarm description texts, such as "network connection interrupted" and "network connection timed out," the feature similarity might be 0.8.

[0079] The propagation weight coefficient of alarm data is calculated based on its impact range, alarm level, and historical statistical data. Alarms with a wider impact range and higher levels have greater propagation weights. For example, an alarm affecting the entire network subsystem might have a propagation weight coefficient of 0.9, while an alarm affecting only a single device might have a propagation weight coefficient of 0.3. These propagation weight coefficients are then used to weight and combine temporal similarity, path similarity, and feature similarity to obtain the alarm propagation probability. For example, for two alarms A and B, assuming a temporal similarity of 0.8, a path similarity of 0.6, a feature similarity of 0.7, and a propagation weight coefficient of 0.8 for alarm A, the alarm propagation probability might be 0.8 × 0.8 + 0.6 × 0.1 + 0.7 × 0.1 = 0.77. An alarm propagation graph is constructed based on the calculated alarm propagation probabilities, where nodes represent alarm data and edges represent alarm propagation relationships with propagation probabilities.

[0080] The constructed alarm propagation graph undergoes dynamic path verification. A recursive search algorithm is used to identify and remove alarm propagation relationships that do not meet the propagation timing constraints. These constraints require that the causal alarm in a causal relationship must occur before the resulting alarm. For example, if there is an edge between alarm A and alarm B, but alarm B occurs earlier than alarm A, this edge violates the propagation timing constraint and should be removed. Through recursive search, all paths in the alarm propagation graph can be checked, and edges violating the timing constraints can be removed.

[0081] After dynamic path verification, the alarm propagation graph is divided into multiple connected subgraphs, each containing a set of alarms that may have causal relationships. These connected subgraphs undergo time-series consistency verification to check for loops or temporal inconsistencies. Specifically, within each connected subgraph, alarms are sorted according to their occurrence time order, and the temporal relationship of cause and effect is checked. For example, in a connected subgraph containing alarms A, B, and C, if their occurrence time order is A→B→C, and edges A→B, B→C, and A→C exist, then the subgraph has temporal consistency; conversely, if the temporal relationship between alarms is inconsistent with the direction of the edges, then the subgraph does not satisfy temporal consistency. Through time-series consistency verification, causally related alarm events from the same source are ultimately identified. These events can help operations and maintenance personnel quickly locate the root cause of faults, improving the operational efficiency of industrial internet systems.

[0082] In this embodiment, by introducing an alarm level-driven adaptive time window and device network topology information, the timeliness and accuracy of identifying homogeneous alarm events are improved; the density clustering algorithm using an attention mechanism enhances the ability to perceive densely populated local alarm areas; by fusing time sequence, path, and feature similarity and introducing propagation weights for weighted calculation, the rationality and credibility of alarm propagation relationship modeling are effectively improved; and by combining recursive search and time sequence consistency verification, pseudo-related alarm paths can be eliminated, and the true causal propagation chain can be accurately extracted, enabling intelligent identification of homogeneous events in complex alarm scenarios and supporting operation and maintenance decisions and security situation awareness.

[0083] In one optional implementation, a recursive search algorithm is used to perform dynamic path verification on the alarm propagation graph, identifying and eliminating alarm propagation relationships that do not meet propagation timing constraints, resulting in multiple connected subgraphs. The timing consistency of these connected subgraphs is then verified, and causally related alarm events from the same source are identified, including:

[0084] Calculate the propagation delay attenuation coefficient based on the network hop count between alarm data, and determine the propagation timing constraints between adjacent alarm data based on the propagation delay attenuation coefficient;

[0085] Based on the alarm types in the alarm data, alarm propagation rules are constructed. The alarm propagation graph is preprocessed according to the alarm propagation rules, and alarm propagation relationships that do not meet the alarm propagation rules are deleted to obtain the preprocessed alarm propagation graph.

[0086] A depth-first search is performed on the source alarm data in the preprocessed alarm propagation graph. During the search, it is determined whether the time interval between adjacent alarm data meets the propagation timing constraints. Alarm data that violates the propagation timing constraints are marked as invalid alarm data.

[0087] Skip path search starting from invalid alarm data, update the reachability marker of the alarm data, and save the alarm propagation relationship that satisfies the propagation timing constraint as a valid alarm propagation relationship;

[0088] Based on the connectivity of effective alarm propagation relationships, the preprocessed alarm propagation graph is decomposed into multiple connected subgraphs. The propagation probability of alarm propagation relationships in the connected subgraphs and the temporal consistency index of alarm timestamps are calculated. Based on the temporal consistency index, the temporal consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

[0089] In this embodiment, the propagation delay attenuation coefficient is first determined by calculating the network hop count between alarm data. The network hop count refers to the number of network devices traversed from one alarm node to another. For example, the propagation delay attenuation coefficient is set to 0.8 for alarm nodes 1 hop apart, 0.6 for alarm nodes 2 hop apart, and 0.4 for alarm nodes 3 hop apart. Based on these propagation delay attenuation coefficients, the propagation timing constraints between adjacent alarm data are further determined. The propagation timing constraints are represented by a time threshold; for example, the time threshold is set to 5 seconds for alarm nodes 1 hop apart, 10 seconds for alarm nodes 2 hop apart, and 15 seconds for alarm nodes 3 hop apart.

[0090] Alarm propagation rules are constructed based on the alarm types in the alarm data. Alarm propagation rules refer to the causal relationship rules that may exist between different types of alarms. For example, an alarm of type "network link interruption" may cause an alarm of type "service unavailable," but an alarm of type "service unavailable" is unlikely to cause an alarm of type "network link interruption." Based on these rules, the alarm propagation graph is preprocessed, removing alarm propagation relationships that do not satisfy the rules, resulting in a preprocessed alarm propagation graph. For example, in the original alarm propagation graph, if there is an edge pointing from an alarm of type "service unavailable" to an alarm of type "network link interruption," that edge will be deleted.

[0091] On the preprocessed alarm propagation graph, a depth-first search is performed on the source alarm data. Source alarm data refers to alarm nodes without incoming edges, i.e., alarms not caused by other alarms. During the search, it is determined whether the time interval between adjacent alarm data satisfies the propagation timing constraint. For example, if alarm A occurs at time t1 and alarm B occurs at time t2, if t2-t1 is less than the time threshold determined based on the network hop count, then the propagation relationship between alarm A and alarm B is considered to satisfy the timing constraint; otherwise, alarm B is marked as invalid alarm data.

[0092] During the search, paths originating from invalid alarm data are skipped to improve search efficiency. Simultaneously, the reachability markers for alarm data are updated, and alarm propagation relationships that satisfy propagation timing constraints are saved as valid alarm propagation relationships. Reachability markers indicate whether a valid propagation path exists from the source alarm data to the current alarm data. For example, for a path in the alarm propagation graph: Alarm A → Alarm B → Alarm C, if the propagation relationship from Alarm A to Alarm B satisfies the timing constraint, but the propagation relationship from Alarm B to Alarm C does not, then Alarm C will be marked as invalid alarm data, and all paths originating from Alarm C will not be further searched.

[0093] Based on the connectivity of effective alarm propagation relationships, the preprocessed alarm propagation graph is decomposed into multiple connected subgraphs. A connected subgraph is a subgraph in which all nodes are mutually reachable. For each connected subgraph, the propagation probability of alarm propagation relationships and the temporal consistency index of alarm timestamps are calculated. The propagation probability refers to the probability that one alarm type will lead to another alarm type, calculated based on historical data. For example, the probability that "network link interruption" will lead to "service unavailability" may be 0.85. The temporal consistency index is a comprehensive index calculated based on the time interval of all alarm propagation relationships in the connected subgraph, used to measure whether the temporal logic of alarm propagation in the connected subgraph is reasonable.

[0094] The temporal consistency of connected subgraphs is verified based on a temporal consistency index to identify alarm events with a causal relationship. Specifically, if the temporal consistency index of a connected subgraph exceeds a preset threshold (e.g., 0.75), the alarms in that subgraph are considered to be caused by the same root event, i.e., they constitute a common-source alarm event. For example, a connected subgraph contains alarms A, B, C, and D, where alarm A is the source alarm. If the temporal consistency index of this connected subgraph is 0.85, exceeding the preset threshold of 0.75, then alarms A, B, C, and D are considered to be caused by the same root event, constituting a common-source alarm event.

[0095] In this embodiment, abnormal paths that do not conform to temporal logic or propagation rules in the alarm propagation chain can be effectively eliminated, thereby improving the accuracy and reliability of causal relationship identification. By introducing a propagation delay attenuation coefficient, the time propagation constraints under different network hop counts are reasonably limited, avoiding misjudgment of distant nodes as events from the same source; propagation rules are constructed in combination with alarm types to effectively filter logically invalid alarm relationships; a depth-first search combined with propagation timing judgment and reachability marking strategies improves the efficiency and accuracy of propagation path verification; finally, by jointly evaluating the propagation probability and temporal consistency of connected subgraphs, accurate identification and tracing of events from the same source are achieved, enhancing the intelligence and practicality of alarm processing.

[0096] Figure 2 This is a comparison diagram of the effective alarm propagation relationship before and after alarm propagation rule preprocessing in an embodiment of the present invention, as shown below. Figure 2 As shown in the figure, this diagram compares the number of valid alarm propagation relationships before and after alarm propagation rule preprocessing, and also compares the effectiveness of this technical solution with the GNN-based alarm association method. The figure shows that the original number of alarm propagation relationships before preprocessing was relatively large; for example, there were 85 relationships for network link interruption and 95 relationships for security attack. After the alarm propagation rule preprocessing of this technical solution, the number of valid propagation relationships for each type of alarm was significantly reduced: network link interruption decreased to 64 (a 25% reduction), service unavailability decreased to 50 (a 36% reduction), CPU overload decreased to 57 (a 38% reduction), memory overflow decreased to 43 (a 39% reduction), and security attack decreased to 60 (a 37% reduction). In comparison, the GNN-based alarm association method performed slightly worse, with corresponding numbers of valid relationships of 49, 39, 46, 32, and 42, respectively. This demonstrates that the proposed technical solution, through alarm propagation rules built based on alarm type, can more accurately identify and retain alarm propagation paths with causal relationships, while effectively eliminating illogical propagation relationships, such as "service unavailable" being unlikely to cause "network link interruption." This preprocessing mechanism significantly improves the accuracy and efficiency of subsequent alarm correlation analysis.

[0097] In one optional implementation, a time-series propagation matrix is ​​established based on alarm events from the same source, the alarm propagation probability between industrial internet devices is calculated, and the diffusion path is constructed, including:

[0098] An initial time-series propagation matrix is ​​constructed based on the same source alarm events. The industrial internet devices in the same source alarm events are used as row vectors and column vectors. The number of alarm propagation times between each pair of devices is counted within a specified time window. For any two industrial internet devices, the alarm propagation probability is obtained by the ratio of the number of times the target device generates an alarm after the source device generates an alarm to the total number of alarms of the source device. The alarm propagation probability is filled into the corresponding matrix element positions to generate the time-series propagation matrix.

[0099] The alarm propagation probability of devices less than a preset probability threshold is set to zero to obtain a filtered time-series propagation matrix. Based on the filtered time-series propagation matrix, a depth-first search method is used to search for alarm propagation paths starting from the first alarm device. The alarm propagation probability on each path is multiplied to obtain the path weight. A weight threshold is set for the path weight, and paths with a weight greater than the weight threshold are retained as propagation paths.

[0100] In this implementation, alarm event data from the industrial internet environment is first collected. Each alarm event data entry includes information such as the device identifier where the alarm occurred, the alarm type, and the alarm occurrence time. To construct an initial time-series propagation matrix, the collected alarm events need to be preprocessed and filtered to identify alarm events with the same source. Aligned alarm events refer to a series of device alarms caused by the same reason.

[0101] In a specific implementation, when constructing the initial time-series propagation matrix based on co-origin alarm events, the industrial internet devices involved in the co-origin alarm events need to be used as the row and column vectors of the matrix. For example, in a certain industrial internet environment, there are five key devices: device A, device B, device C, device D, and device E. These devices generate multiple alarms within a certain period of time, and it is necessary to analyze the propagation relationship between these alarms. To this end, a 5×5 initial matrix is ​​constructed, where the rows and columns of the matrix represent these five devices, respectively.

[0102] When counting the number of alarm propagations between each pair of devices within a specified time window, a 10-minute time window can be set. Within this time window, if device A generates an alarm first, and then device B also generates an alarm within the same time window, it is considered that alarm propagation from device A to device B may have occurred. By analyzing historical alarm logs, it was found that within the 10-minute time window, device B generated an alarm 15 times after device A generated an alarm, while device A generated a total of 20 alarms.

[0103] When calculating the alarm propagation probability, the alarm propagation probability from device A to device B is calculated by dividing the number of times device B also generates an alarm within a specified time window after device A generates an alarm (15 times) by the total number of alarms generated by device A (20 times), resulting in an alarm propagation probability of 0.75. Similarly, the alarm propagation probability between all device pairs is calculated. For example, the alarm propagation probability from device A to device C is 0.6, from device B to device D is 0.8, from device C to device E is 0.7, from device B to device C is 0.3, and from device D to device E is 0.5.

[0104] The calculated alarm propagation probabilities are then filled into the corresponding matrix elements to generate a time-series propagation matrix. In this matrix, rows represent source devices, columns represent target devices, and element values ​​represent the alarm propagation probability between corresponding device pairs. For example, the element value in the first row and second column of the matrix is ​​0.75, indicating that the alarm propagation probability from device A to device B is 0.75. To filter out low-probability alarm propagation relationships, a preset probability threshold of 0.4 is set. Alarm propagation probabilities less than 0.4 in the time-series propagation matrix are set to 0, resulting in a filtered time-series propagation matrix. In this example, the alarm propagation probability from device B to device C is 0.3, which is less than the threshold of 0.4, so this value is set to 0 in the filtered matrix. Thus, the filtered time-series propagation matrix retains only the stronger alarm propagation relationships.

[0105] Based on the filtered time-series propagation matrix, a depth-first search (DFS) method is used to search for alarm propagation paths. Assuming the first alarm device is device A, the search begins with device A and searches for possible propagation paths. The DFS process involves traversing a path as deeply as possible until no further progress is possible, then backtracking and exploring other possible paths. During the search, starting from device A, devices B (propagation probability 0.75) and C (propagation probability 0.6) are reachable. From device B, device D (propagation probability 0.8) is reachable; from device C, device E (propagation probability 0.7) is reachable; and from device D, device E (propagation probability 0.5) is reachable. Through DFS, multiple possible alarm propagation paths can be found, including "A→B→D→E", "A→C→E", etc. When calculating the weight of each path, the propagation probabilities of the alarms along the path are multiplied together to obtain the path weight. For example, the weight of the path "A→B→D→E" is 0.75×0.8×0.5=0.3, and the weight of the path "A→C→E" is 0.6×0.7=0.42.

[0106] The path weight threshold is set to 0.35, and paths with weights greater than the threshold are retained as the final diffusion paths. In this example, the path "A→B→D→E" has a weight of 0.3, which is less than the threshold of 0.35, so it is filtered out; while the path "A→C→E" has a weight of 0.42, which is greater than the threshold of 0.35, so it is retained as a valid diffusion path.

[0107] To improve the accuracy of the alarm propagation matrix, a time decay factor can be used to weight historical alarm data. Newer alarm data is given a higher weight, and older alarm data is given a lower weight. For example, setting the time decay factor to 0.9 multiplies the weight by 0.9 for each time unit backward (e.g., one day). Thus, alarm data from a week ago has approximately 0.5 times the weight of current alarm data, more accurately reflecting the alarm propagation pattern under current network conditions.

[0108] In practical applications, dynamically adjustable probability and weight thresholds can be set. The threshold values ​​are automatically adjusted based on the scale and complexity of the industrial internet environment. For example, in environments with a large number of devices and frequent alarms, the threshold can be appropriately increased to reduce the number of paths and focus on the most important alarm propagation paths; in environments with a small number of devices and fewer alarms, the threshold can be appropriately decreased to capture more possible alarm propagation relationships.

[0109] To address the sparsity problem of time-series propagation matrices, matrix compression storage techniques can be employed. In large-scale industrial internet environments, the number of devices can reach thousands, resulting in extremely large time-series propagation matrices. Since most devices do not have direct alarm propagation relationships, most elements in the matrix are zero. By storing only non-zero elements and their location information, storage space requirements can be significantly reduced, improving algorithm efficiency. To handle false alarms and missed alarms, a confidence scoring mechanism can be introduced. For each alarm, a confidence score is calculated based on its source, type, historical accuracy, and other factors. When constructing the time-series propagation matrix, the confidence score of the alarm is taken into account to reduce the impact of low-confidence alarms on the propagation probability calculation. For example, the alarm confidence score can be used as a weighting factor multiplied by the original count value. During the construction of the propagation path, the physical connection relationships between devices can be considered. If two devices do not have a direct or indirect connection in the physical network, even if statistically they show an alarm propagation relationship, it may be a coincidence caused by other factors. By combining network topology information, such spurious propagation relationships can be eliminated, improving the accuracy of the propagation path.

[0110] In this embodiment, by constructing an initial time-series propagation matrix and filtering low-probability propagation relationships, the system can focus on important alarm links, reducing analysis noise. Depth-first search combined with path weight calculation methods enables the system to identify the most likely alarm propagation paths, improving the efficiency of security incident tracing. The introduction of a time decay factor and confidence scoring mechanism enhances the model's adaptability to real-time network conditions, reducing the impact of false alarms. Combining device physical connection relationship analysis can eliminate false propagation relationships, improving the accuracy of propagation paths. A dynamic threshold adjustment mechanism allows the system to adapt to industrial network environments of varying scales and complexities. Matrix compression storage technology effectively solves the computational efficiency problem in large-scale environments. The risk assessment function supports security teams in prioritizing high-risk paths, improving security situational awareness and response efficiency, reducing the scope of security incident impact, and ensuring the stable operation of the industrial internet system.

[0111] In one optional implementation, an attack scenario map is constructed based on the overlap and coverage of multiple propagation paths. The propagation characteristics of alarm data and the number of affected devices are extracted from the attack scenario map to generate a situation assessment dataset, including:

[0112] A path connection table is constructed based on the diffusion path. The path connection table records the sequence of device nodes traversed by each diffusion path. The degree of path overlap is obtained by counting the number of repeated device nodes in the path connection table.

[0113] The total number of accessible nodes along each diffusion path is obtained by traversing the sequence of device nodes. The ratio of the total number of accessible nodes to the total number of network nodes is used as the path coverage.

[0114] Based on the degree of path overlap, diffusion paths with the same repeating nodes are divided into the same group, the coverage of the paths in each group is calculated, and the path with the largest coverage is selected to construct the attack scenario graph.

[0115] Identify propagation feature nodes in the attack scenario graph, extract propagation features based on the connection relationships between the propagation feature nodes, count the number of device nodes reachable by the propagation feature nodes as the number of affected devices, and generate a situation assessment dataset.

[0116] In this embodiment, when constructing the path connection table based on the diffusion paths, it is necessary to record the sequence of device nodes traversed by each diffusion path obtained in the aforementioned steps. In practical applications, it is assumed that multiple diffusion paths have been obtained through the aforementioned method, such as path 1: device A→device B→device D→device F; path 2: device A→device C→device E→device G; path 3: device A→device B→device E→device H; path 4: device B→device D→device F→device I. For these paths, a path connection table is constructed, which contains the path ID and the corresponding device node sequence. For example, the record for path 1 is (1, [A, B, D, F]), the record for path 2 is (2, [A, C, E, G]), the record for path 3 is (3, [A, B, E, H]), and the record for path 4 is (4, [B, D, F, I]).

[0117] To determine the degree of path overlap by counting the number of recurring device nodes in the path connection table, it is necessary to traverse each path in the table and calculate the number of times each device node appears in different paths. By comparing the device nodes shared between different paths, the degree of overlap between paths can be determined. In the example above, device A appears in paths 1, 2, and 3, with a repetition count of 3; device B appears in paths 1, 3, and 4, with a repetition count of 3; device D appears in paths 1 and 4, with a repetition count of 2; device E appears in paths 2 and 3, with a repetition count of 2; device F appears in paths 1 and 4, with a repetition count of 2; while devices C, G, H, and I each appear in only one path, with a repetition count of 1.

[0118] When traversing the sequence of device nodes along each diffusion path to obtain the total number of nodes reachable along the path, it is necessary to calculate the number of device nodes that can be directly or indirectly reached by each path. In practical applications, a graph traversal algorithm can be used, starting from each node in the path and exploring all reachable nodes. Assuming there are 15 device nodes in an industrial internet environment, after traversal analysis, path 1 can reach 6 nodes (including the 4 nodes on the path and the other 2 nodes that can be reached from these nodes); path 2 can reach 5 nodes; path 3 can reach 7 nodes; and path 4 can reach 8 nodes.

[0119] When using the ratio of the total number of accessible nodes to the total number of network nodes as the path coverage, it's necessary to calculate the proportion of the network each path can cover. In the example above, with a total of 15 network nodes, the coverage of path 1 is 6 / 15 = 0.4; the coverage of path 2 is 5 / 15 = 0.33; the coverage of path 3 is 7 / 15 = 0.47; and the coverage of path 4 is 8 / 15 = 0.53. A larger coverage area indicates a wider network impact from that path, and consequently, a higher potential security risk.

[0120] When grouping diffusion paths with identical repeating nodes into the same group based on path overlap, it's necessary to identify the similarity between paths. Specifically, this is achieved by grouping based on the key nodes that appear repeatedly in the paths. In the example above, paths 1 and 3 can be grouped together because they both contain devices A and B; paths 1 and 4 can be grouped together because they both contain devices B, D, and F; and paths 2 and 3 can be grouped together because they both contain devices A and E. Note that a path can belong to multiple groups, depending on its overlap with other paths.

[0121] When calculating the coverage of paths in each group and selecting the path with the largest coverage to construct the attack scenario graph, it is necessary to compare the coverage of paths within each group and select the path with the largest coverage as the representative of that group. In the example above, for the group containing paths 1 and 3, the coverage of path 3 (0.47) is greater than that of path 1 (0.4), so path 3 is selected as the representative of this group; for the group containing paths 1 and 4, the coverage of path 4 (0.53) is greater than that of path 1 (0.4), so path 4 is selected as the representative of this group; for the group containing paths 2 and 3, the coverage of path 3 (0.47) is greater than that of path 2 (0.33), so path 3 is selected as the representative of this group. Finally, paths 3 and 4 are selected to construct the attack scenario graph.

[0122] When constructing an attack scenario graph, selected paths are combined to form a directed graph. In this graph, nodes represent devices, and edges represent alarm propagation relationships. For the example above, combining path 3 (A→B→E→H) and path 4 (B→D→F→I) forms an attack scenario graph that includes devices A, B, D, E, F, H, and I. This graph reflects the potential attack paths and the range of affected devices.

[0123] When identifying propagation characteristic nodes in an attack scenario graph, it is necessary to analyze the nodes' positions and connections within the graph to identify key nodes. Propagation characteristic nodes typically have high connectivity or are located at critical positions along the paths. In the example above, device B is a propagation characteristic node because it connects two different paths and is located at the hub of attack propagation. Other propagation characteristic nodes may include nodes with high in-degree or out-degree, such as device A (as the starting point of multiple paths) and device D (connected to multiple downstream nodes).

[0124] When extracting propagation features based on the connection relationships between nodes, it is necessary to analyze the link patterns between these nodes. Propagation features can include star topologies (one node connects to multiple other nodes), chain topologies (nodes are connected sequentially), and ring topologies (forming a closed loop), etc. In the example above, a star propagation structure centered on device B can be identified, with device B connected to devices A, D, and E, forming a divergent propagation pattern. Another feature is the chain propagation structure from device D to device F and then to device I. These propagation features reflect the spread pattern of the attack in the network.

[0125] When calculating the number of device nodes reachable from a propagation characteristic node as the number of affected devices, it is necessary to calculate the total number of all device nodes reachable from that propagation characteristic node. In the example above, starting from device B, devices D, E, F, H, and I can be reached, a total of 5 device nodes; starting from device A, devices B and all its downstream nodes can be reached, a total of 6 device nodes. These data reflect the size of the influence range of different propagation characteristic nodes.

[0126] When generating the situation assessment dataset, the data obtained in the previous steps are organized into a structured dataset. This dataset includes information such as path overlap, path coverage, the topology of the attack scenario graph, propagation feature nodes and their characteristics, and the number of affected devices. For example, a dataset can be created containing the following fields: path ID, path node sequence, overlapping node list, coverage, attack scenario graph ID, propagation feature type, propagation feature node list, and number of affected devices. In the example above, a record in the dataset might be: {Path ID: 3, Path node sequence: [A, B, E, H], Overlapping node list: [A, B, E], Coverage: 0.47, Attack scenario graph ID: 1, Propagation feature type: "star", Propagation feature node list: [B], Number of affected devices: 5}.

[0127] To improve the accuracy of attack scenario graphs, a node weighting mechanism can be introduced. Weights are assigned to each device node based on factors such as its importance in the network, the severity of alarms, and historical attack frequency. When constructing the attack scenario graph, paths containing high-weight nodes are given priority. For example, if device B is a core production control device with a high weight, then paths containing device B will be prioritized when constructing the attack scenario graph.

[0128] In practical applications, dynamic coverage thresholds can be set and automatically adjusted according to network size and security requirements. For example, in large industrial internet environments, a lower coverage threshold (such as 0.2) can be set to capture more potential attack scenarios; in small networks, a higher threshold (such as 0.5) can be set to focus on the most important attack scenarios.

[0129] In this embodiment, by constructing a path connection table and calculating the degree of path overlap, the scheme can effectively identify key propagation nodes and high-risk propagation paths, avoiding the one-sided analysis of isolated alarms in traditional methods. Introducing a path coverage index allows the system to quantitatively assess the potential attack impact range, prioritizing attack paths with high coverage. Grouping propagation paths with identical repeating nodes into the same group reduces redundant analysis and improves computational efficiency. The attack scenario graph constructed based on the path with the maximum coverage comprehensively demonstrates the propagation pattern and potential impact of alarms in the network, facilitating a direct understanding of the attack chain by security personnel. By identifying propagation feature nodes and extracting propagation features, the system can reveal typical attack patterns and behavioral characteristics, improving the accuracy of anomaly detection. The statistics on the number of affected devices provide a quantitative basis for prioritizing security responses. The generated situation assessment dataset comprehensively reflects the security status of the Industrial Internet, providing high-quality training data for subsequent security situation prediction based on support vector regression, enhancing the foresight and targeting of security protection.

[0130] Figure 3 A performance heatmap is constructed for the attack scenario graph of the embodiments of the present invention, such as... Figure 3 As shown in the figure, this diagram illustrates the attack scenario graph construction performance of this technical solution under different network sizes and path overlap conditions. It can be observed that when the number of network nodes is 100 and the path overlap is 10%, the attack scenario graph construction takes only 8ms, demonstrating extremely high processing efficiency. Even in the most complex scenario (10,000 nodes, 60% overlap), the processing time is only 261ms. Data shows that as the number of network nodes and path overlap increase, the processing time exhibits a non-linear growth, but the growth curve is relatively flat. Particularly noteworthy is that in a medium-sized network (1000 nodes), even with a path overlap of 40%, the construction time is only 58ms, which is far superior to the traditional graph traversal-based algorithms (such as Kruskal's minimum spanning tree algorithm), which typically require more than 200ms. Furthermore, when the number of nodes increases to 5000, even with a high overlap (50%), this technical solution can complete the construction process within 143ms, which is crucial for real-time situational awareness systems. The heatmap clearly demonstrates the advantages of this technical solution based on overlapping path selection, proving its efficiency and scalability in large-scale network environments, and providing a solid performance foundation for network security situation assessment.

[0131] In one optional implementation, the situation assessment dataset is input into a pre-trained support vector regression model to calculate a security situation index, determine protection priorities, and formulate protection strategies based on the diffusion paths in the attack scenario graph, including:

[0132] Extract alarm propagation feature sequences and affected device number sequences from the situation assessment dataset. Calculate standardized features based on the maximum and minimum values ​​of the alarm propagation feature sequences, and calculate normalized features based on the ratio of the affected device number sequence to the total number of devices.

[0133] A feature matrix is ​​constructed by combining standardized features and normalized features. The mutual information between features in the feature matrix is ​​calculated to obtain the feature redundancy. Features are selected based on the feature redundancy and the information gain is calculated. When the information gain is less than a preset gain threshold, the training features are obtained.

[0134] The training features are divided into training and validation sets and cross-validation is performed to obtain the optimal kernel function parameters. The training features and kernel function parameters are input into the support vector regression model, the error value between the predicted result and the true result is calculated, and the model parameters are updated according to the error value. When the error value is less than a preset error threshold, the trained support vector regression model is obtained.

[0135] The security situation index is obtained by inputting the situation assessment dataset into the trained support vector regression model. The security situation index is then weighted and smoothed within a preset time window to obtain a smoothed situation index.

[0136] The situation change rate is obtained by calculating the difference in the smooth situation index between adjacent time points. The protection priority is determined based on the situation change rate. The node weight is calculated by combining the time order of node access on the diffusion path in the attack scenario diagram. The protection priority is adjusted to obtain the protection node sequence. The protection strategy is formulated based on the protection node sequence and the node access time order of the diffusion path.

[0137] In this embodiment, when extracting the alarm propagation feature sequence and the affected device number sequence from the situation assessment dataset, it is necessary to analyze the structured data in the situation assessment dataset. In practical applications, it is assumed that the situation assessment dataset contains data from the past 30 days, where the alarm propagation feature sequence records the frequency of occurrence of different propagation features (such as star, chain, ring, etc.), and the affected device number sequence records the number of devices affected by each security event. For example, on day 1, the star propagation feature appeared 5 times, the chain propagation feature appeared 3 times, and the ring propagation feature appeared once, affecting a total of 15 devices; on day 2, the star propagation feature appeared 4 times, the chain propagation feature appeared 5 times, and the ring propagation feature appeared 2 times, affecting a total of 18 devices, and so on.

[0138] When calculating standardized features based on the maximum and minimum values ​​of the alarm propagation feature sequence, it is necessary to unify the values ​​of different propagation features to the same scale. In the example above, assume that the maximum value of the star-shaped propagation feature over 30 days is 8 and the minimum value is 2; the maximum value of the chain-shaped propagation feature is 7 and the minimum value is 1; and the maximum value of the ring-shaped propagation feature is 4 and the minimum value is 0. For the data of day 1, the standardized star-shaped feature value is (5-2) / (8-2)=0.5, the chain-shaped feature value is (3-1) / (7-1)=0.33, and the ring-shaped feature value is (1-0) / (4-0)=0.25.

[0139] When calculating normalized features based on the ratio of the number of affected devices to the total number of devices, it is necessary to calculate the relative size of the impact range of each security event. Assuming there are 100 devices in an industrial internet environment, the proportion of affected devices on day 1 is 15 / 100 = 0.15, and on day 2 it is 18 / 100 = 0.18. This normalization process makes data comparable across network environments of different sizes. When combining standardized and normalized features to construct a feature matrix, the processed features need to be organized into a structured matrix. In the example above, the feature vector for day 1 is [0.5, 0.33, 0.25, 0.15], the feature vector for day 2 is [0.33, 0.67, 0.5, 0.18], and so on. These feature vectors form the feature matrix, with each row representing one day's data and each column representing a feature.

[0140] When calculating the mutual information value between features in a feature matrix to determine feature redundancy, it is necessary to analyze the correlation between different features. Mutual information is an indicator that measures the degree of interdependence between two variables. The higher the mutual information value, the more common information the two features contain, and the higher the redundancy. In the example above, assume that the calculated mutual information value between the star-shaped feature and the chain-shaped feature is 0.6, the mutual information value between the star-shaped feature and the ring-shaped feature is 0.3, the mutual information value between the chain-shaped feature and the ring-shaped feature is 0.4, the mutual information value between the star-shaped feature and the proportion of affected devices is 0.7, the mutual information value between the chain-shaped feature and the proportion of affected devices is 0.5, and the mutual information value between the ring-shaped feature and the proportion of affected devices is 0.2.

[0141] When selecting features and calculating information gain based on feature redundancy, redundant features need to be removed, retaining those with high information content. Assuming a mutual information threshold of 0.5, the redundancy between star-shaped and chain-shaped features, and between star-shaped features and the proportion of affected devices, is high, requiring further calculation of the information gain for each feature. Assuming the calculated information gain is 0.4 for star-shaped features, 0.3 for chain-shaped features, 0.2 for ring-shaped features, and 0.5 for the proportion of affected devices, training features are obtained when the information gain is less than a preset gain threshold. Assuming the preset gain threshold is 0.25, the information gain of the ring-shaped feature (0.2) is less than the threshold and is therefore discarded. The final selected training features include star-shaped features, chain-shaped features, and the proportion of affected devices.

[0142] When dividing training features into training and validation sets and performing cross-validation to obtain the optimal kernel function parameters, a 5-fold cross-validation method can be used. The 30 days of data are randomly divided into 5 parts, with 4 parts used as the training set and 1 part as the validation set each time, for a total of 5 validations. Assuming linear kernel functions, polynomial kernel functions, and radial basis function kernel functions were tried, cross-validation showed that the radial basis function kernel with gamma=0.1 exhibited the best model performance. When inputting the training features and kernel function parameters into the support vector regression model and calculating the error between the predicted and actual results, a true security situation index needs to be set as the label. Assuming the security situation index for the past 30 days is known, the mean squared error is used as the evaluation metric. The model parameters are continuously adjusted during training. When the error value reaches 0.05, which is less than the preset error threshold of 0.1, the trained support vector regression model is obtained.

[0143] When inputting the situation assessment dataset into a trained support vector regression model to obtain the security situation index, the latest situation assessment data is used as input. Assuming the standardized features of the latest day are [0.6, 0.4, 0.35], the model predicts a security situation index of 0.75. When performing weighted smoothing on the security situation index within a preset time window to obtain a smoothed situation index, exponential smoothing can be used. Assuming a smoothing coefficient of 0.3 and a preset time window of 7 days, the smoothed situation index of the latest day is 0.3 multiplied by 0.75 plus 0.7 multiplied by the smoothed situation index of the previous day, and so on, to obtain the smoothed situation index sequence within the time window.

[0144] When calculating the difference in smoothed situation indices between adjacent time points to obtain the rate of change of security status, the smoothed situation indices of the current time point are subtracted from those of the previous time point. A positive difference indicates a deterioration in the security situation; a negative difference indicates an improvement. Assuming the calculated rate of change of security status is 0.05, it indicates a slight deterioration in the security situation. When determining protection priorities based on the rate of change of security status, a larger rate of change indicates a faster deterioration in the security situation, and a higher protection priority. Assuming a threshold of 0.1 is set, the current rate of change of security status of 0.05 is less than the threshold, and the protection priority is medium.

[0145] When calculating node weights based on the time sequence of node visits along the propagation path in the attack scenario diagram, it is necessary to analyze the position and role of each node in the attack propagation process. Assume the attack scenario diagram shows that device A is the starting point of the attack, passing through device B, device C, and finally device D. Device A has the earliest access time, with a weight of 1.0; device B is next, with a weight of 0.8; device C is next, with a weight of 0.6; and device D is the latest, with a weight of 0.4. When adjusting the protection priority to obtain the protection node sequence, both the situation change rate and the node weights need to be considered. Multiplying the node weights by the protection priority yields the adjusted priority. Since the current protection priority is medium (assuming a value of 0.5), the adjusted priority for device A is 1.0 × 0.5 = 0.5, for device B it is 0.8 × 0.5 = 0.4, for device C it is 0.6 × 0.5 = 0.3, and for device D it is 0.4 × 0.5 = 0.2. Sorting the nodes according to their adjusted priorities from highest to lowest, the protection node sequence is: Device A, Device B, Device C, Device D.

[0146] When developing protection strategies based on the access sequence of nodes along the propagation path, it is necessary to adopt corresponding protection measures according to the characteristics and location of different nodes. For the starting device A, intrusion detection and access control can be strengthened; for intermediate node devices B and C, traffic monitoring and abnormal behavior analysis can be implemented; for the ending device D, data protection and backup and recovery mechanisms can be strengthened. In this way, targeted protection strategies can effectively block the attack propagation path and reduce security risks.

[0147] In this embodiment, feature standardization and normalization solve the problem of direct comparison between different types of data, improving model adaptability. Mutual information calculation and redundancy analysis between features effectively remove redundant features, reducing computational complexity while retaining key information. Cross-validation ensures optimal kernel function parameter selection, enhancing model generalization ability. Weighted smoothing within the time window eliminates interference from short-term fluctuations, making the situation index more stable and reliable. Situation change rate calculation provides a quantitative basis for protection priority judgment, and combined with the node time-series weight adjustment mechanism in the attack scenario graph, it achieves precise allocation of protection resources. Protection strategies based on node access time-series are highly targeted, capable of intercepting attacks at critical stages of propagation and effectively blocking attack spread paths. The overall solution forms a complete closed loop from data processing, feature selection, model training to situation assessment and protection decision-making, significantly improving the accuracy, foresight, and operability of industrial internet security situation awareness, and providing scientific decision support for security operations teams.

[0148] In one optional implementation, the node centrality of each industrial internet device is calculated based on the attack scenario graph, a protection decision tree is constructed in conjunction with the protection strategy, and the optimal combination of protection nodes is selected based on the node centrality and the protection decision tree to generate protection instructions, including:

[0149] Degree centrality is obtained by calculating the alarm reception and propagation volume of each industrial internet device node in the attack scenario graph, betweenness centrality is obtained by calculating the alarm forwarding count of the node based on the attack scenario graph, and proximity centrality is obtained by calculating the shortest hop count between nodes.

[0150] Extract the alarm processing sequence of nodes in the attack scenario graph, calculate the alarm propagation delay of nodes, and adaptively weight degree centrality, betweenness centrality and proximity centrality based on the propagation delay to obtain node centrality.

[0151] Based on the node centrality, industrial internet devices are classified into importance levels. According to the protection requirements corresponding to the importance level, protection measures are divided into different protection levels. A protection decision tree is constructed, and decision rules based on node centrality and propagation delay are set at the branch nodes of the protection decision tree.

[0152] Based on the decision rules, nodes to be protected are selected at each protection level. The alarm processing efficiency of the selected nodes is statistically analyzed. The protection priority is calculated by combining the position of the node in the attack scenario graph. The protection priority is matched with the protection level to generate a candidate protection node combination.

[0153] Calculate the alarm blocking effect of each candidate protection node combination, select the protection node combination with the best blocking effect and satisfying resource constraints, and generate protection instructions based on the protection node combination.

[0154] In this embodiment, when calculating the degree centrality of each industrial internet device node in the attack scenario graph based on the alarm reception and propagation volume, the number of connections for each node is counted. In practical applications, the attack scenario graph contains multiple industrial internet device nodes, such as PLC controllers, SCADA servers, industrial gateways, and smart sensors. By analyzing the alarm flow records, it can be statistically determined that the PLC controller receives 8 alarms, propagates 5 alarms, has a total of 13 connections, and a degree centrality of 13; the SCADA server receives 10 alarms, propagates 12 alarms, has a total of 22 connections, and a degree centrality of 22; the industrial gateway receives 15 alarms, propagates 8 alarms, has a total of 23 connections, and a degree centrality of 23; and the smart sensor receives 4 alarms, propagates 2 alarms, has a total of 6 connections, and a degree centrality of 6. A higher degree centrality value indicates that the device is more active in the alarm propagation network and may be an important node in the attack propagation process.

[0155] When calculating the betweenness centrality of nodes based on the alarm forwarding count in the attack scenario graph, the frequency of each node acting as a relay station is analyzed. By traversing all alarm propagation paths in the attack scenario graph, the number of paths in which each device participates in forwarding is counted. The PLC controller participates in forwarding on 7 paths, with a betweenness centrality of 7; the SCADA server participates in forwarding on 18 paths, with a betweenness centrality of 18; the industrial gateway participates in forwarding on 15 paths, with a betweenness centrality of 15; and the smart sensor participates in forwarding on 2 paths, with a betweenness centrality of 2. Nodes with high betweenness centrality often act as "bridges" in the network, controlling the flow of information between different areas.

[0156] When calculating the shortest hop count between nodes to determine proximity centrality, the average distance from each node to other nodes is analyzed. Proximity centrality is inversely proportional to the average hop count; the shorter the average distance from a node to other nodes, the higher its proximity centrality. Using a breadth-first search algorithm, the average hop count from the PLC controller to all other nodes was calculated to be 2.1, with a proximity centrality of 0.48; the average hop count for the SCADA server was 1.5, with a proximity centrality of 0.67; the average hop count for the industrial gateway was 1.3, with a proximity centrality of 0.77; and the average hop count for the smart sensor was 2.8, with a proximity centrality of 0.36. Nodes with high proximity centrality can quickly reach other nodes in the network and play an important role in the propagation of alarm information.

[0157] By extracting the alarm processing sequence of nodes in the attack scenario graph and calculating the alarm propagation delay, the time required for alarms to propagate between nodes is analyzed. Through timestamp analysis, the average alarm propagation delay is calculated to be 350 milliseconds for PLC controllers, 180 milliseconds for SCADA servers, 150 milliseconds for industrial gateways, and 420 milliseconds for smart sensors. Nodes with lower propagation delays have higher alarm processing efficiency and are more valuable in protection decision-making.

[0158] An adaptive weighting mechanism based on propagation delay is used to combine the three centrality indices to obtain the node centrality, employing a delay-inverse weighting mechanism. The smaller the propagation delay, the greater the weight of the corresponding centrality index. The basic weights for degree centrality, betweenness centrality, and proximity centrality are set to 0.4, 0.3, and 0.3, respectively. Based on the propagation delay of each device, the weights are adjusted as follows: PLC controller [0.35, 0.3, 0.35]; SCADA server [0.4, 0.35, 0.25]; industrial gateway [0.45, 0.3, 0.25]; and smart sensor [0.3, 0.35, 0.35]. Multiplying the adjusted weights by their corresponding centrality indices and summing the results, the node centrality of the PLC controller is 6.92; the SCADA server is 12.57; the industrial gateway is 13.69; and the smart sensor is 2.53.

[0159] When classifying the importance of industrial internet devices based on node centrality, a grading standard is established. A node centrality greater than 10 indicates high importance, between 5 and 10 indicates medium importance, and less than 5 indicates low importance. Accordingly, SCADA servers and industrial gateways are classified as high-importance devices, PLC controllers as medium-importance devices, and smart sensors as low-importance devices. This grading provides a basis for subsequent protection decisions.

[0160] Based on the protection requirements corresponding to the importance level, protection measures are divided into different protection levels. A three-tiered protection system is designed when constructing the protection decision tree. High-importance devices employ advanced protection measures, including deep packet inspection, anomaly analysis, and real-time monitoring; medium-importance devices employ intermediate protection measures, including basic intrusion detection and access control; and low-importance devices employ basic protection measures, including periodic security scans and basic firewall rules. The root node of the protection decision tree is the device importance assessment, the second layer is the propagation delay assessment, and the third layer is the selection of specific protection measures.

[0161] When setting decision rules based on node centrality and propagation delay at the branch nodes of the protection decision tree, protection strategies are formulated for different node characteristics. Nodes with high importance and propagation delay less than 200 milliseconds (such as industrial gateways) are given priority for real-time deep behavioral analysis; nodes with high importance and propagation delay greater than or equal to 200 milliseconds (such as SCADA servers) are given priority for preventive access control; medium-importance nodes (such as PLC controllers) are given basic intrusion detection systems; and low-importance nodes (such as smart sensors) are given periodic security scans.

[0162] Based on decision-making rules, nodes to be protected are selected at each protection level. When calculating the alarm processing efficiency of the selected nodes, the proportion of successfully processed alarms for each device in historical data is analyzed. The alarm processing efficiency of the industrial gateway is 92%, the SCADA server is 88%, the PLC controller is 85%, and the smart sensor is 75%. Protection priorities are calculated based on the node's position in the attack scenario diagram, considering the upstream and downstream connections of the nodes. The industrial gateway connects multiple critical subnets, with a protection priority of 0.95; the SCADA server controls multiple industrial processes, with a protection priority of 0.9; the PLC controller is responsible for the operation of critical equipment, with a protection priority of 0.8; and the smart sensor has relatively independent functions, with a protection priority of 0.6.

[0163] When generating candidate protection node combinations by matching protection priorities with protection levels, both the importance level and protection priority of the nodes are considered. The generated candidate combinations include: combination 1 (industrial gateway and SCADA server), combination 2 (industrial gateway and PLC controller), combination 3 (SCADA server and PLC controller), and combination 4 (industrial gateway, SCADA server, and smart sensor).

[0164] When calculating the alarm blocking effect of each candidate protection node combination, the proportion of potential attack paths that each combination can block is evaluated. Combination 1 blocks 88% of attack paths, combination 2 blocks 75% of attack paths, combination 3 blocks 70% of attack paths, and combination 4 blocks 90% of attack paths. Considering resource constraints, assuming the system is limited to protecting a maximum of two nodes simultaneously, the protection node combination with the best blocking effect and meeting the resource constraints is selected, namely combination 1 (industrial gateway and SCADA server).

[0165] When generating protection commands based on the combination of protection nodes, specific protection configurations are formulated for the selected devices. Deep packet inspection commands are generated for industrial gateways, rules are configured to identify abnormal traffic patterns, and a real-time behavior analysis module is deployed. Access control enhancement commands are generated for SCADA servers, fine-grained permission management is configured, and abnormal operation auditing is implemented. These protection commands are distributed to the corresponding devices through the security management platform, achieving precise protection of the industrial internet environment and effectively improving network security posture. The execution results of the protection commands are recorded and analyzed by a support vector regression model, providing data support for subsequent security posture assessments and forming a closed-loop optimization mechanism.

[0166] In this embodiment, through comprehensive analysis of degree centrality, betweenness centrality, and proximity centrality, the system can comprehensively identify key nodes in the network, rather than being limited to the single-dimensional importance assessment of traditional methods. The introduction of an adaptive weighted mechanism based on alarm propagation delay makes node importance assessment more consistent with actual network operating characteristics, improving assessment accuracy. Device importance grading based on node centrality provides a scientific basis for the rational allocation of protection resources, avoiding resource waste. The construction of the protection decision tree combines expert experience with data analysis, making protection strategies more targeted and adaptable. Decision rules based on node characteristics and location achieve precise matching of protection measures, improving protection efficiency. The generation and evaluation mechanism of candidate protection node combinations ensures optimal protection effects under resource constraints, balancing protection costs and security benefits.

[0167] A second aspect of this invention provides an industrial internet security situation analysis system based on support vector regression, the system comprising:

[0168] The first unit is used to collect alarm data from industrial internet devices. Based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, the alarm data is analyzed by using a time window sliding method to identify alarm events with causal relationships.

[0169] The second unit is used to establish a time-series propagation matrix based on alarm events from the same source, calculate the alarm propagation probability between industrial internet devices, construct diffusion paths, construct an attack scenario graph based on the overlap and coverage of multiple diffusion paths, extract the propagation characteristics of alarm data and the number of affected devices in the attack scenario graph, and generate a situation assessment dataset.

[0170] The third unit is used to input the situation assessment dataset into a pre-trained support vector regression model, calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph.

[0171] The fourth unit is used to calculate the node centrality of each industrial internet device based on the attack scenario graph, construct a protection decision tree in combination with the protection strategy, select the optimal combination of protection nodes according to the node centrality and the protection decision tree, generate protection instructions, and send the protection instructions to the affected industrial internet devices to implement proactive protection.

[0172] A third aspect of the present invention provides an electronic device, comprising:

[0173] processor;

[0174] Memory used to store processor-executable instructions;

[0175] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0176] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0177] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing the security situation of the industrial internet based on support vector regression, characterized in that, include: Collect alarm data from industrial internet devices, and based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, use a time window sliding method to perform correlation analysis on the alarm data to identify alarm events with causal relationships. A time-series propagation matrix is ​​established based on alarm events from the same source. The alarm propagation probability between industrial internet devices is calculated, and a diffusion path is constructed. An attack scenario graph is constructed based on the overlap and coverage of multiple diffusion paths. The propagation characteristics of alarm data and the number of affected devices are extracted from the attack scenario graph to generate a situation assessment dataset. The situation assessment dataset is input into a pre-trained support vector regression model to calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph. The node centrality of each industrial internet device is calculated based on the attack scenario graph. A protection decision tree is constructed in combination with the protection strategy. The optimal combination of protection nodes is selected according to the node centrality and the protection decision tree. Protection instructions are generated and sent to the affected industrial internet devices to implement proactive protection. Alarm data from industrial internet devices is collected. Based on the temporal attributes of the alarm data and the network topology between industrial internet devices, a sliding time window approach is used to perform correlation analysis on the alarm data to identify causally related alarm events from the same source, including: Collect alarm data from industrial internet devices, set corresponding baseline time windows based on the alarm levels of the alarm data, and construct a network connection diagram based on the network topology between industrial internet devices. The network connection diagram includes device nodes and communication links. The alarm density of the alarm data is calculated using a density clustering algorithm based on an attention mechanism. Based on the alarm density and the shortest path hop count between device nodes in the network connection graph, the baseline time window is adaptively adjusted to obtain the time window. Within the time window, time series similarity is calculated based on the time series attributes of alarm data, path similarity is calculated based on the shortest path between device nodes in the network connection graph, and feature similarity is calculated based on the attribute features of alarm data. Calculate the propagation weight coefficient of the alarm data, and use the propagation weight coefficient to weight and combine the temporal similarity, path similarity and feature similarity to obtain the alarm propagation probability. Construct an alarm propagation graph, where nodes are alarm data and edges are alarm propagation relationships with alarm propagation probabilities. The alarm propagation graph is dynamically verified based on a recursive search algorithm. Alarm propagation relationships that do not meet the propagation timing constraints are identified and eliminated, resulting in multiple connected subgraphs. The timing consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

2. The method according to claim 1, characterized in that, A recursive search algorithm is used to perform dynamic path verification on the alarm propagation graph, identifying and eliminating alarm propagation relationships that do not meet propagation timing constraints, resulting in multiple connected subgraphs. Timing consistency verification is then performed on these connected subgraphs, identifying causally related alarm events originating from the same source, including: Calculate the propagation delay attenuation coefficient based on the network hop count between alarm data, and determine the propagation timing constraints between adjacent alarm data based on the propagation delay attenuation coefficient; Based on the alarm types in the alarm data, alarm propagation rules are constructed. The alarm propagation graph is preprocessed according to the alarm propagation rules, and alarm propagation relationships that do not meet the alarm propagation rules are deleted to obtain the preprocessed alarm propagation graph. A depth-first search is performed on the source alarm data in the preprocessed alarm propagation graph. During the search, it is determined whether the time interval between adjacent alarm data meets the propagation timing constraints. Alarm data that violates the propagation timing constraints are marked as invalid alarm data. Skip path search starting from invalid alarm data, update the reachability marker of the alarm data, and save the alarm propagation relationship that satisfies the propagation timing constraint as a valid alarm propagation relationship; Based on the connectivity of effective alarm propagation relationships, the preprocessed alarm propagation graph is decomposed into multiple connected subgraphs. The propagation probability of alarm propagation relationships in the connected subgraphs and the temporal consistency index of alarm timestamps are calculated. Based on the temporal consistency index, the temporal consistency of the connected subgraphs is verified to identify alarm events with causal relationships.

3. The method according to claim 1, characterized in that, Based on alarm events originating from the same source, a time-series propagation matrix is ​​established to calculate the alarm propagation probability among industrial internet devices and construct the diffusion path, including: An initial time-series propagation matrix is ​​constructed based on the same source alarm events. The industrial internet devices in the same source alarm events are used as row vectors and column vectors. The number of alarm propagation times between each pair of devices is counted within a specified time window. For any two industrial internet devices, the alarm propagation probability is obtained by the ratio of the number of times the target device generates an alarm after the source device generates an alarm to the total number of alarms of the source device. The alarm propagation probability is filled into the corresponding matrix element positions to generate the time-series propagation matrix. The alarm propagation probability of devices less than a preset probability threshold is set to zero to obtain a filtered time-series propagation matrix. Based on the filtered time-series propagation matrix, a depth-first search method is used to search for alarm propagation paths starting from the first alarm device. The alarm propagation probability on each path is multiplied to obtain the path weight. A weight threshold is set for the path weight, and paths with a weight greater than the weight threshold are retained as propagation paths.

4. The method according to claim 1, characterized in that, An attack scenario map is constructed based on the overlap and coverage of multiple propagation paths. The propagation characteristics of alarm data and the number of affected devices are extracted from this map to generate a situation assessment dataset, including: A path connection table is constructed based on the diffusion path. The path connection table records the sequence of device nodes traversed by each diffusion path. The degree of path overlap is obtained by counting the number of repeated device nodes in the path connection table. The total number of accessible nodes along each diffusion path is obtained by traversing the sequence of device nodes. The ratio of the total number of accessible nodes to the total number of network nodes is used as the path coverage. Based on the degree of path overlap, diffusion paths with the same repeating nodes are divided into the same group, the coverage of the paths in each group is calculated, and the path with the largest coverage is selected to construct the attack scenario graph. Identify propagation feature nodes in the attack scenario graph, extract propagation features based on the connection relationships between the propagation feature nodes, count the number of device nodes reachable by the propagation feature nodes as the number of affected devices, and generate a situation assessment dataset.

5. The method according to claim 1, characterized in that, The situation assessment dataset is input into a pre-trained support vector regression model to calculate the security situation index, determine protection priorities, and formulate protection strategies based on the diffusion paths in the attack scenario graph, including: Extract alarm propagation feature sequences and affected device number sequences from the situation assessment dataset. Calculate standardized features based on the maximum and minimum values ​​of the alarm propagation feature sequences, and calculate normalized features based on the ratio of the affected device number sequence to the total number of devices. A feature matrix is ​​constructed by combining standardized features and normalized features. The mutual information between features in the feature matrix is ​​calculated to obtain the feature redundancy. Features are selected based on the feature redundancy and the information gain is calculated. When the information gain is less than a preset gain threshold, the training features are obtained. The training features are divided into training and validation sets and cross-validation is performed to obtain the optimal kernel function parameters. The training features and kernel function parameters are input into the support vector regression model, the error value between the predicted result and the true result is calculated, and the model parameters are updated according to the error value. When the error value is less than a preset error threshold, the trained support vector regression model is obtained. The security situation index is obtained by inputting the situation assessment dataset into the trained support vector regression model. The security situation index is then weighted and smoothed within a preset time window to obtain a smoothed situation index. The situation change rate is obtained by calculating the difference in the smooth situation index between adjacent time points. The protection priority is determined based on the situation change rate. The node weight is calculated by combining the time order of node access on the diffusion path in the attack scenario diagram. The protection priority is adjusted to obtain the protection node sequence. The protection strategy is formulated based on the protection node sequence and the node access time order of the diffusion path.

6. The method according to claim 1, characterized in that, Based on the attack scenario graph, the node centrality of each industrial internet device is calculated. A protection decision tree is constructed by combining the protection strategy. The optimal combination of protection nodes is selected based on the node centrality and the protection decision tree. Protection commands are then generated, including: Degree centrality is obtained by calculating the alarm reception and propagation volume of each industrial internet device node in the attack scenario graph, betweenness centrality is obtained by calculating the alarm forwarding count of the node based on the attack scenario graph, and proximity centrality is obtained by calculating the shortest hop count between nodes. Extract the alarm processing sequence of nodes in the attack scenario graph, calculate the alarm propagation delay of nodes, and adaptively weight degree centrality, betweenness centrality and proximity centrality based on the propagation delay to obtain node centrality. Based on the node centrality, industrial internet devices are classified into importance levels. According to the protection requirements corresponding to the importance level, protection measures are divided into different protection levels. A protection decision tree is constructed, and decision rules based on node centrality and propagation delay are set at the branch nodes of the protection decision tree. Based on the decision rules, nodes to be protected are selected at each protection level. The alarm processing efficiency of the selected nodes is statistically analyzed. The protection priority is calculated by combining the position of the node in the attack scenario graph. The protection priority is matched with the protection level to generate a candidate protection node combination. Calculate the alarm blocking effect of each candidate protection node combination, select the protection node combination with the best blocking effect and satisfying resource constraints, and generate protection instructions based on the protection node combination.

7. An industrial internet security situation analysis system based on support vector regression, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to collect alarm data from industrial internet devices. Based on the time-series attributes of the alarm data and the network topology relationship between industrial internet devices, the alarm data is analyzed by using a time window sliding method to identify alarm events with causal relationships. The second unit is used to establish a time-series propagation matrix based on alarm events from the same source, calculate the alarm propagation probability between industrial internet devices, construct diffusion paths, construct an attack scenario graph based on the overlap and coverage of multiple diffusion paths, extract the propagation characteristics of alarm data and the number of affected devices in the attack scenario graph, and generate a situation assessment dataset. The third unit is used to input the situation assessment dataset into a pre-trained support vector regression model, calculate the security situation index, determine the protection priority, and formulate protection strategies in combination with the diffusion path in the attack scenario graph. The fourth unit is used to calculate the node centrality of each industrial internet device based on the attack scenario graph, construct a protection decision tree in combination with the protection strategy, select the optimal combination of protection nodes according to the node centrality and the protection decision tree, generate protection instructions, and send the protection instructions to the affected industrial internet devices to implement proactive protection.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images