Industrial internet intrusion detection model construction method, intrusion detection method and device

Abstract

The invention relates to the field of industrial internet, and provides an industrial internet intrusion detection model construction method and an intrusion detection method and device.The construction method comprises the steps that locally-stored industrial internet sample data features are obtained; performing risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, the risk assessment function being constructed based on the relative importance of each risk signal; training a local model based on the risk assessment score of the sample data feature to obtain the parameter update quantity of the current parameter of the global model; and sending the parameter update quantity to a central server to aggregate the parameter update quantity, iteratively updating the current parameter of the global model based on an aggregation result until the global model finishes training, and determining the trained global model as the industrial internet intrusion detection model. According to the method and the device provided by the invention, the intrusion behavior can be accurately identified, the false report and missing report rate is reduced, the novel attack detection capability is strong, and the system adaptability is improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet technology, and in particular to an industrial Internet intrusion detection model construction method, intrusion detection method and device. Background Art

[0002] The Industrial Internet faces complex security threats, primarily manifested in the high complexity of the challenges: the Industrial Internet consists of a large number of devices, sensors, and control systems, resulting in a complex network structure and an easy target for attack. Real-time requirements: Industrial control systems have extremely high real-time requirements, and traditional intrusion detection methods struggle to meet the demand for rapid response. Data silos: Data in the Industrial Internet is dispersed across different companies and departments, making data sharing difficult and resulting in insufficient collaborative defense capabilities. New types of attacks are on the rise: With the development of the Industrial Internet, attack methods are becoming increasingly sophisticated, making traditional rule-based or signature-based detection methods difficult to handle. Furthermore, data silos and privacy protection issues limit the improvement of collaborative defense capabilities.

[0003] Existing intrusion detection technologies primarily include the following: ① Rule- or signature-based detection: Relying on known attack patterns, it cannot detect new or unknown attacks. It also requires frequent rule base updates, resulting in high maintenance costs. ② Machine learning-based detection: Requires centralized data training models, which poses the risk of data privacy leaks. Model performance degrades when data is unevenly distributed. ③ Traditional distributed detection: Data sharing can lead to privacy leaks, making it difficult to meet the data privacy requirements of the Industrial Internet. Furthermore, high computational and communication overhead makes it difficult to adapt to the real-time demands of the Industrial Internet. Summary of the Invention

[0004] The present invention provides an industrial Internet intrusion detection model construction method, an intrusion detection method and a device to address the defect that the intrusion detection technology in the prior art is difficult to cope with the complex security threats faced by the industrial Internet. The present invention provides a method for constructing an industrial Internet intrusion detection model, which is applied to all participants in federated learning, including: Obtain the characteristics of the locally stored industrial Internet sample data; Performing a risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; Training a local model based on the risk assessment score of the sample data feature to obtain parameter updates of current parameters of the global model; The parameter update amount is sent to the central server so that the central server aggregates the parameter update amount, and iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained, and the trained global model is determined as the industrial Internet intrusion detection model.

[0005] According to the method for constructing an industrial Internet intrusion detection model provided by the present invention, the risk assessment function is constructed based on the following steps: Based on the operational characteristics of the Industrial Internet, identify danger signals and extract danger signal features; Determine the feature weight of each danger signal feature based on the relative importance between each two danger signal features; The risk assessment function is constructed based on the feature weights of the risk signal features.

[0006] According to the method for constructing an industrial Internet intrusion detection model provided by the present invention, constructing the risk assessment function based on the feature weights of the respective danger signal features includes: The risk assessment function is constructed based on the following formula:

[0007] Where, To score the risk assessment, For the The feature weight of each danger signal feature, For the Danger signal characteristics, is the number of red flag features.

[0008] According to the method for constructing an industrial Internet intrusion detection model provided by the present invention, the risk assessment score training of the local model based on the sample data characteristics includes: Determining a training weight for the sample data feature based on the risk assessment score of the sample data feature; Determining a weighted cross entropy loss function based on the training weights of the sample data features; The local model is trained based on the weighted cross entropy loss function.

[0009] According to the method for constructing an industrial Internet intrusion detection model provided by the present invention, obtaining the characteristics of the locally stored industrial Internet sample data includes: Acquire raw sample data and extract raw data features, wherein the raw sample data includes at least one of network traffic data, system log data, and device status data; The original data features are normalized to obtain the sample data features.

[0010] The present invention also provides an industrial Internet intrusion detection method, which is characterized by comprising: Obtain the characteristics of the data to be tested in the Industrial Internet; The data features to be detected are input into a trained industrial Internet intrusion detection model to obtain a risk score output by the industrial Internet intrusion detection model, the risk score is compared with a preset risk threshold, and intrusion detection is performed based on the comparison result; wherein, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0011] According to the industrial Internet intrusion detection method provided by the present invention, the danger threshold is determined based on the following steps: identifying multiple candidate hazard thresholds; Each candidate danger threshold is tested on a validation set to obtain a false positive rate and a false negative rate of the industrial Internet intrusion detection model under each candidate danger threshold; A ROC curve is drawn based on the false alarm rate and the missed alarm rate of the industrial Internet intrusion detection model under each candidate danger threshold, and the danger threshold is determined from the multiple candidate danger thresholds based on the ROC curve.

[0012] The present invention also provides an industrial Internet intrusion detection model construction device, which is applied to each participant in federated learning, including: A sample data acquisition unit, used to acquire the characteristics of the industrial Internet sample data stored locally; a risk assessment unit, configured to perform risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; A model training unit, configured to train a local model based on the risk assessment score of the sample data feature to obtain parameter update amounts of current parameters of the global model; A model determination unit is used to send the parameter update amount to a central server so that the central server aggregates the parameter update amount, iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained, and determines the trained global model as the industrial Internet intrusion detection model.

[0013] The present invention also provides an industrial Internet intrusion detection device, comprising: A unit for acquiring data to be tested, used to obtain characteristics of data to be tested on the industrial Internet; an intrusion detection unit, configured to input the features of the data to be detected into a trained industrial Internet intrusion detection model to perform intrusion detection, obtain a risk score output by the industrial Internet intrusion detection model, compare the risk score with a preset risk threshold, and perform intrusion detection based on the comparison result; Among them, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements any of the above-mentioned industrial Internet intrusion detection model construction methods or industrial Internet intrusion detection methods.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned industrial Internet intrusion detection model construction methods or industrial Internet intrusion detection methods. The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned industrial Internet intrusion detection model construction methods or industrial Internet intrusion detection methods.

[0016] The industrial Internet intrusion detection model construction method, intrusion detection method and device provided by the present invention, by combining immune risk theory and federated learning, can provide an industrial Internet intrusion detection model that can both protect data privacy and efficiently detect intrusions, so as to meet the special needs of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is one of the flow charts of the industrial Internet intrusion detection model construction method provided by the present invention.

[0019] Figure 2 This is one of the flow charts of the industrial Internet intrusion detection method provided by the present invention.

[0020] Figure 3 This is the second flow chart of the industrial Internet intrusion detection method provided by the present invention.

[0021] Figure 4 It is a structural diagram of the industrial Internet intrusion detection model building device provided by the present invention.

[0022] Figure 5 It is a structural diagram of the industrial Internet intrusion detection device provided by the present invention.

[0023] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0025] In response to the problem that intrusion detection technology in the existing technology is difficult to cope with the complex security threats faced by the industrial Internet, an embodiment of the present invention proposes a method for constructing an industrial Internet intrusion detection model, in which locally stored industrial Internet sample data features are obtained; the risk assessment score of the sample data features is determined based on a risk assessment function, and the risk assessment function is constructed based on the relative importance of each risk signal; the local model is trained based on the risk assessment score of the sample data features to obtain the parameter update amount of the current parameter of the global model; the parameter update amount is sent to the central server so that the central server aggregates the parameter update amount, and the current parameters of the global model are iteratively updated based on the aggregation result until the global model is trained, and the trained global model is determined as the industrial Internet intrusion detection model.

[0026] The embodiment of the present invention introduces immune danger theory and federated learning in the process of model construction. The biological immune system can respond to external threats by identifying "danger signals", and this mechanism can be applied to intrusion detection. The advantage of the biological immune system applied here is that it can dynamically identify unknown attacks, adapt to the complex industrial Internet environment, and is also adaptive and can adjust the detection strategy according to environmental changes. Federated learning allows multiple participants to collaboratively train models without sharing original data, solving the problems of data silos and privacy protection. Federated learning is also adapted to the distributed architecture of the industrial Internet and can realize model training and updating without centralizing data. By combining immune danger theory and federated learning, the embodiment of the present invention can provide an industrial Internet intrusion detection model that can protect data privacy and efficiently detect intrusions to meet the special needs of the industrial Internet.

[0027] Embodiments of the present invention can be applied to scenarios requiring industrial internet intrusion detection. The execution subject of this method can be an electronic device such as a terminal device, a computer, a server, a server cluster, or a specially designed industrial internet intrusion detection model building device, or a model building device provided in such an electronic device. The model building device can be implemented using software, hardware, or a combination of both.

[0028] In the description of the embodiments of the present invention, “plurality” means two or more than two, unless otherwise clearly defined.

[0029] Figure 1 This is one of the flow charts of the method for building an industrial Internet intrusion detection model provided by the present invention, such as Figure 1 As shown, the method includes the following steps: Step 110, obtain the locally stored industrial Internet sample data features.

[0030] Specifically, to address data silos and privacy issues across the Industrial Internet, embodiments of the present invention establish a federated learning framework for model training. Federated learning involves identifying various production units, management departments, and other entities within the Industrial Internet as participants. A client-server architecture, or other suitable architecture, is employed, typically with a central server and multiple local client devices. The central server is responsible for model distribution, aggregation, and management, while each client performs data training and model updates locally.

[0031] The execution subject of this embodiment may be each client, and each client obtains the characteristics of the industrial Internet sample data stored locally.

[0032] Industrial Internet sample data refers to multi-source heterogeneous data generated during the operation of industrial equipment, sensors, control systems, networks, etc., and used for model training, including structured data (such as temperature and pressure values), semi-structured data (such as JSON format logs), and unstructured data (such as images and text).

[0033] Sample data features refer to attributes or variables extracted from sample data that can represent key information of the data and are used for model training or analysis.

[0034] In some embodiments, step 110 specifically includes: Step 111: obtaining raw sample data and extracting raw data features, where the raw sample data includes at least one of network traffic data, system log data, and device status data; Step 112: normalize the original data features to obtain sample data features.

[0035] Specifically, data collection tools are deployed at key nodes of the Industrial Internet, such as production equipment, network switches, and servers, to collect raw sample data. Network traffic data includes source IP, destination IP, port number, protocol type, packet size, and frequency; system log data covers device operation records and user login information; and device status data includes, for example, CPU usage, memory usage, and disk I / O.

[0036] Standardize the raw sample data, remove duplicate, erroneous, or incomplete data records, fill in missing values, and correct data format errors. Use statistical analysis, machine learning algorithms, and other methods to extract key features and obtain raw data features.

[0037] Then the original data features are normalized to make them in the same scale range. Normalization can be done using the Z-score normalization method, the formula is:

[0038] In the formula, x is the original data feature, μ is the mean of the original data feature, is the standard deviation of the feature, is the normalized feature value, i.e., the sample data feature. This formula converts the raw data features into standardized values ​​with a mean of 0 and a standard deviation of 1, ensuring that different features are weighted consistently during model training. This ensures that during subsequent model training, different features have the same influence on model parameter updates, preventing instability in model training caused by large differences in feature scale.

[0039] Step 120 , performing risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score. The risk assessment function is constructed based on the relative importance of each risk signal.

[0040] Specifically, risk assessment begins after obtaining sample data characteristics. Prior to this step, a risk assessment function can be constructed. A risk assessment function is a quantitative model that calculates the overall risk level of the sample data by combining weighted or other mathematical relationships across multiple risk signals (features or indicators). The risk assessment function maps multidimensional risk signals into a single numerical value (a risk assessment score) that is used to measure the potential risk level of the sample.

[0041] Red flags are indicators or characteristics that reflect potential anomalies or threats to a device or system, and may come from sensor data, log records, or the external environment.

[0042] The relative importance of each hazard signal refers to the difference in their contribution to the overall risk. This is determined using statistical methods (such as feature importance analysis) or domain knowledge. For example, in industrial fault detection, "bearing temperature" may be more important than "ambient humidity" and thus have a higher weight.

[0043] In some embodiments, the risk assessment function is constructed based on the following steps: Based on the operational characteristics of the Industrial Internet, identify danger signals and extract danger signal features; Determine the feature weight of each danger signal feature based on the relative importance between each two danger signal features; Based on the feature weights of each danger signal feature, a danger assessment function is constructed.

[0044] Specifically, based on the operational characteristics of the Industrial Internet, we identify danger signals. Abnormal network traffic patterns, such as a traffic surge of more than five times in a short period of time; unauthorized access attempts, such as more than 20 login attempts from an unfamiliar IP address within 10 minutes; and abnormal system resource consumption, such as CPU utilization exceeding 80% for 30 consecutive minutes, can serve as danger signals. These signals can then be characterized by feature extraction.

[0045] The feature weights of each red flag feature can be determined using the Analytic Hierarchy Process (AHP). First, the relative importance of each pair of red flag features is calculated. Experts are then invited to rate the relative importance of different red flag features to construct a judgment matrix. For example, for three red flag features, x1 (abnormal network traffic patterns), x2 (unauthorized access attempts), and x3 (abnormal system resource consumption), experts pairwise compare their importance, resulting in the following judgment matrix A:

[0046] By calculating the maximum eigenvalue of the matrix and its corresponding eigenvector and performing a consistency check, the normalized weight vector [w1, w2, w3] of the eigenvector is obtained, thereby determining the characteristic weight of each danger signal feature.

[0047] On this basis, a risk assessment function is constructed based on the feature weights of each risk signal feature.

[0048] In some embodiments, a risk assessment function may be designed using a weighted summation approach. The risk assessment function is constructed based on the following formula:

[0049] Where, To score the risk assessment, For the The feature weight of each danger signal feature, For the Danger signal characteristics, is the number of red flag features.

[0050] Step 130 : training a local model based on the risk assessment score of the sample data feature to obtain parameter update amounts for current parameters of the global model.

[0051] Specifically, a local model is a model deployed on a single device or node, trained based on local data and adapted to the local feature distribution. On the central server, select an appropriate global model, such as a multilayer perceptron (MLP), and initialize the model parameters. Assume the MLP model consists of an input layer, hidden layers, and an output layer. The number of input layer nodes is determined by the number of extracted features, and the number of hidden layer nodes can be determined using the following formula:

[0052] in is the number of hidden layer nodes, is the number of input layer nodes, is the number of nodes in the output layer, is a constant (usually between 1 and 10).

[0053] Initialize the global model's parameters, such as the weight matrix and bias vector, using either random initialization or initialization based on a specific distribution (e.g., normal distribution). Distribute the initialized global model parameters to each client. The client updates its local model based on the received global model parameters.

[0054] Each client trains a local model based on the risk assessment score of sample data features. The risk assessment score guides model training to focus on high-risk features and adjust parameters to increase sensitivity to red flags. If the risk assessment score indicates potential intrusion risk, the model adjusts its parameters accordingly, prioritizing these features and enhancing its ability to identify intrusion signatures. For example, if a data sample with a short-term surge in traffic is found to have a high risk assessment score, the model will adjust its parameters to increase the weighting of traffic-related features.

[0055] In some embodiments, training a local model based on the risk assessment score of the sample data features in step 130 includes: Step 131, determining a training weight for the sample data feature based on the risk assessment score of the sample data feature; Step 132: determining a weighted cross entropy loss function based on the training weights of the sample data features; Step 133: Train the local model based on the weighted cross entropy loss function.

[0056] Specifically, the client uses locally preprocessed data to train a local model based on immune risk theory. Let the model's loss function be L(θ), where θ is the model parameter. During local training, the gradient of the loss function with respect to the parameter, ∇θL(θ), is calculated. Based on the risk assessment score, if the score indicates a high intrusion risk, the learning rate α may be appropriately increased to increase the model parameter update amplitude and accelerate the learning of intrusion features. If the score indicates a low risk, the learning rate may be appropriately reduced to ensure the stability of model training. Model parameters are updated according to the following gradient descent formula:

[0057] Where α is the learning rate and t is the number of iterations.

[0058] The loss function may be a weighted cross entropy loss function. The weighted cross entropy loss function is determined based on the training weights of the sample data features. The training weights of the sample data features are determined based on the risk assessment scores of the sample data features.

[0059] No. The training weight of the sample data features It can be expressed as: ,in It is a regulating factor used to control the impact of risk assessment score on training weight.

[0060] The weighted cross entropy loss function L(θ) can be expressed as:

[0061] Where N is the number of sample data features, For the The training weights of the sample data features, is the total number of categories in the classification task, such as normal and intrusion; For category index, traverse all classes; Indicates the The sample data features belong to the true label of category c. If the sample For invasion, =1, the rest of the categories are 0, if the sample If it is normal, =1, and the rest of the categories are 0; For the model parameters When the sample The predicted probability of belonging to class c.

[0062] The model parameters are updated according to the gradient descent formula, and the difference between the updated parameters and the original parameters is used as the parameter update amount, thereby obtaining the parameter update amount of the current parameters of the global model.

[0063] During the training process, the feature weights in the risk assessment function are continuously adjusted to enable the model to better distinguish between normal behavior and potential intrusion behavior.

[0064] In step 140, the parameter update amount is sent to the central server so that the central server aggregates the parameter update amount, and iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained. The trained global model is determined as the industrial Internet intrusion detection model.

[0065] Specifically, each client sends the parameter update amount to the central server. The central server receives the parameter update information sent by each client and aggregates the parameter updates of each client using aggregation strategies such as the federated averaging algorithm. For example, it aggregates the parameter updates of each client using weighted averaging. Based on the aggregation results, the current parameters of the global model are iteratively updated to obtain the current parameters after iterative update. Assuming there are K clients in total, the model parameter update amount uploaded by the kth client is , the local data volume is , the total amount of data is:

[0066] Then the global model parameter update amount after aggregation is:

[0067] The updated global model is evaluated using a validation dataset or other evaluation methods to check whether performance metrics such as accuracy, recall, and F1 score meet requirements and whether they have improved compared to the previous model. If the global model passes the evaluation, the server distributes the updated global model's current parameters to each client for the next round of local training. If it does not meet requirements, the aggregation strategy or other parameters can be adjusted, and aggregation and evaluation can be repeated. The final trained global model becomes the Industrial Internet intrusion detection model, used for intrusion detection of Industrial Internet data.

[0068] In this embodiment, local training guided by immune risk theory enables the client model to better adapt to intrusion characteristics in local data. The uploaded parameter updates contain information learned about local intrusion situations. The central server aggregates these parameter updates, continuously optimizing the global model and improving its ability to detect intrusions in different regions, thus realizing the global application of immune risk theory within a federated learning architecture.

[0069] It should be noted that as the global model is continuously trained and optimized, its ability to identify intrusion behaviors gradually increases. This feedback is fed back into the risk assessment function, potentially prompting a reassessment of the weights of risk signal features or the discovery of new risk signal features, thereby further improving the risk assessment function and the performance of the entire intrusion detection system.

[0070] Based on any of the above embodiments, Figure 2 This is one of the flow charts of the industrial Internet intrusion detection method provided by the present invention. Figure 3 This is the second flow chart of the industrial Internet intrusion detection method provided by the present invention, such as Figure 2 and Figure 3 As shown, the method includes the following steps: Step 210: Obtain the characteristics of the data to be detected on the Industrial Internet; Step 220: Input the features of the data to be detected into the trained Industrial Internet intrusion detection model to obtain a risk score output by the Industrial Internet intrusion detection model, compare the risk score with a preset risk threshold, and determine whether to trigger an alarm based on the comparison result; Among them, the industrial Internet intrusion detection model is constructed based on the above-mentioned industrial Internet intrusion detection model construction method.

[0071] Specifically, the industrial internet intrusion detection model constructed based on the above method can be used for intrusion detection. The data features to be detected can be collected in real time, and the real-time collected industrial internet data can be preprocessed to obtain the data features to be detected.

[0072] The features of the data to be detected are input into the trained industrial Internet intrusion detection model for analysis, the danger signals and the weights of the danger signals are identified, and the danger score output by the industrial Internet intrusion detection model is obtained based on the danger assessment function.

[0073] The system then compares the risk score with the pre-set risk threshold and performs intrusion detection based on the comparison result. If the risk score exceeds the threshold, an intrusion is confirmed; otherwise, no intrusion is confirmed. Once a possible intrusion is detected, the system immediately triggers an alarm and notifies the relevant security personnel. Simultaneously, according to pre-set policies, appropriate response measures are taken, such as disconnecting the network, restricting access rights, and isolating the infected device, to prevent the further spread of the intrusion.

[0074] During the detection process, continuously monitor the operating status and data changes of the Industrial Internet, collect new data regularly or irregularly, and repeat the above steps to update and optimize the model to adapt to the ever-changing network environment and intrusion methods.

[0075] In some embodiments, the risk threshold is determined based on the following steps: identifying multiple candidate hazard thresholds; Each candidate danger threshold is tested on the validation set to obtain the false positive rate and false negative rate of the industrial Internet intrusion detection model under each candidate danger threshold; The ROC curve is drawn based on the false alarm rate and missed alarm rate of the industrial Internet intrusion detection model under each candidate danger threshold, and the danger threshold is determined from multiple candidate danger thresholds based on the ROC curve.

[0076] Specifically, multiple candidate danger thresholds can be pre-set, for example, from 0.1 to 1.0, with a step size of 0.05. These different danger thresholds are set sequentially as candidate danger thresholds. Each candidate danger threshold is tested on a validation set, and the model's false positive and false negative rates are statistically analyzed to obtain the false positive and false negative rates of the Industrial Internet intrusion detection model at each candidate danger threshold. For example, when the threshold is set to 0.5, the model misclassifies some normal device debugging activities as intrusions, resulting in a high false positive rate. On the other hand, when the threshold is set to 0.8, some minor intrusion signs are not detected, resulting in an increased false negative rate.

[0077] Next, plot the test results for different candidate danger thresholds on the ROC curve, with the false positive rate as the vertical axis and the false positive rate as the horizontal axis. The threshold corresponding to the point on the curve closest to the upper left corner is selected as the danger threshold. Reference industry experience and make adjustments based on the security requirements of the system. For example, it was observed that when the threshold is 0.65, the ROC curve is closest to the upper left corner. At this point, the sum of the false positive rate and the false negative rate is relatively small, which can minimize unnecessary alerts while ensuring detection accuracy.

[0078] At the same time, empirical methods were used as a reference. Factories of similar scale and production models in the same industry typically set the danger threshold between 0.6 and 0.7 when using similar intrusion detection methods. Considering stringent security requirements and preliminary experimental results, the final danger threshold was determined to be 0.65. In subsequent practical applications, the model was evaluated using test data. The results showed that at this threshold, the model was able to effectively detect actual intrusions while maintaining a low false alarm rate, meeting the factory's security requirements.

[0079] In intrusion detection scenarios, false positive rate and false negative rate are important indicators for measuring model performance. The false positive rate is calculated as follows:

[0080] The False Positive Rate (FPR) refers to the proportion of normal samples that the model mistakenly identifies as abnormal (intrusion) samples. FP (False Positive) represents the number of false positives, which is the number of samples that are actually normal but are identified as intrusions by the model. TN (True Negative) represents the number of true negatives, which is the number of samples that are actually normal but are correctly identified as normal by the model.

[0081] The False Negative Rate (FNR) refers to the proportion of abnormal (intrusion) samples that the model mistakenly identifies as normal samples. The calculation formula is:

[0082] Among them, FN (False Negative) represents the number of missed reports, that is, the number of samples that are actually intrusion behaviors but are judged as normal behaviors by the model; TP (True Positive) represents the number of true positive reports, that is, the number of samples that are actually intrusion behaviors and are correctly judged as intrusion behaviors by the model.

[0083] The industrial internet intrusion detection method provided by the present invention combines immune risk theory with federated learning to build a detection model. This method accurately identifies intrusion behaviors, reduces false positives and false negatives, enhances detection of new attacks, and improves system adaptability. Federated learning uses local training and encrypted transmission to protect data privacy for all parties, meeting the security and compliance requirements of industrial enterprises. Distributed parallel training improves efficiency and reduces training time; compressed and encrypted transmission reduces communication costs and alleviates network burden. Decentralization reduces the risk of single points of failure and provides high stability. It also facilitates expansion with new devices, allowing participants to flexibly update local models.

[0084] The industrial Internet intrusion detection model construction device provided by the present invention is described below. The industrial Internet intrusion detection model construction device described below and the industrial Internet intrusion detection model construction method described above can be referenced to each other.

[0085] Based on any of the above embodiments, Figure 4 This is a schematic diagram of the structure of the industrial Internet intrusion detection model building device provided by the present invention. Figure 4 As shown, the device includes: The sample data acquisition unit 410 is used to obtain the characteristics of the industrial Internet sample data stored locally; a risk assessment unit 420 configured to perform a risk assessment on the sample data feature based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; A model training unit 430 is configured to train a local model based on the risk assessment score of the sample data feature to obtain parameter update amounts of current parameters of the global model; The model determination unit 440 is used to send the parameter update amount to the central server so that the central server aggregates the parameter update amount, iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained, and determines the trained global model as the industrial Internet intrusion detection model.

[0086] The device provided by the embodiment of the present invention, by combining immune risk theory and federated learning, can provide an industrial Internet intrusion detection model that can both protect data privacy and efficiently detect intrusions to meet the special needs of the industrial Internet.

[0087] Based on the above embodiment, the device further includes a function construction unit, which is used to: Based on the operational characteristics of the Industrial Internet, identify danger signals and extract danger signal features; Determine the feature weight of each danger signal feature based on the relative importance between each two danger signal features; The risk assessment function is constructed based on the feature weights of the risk signal features.

[0088] Based on the above embodiment, the function construction unit is used to: The risk assessment function is constructed based on the following formula:

[0089] Where, To score the risk assessment, For the The feature weight of each danger signal feature, For the Danger signal characteristics, is the number of red flag features.

[0090] Based on the above embodiment, the model training unit is specifically used to: Determining a training weight for the sample data feature based on the risk assessment score of the sample data feature; Determining a weighted cross entropy loss function based on the training weights of the sample data features; The local model is trained based on the weighted cross entropy loss function.

[0091] Based on the above embodiment, the sample data acquisition unit is specifically configured to: Acquire raw sample data and extract raw data features, wherein the raw sample data includes at least one of network traffic data, system log data, and device status data; The original data features are normalized to obtain the sample data features.

[0092] Based on the above embodiments, Figure 5 This is a schematic diagram of the structure of the industrial Internet intrusion detection device provided by the present invention. Figure 5 As shown, the device includes: The data acquisition unit 510 is used to acquire the characteristics of the data to be detected in the industrial Internet; An intrusion detection unit 520 is configured to input the features of the data to be detected into a trained industrial Internet intrusion detection model to perform intrusion detection, obtain a risk score output by the industrial Internet intrusion detection model, compare the risk score with a preset risk threshold, and perform intrusion detection based on the comparison result; Among them, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0093] Based on the above embodiment, the device further includes a threshold determination unit, configured to: identifying multiple candidate hazard thresholds; Each candidate danger threshold is tested on a validation set to obtain a false positive rate and a false negative rate of the industrial Internet intrusion detection model under each candidate danger threshold; A ROC curve is drawn based on the false alarm rate and the missed alarm rate of the industrial Internet intrusion detection model under each candidate danger threshold, and the danger threshold is determined from the multiple candidate danger thresholds based on the ROC curve.

[0094] Figure 6 An example of a physical structure diagram of an electronic device is shown below. Figure 6As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communications bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communications bus 640. The processor 610 may call logic instructions in the memory 630 to execute a method for constructing an industrial Internet intrusion detection model. The method includes: obtaining locally stored industrial Internet sample data features; performing a risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; training a local model based on the risk assessment score of the sample data features to obtain parameter updates for current parameters of a global model; sending the parameter updates to a central server so that the central server aggregates the parameter updates, and iteratively updating the current parameters of the global model based on the aggregated results until the global model is trained, and determining the trained global model as the industrial Internet intrusion detection model. Or execute an industrial Internet intrusion detection method, which includes: obtaining features of industrial Internet data to be detected; inputting the features of the data to be detected into a trained industrial Internet intrusion detection model, obtaining a risk score output by the industrial Internet intrusion detection model, comparing the risk score with a preset risk threshold, and performing intrusion detection based on the comparison result; wherein, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0095] Furthermore, the logic instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0096] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the industrial Internet intrusion detection model construction method provided by the above methods, which includes: obtaining locally stored industrial Internet sample data features; performing a risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, and the risk assessment function is constructed based on the relative importance of each risk signal; training a local model based on the risk assessment score of the sample data features to obtain a parameter update amount of the current parameter of the global model; sending the parameter update amount to a central server so that the central server aggregates the parameter update amount, and iteratively updates the current parameters of the global model based on the aggregation result until the global model completes training, and determines the trained global model as the industrial Internet intrusion detection model. Or execute an industrial Internet intrusion detection method, which includes: obtaining features of industrial Internet data to be detected; inputting the features of the data to be detected into a trained industrial Internet intrusion detection model, obtaining a risk score output by the industrial Internet intrusion detection model, comparing the risk score with a preset risk threshold, and performing intrusion detection based on the comparison result; wherein, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0097] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the industrial Internet intrusion detection model construction method provided by the above-mentioned methods, the method comprising: obtaining locally stored industrial Internet sample data features; performing a risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; training a local model based on the risk assessment score of the sample data features to obtain a parameter update amount of the current parameter of the global model; sending the parameter update amount to a central server so that the central server aggregates the parameter update amount, and iteratively updates the current parameters of the global model based on the aggregation result until the global model completes training, and determines the trained global model as the industrial Internet intrusion detection model. Or execute an industrial Internet intrusion detection method, which includes: obtaining features of industrial Internet data to be detected; inputting the features of the data to be detected into a trained industrial Internet intrusion detection model, obtaining a risk score output by the industrial Internet intrusion detection model, comparing the risk score with a preset risk threshold, and performing intrusion detection based on the comparison result; wherein, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method.

[0098] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0099] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for constructing an industrial Internet intrusion detection model, applied to all participants in federated learning, characterized in that: include: Obtain the characteristics of the locally stored industrial Internet sample data; Performing a risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; Training a local model based on the risk assessment score of the sample data feature to obtain parameter updates of current parameters of the global model; The parameter update amount is sent to the central server so that the central server aggregates the parameter update amount, and iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained, and the trained global model is determined as the industrial Internet intrusion detection model.

2. The method for constructing an industrial Internet intrusion detection model according to claim 1, characterized in that: The risk assessment function is constructed based on the following steps: Based on the operational characteristics of the Industrial Internet, identify danger signals and extract danger signal features; Determine the feature weight of each danger signal feature based on the relative importance between each two danger signal features; The risk assessment function is constructed based on the feature weights of the risk signal features.

3. The method for constructing an industrial Internet intrusion detection model according to claim 2, characterized in that: The constructing of the risk assessment function based on the feature weights of the respective risk signal features includes: The risk assessment function is constructed based on the following formula: Where, To score the risk assessment, For the The feature weight of each danger signal feature, For the Danger signal characteristics, is the number of red flag features.

4. The method for constructing an industrial Internet intrusion detection model according to claim 1, wherein: The risk assessment score training of the local model based on the sample data features includes: Determining a training weight for the sample data feature based on the risk assessment score of the sample data feature; Determining a weighted cross entropy loss function based on the training weights of the sample data features; The local model is trained based on the weighted cross entropy loss function.

5. The method for constructing an industrial Internet intrusion detection model according to any one of claims 1 to 4, characterized in that: The method of obtaining the locally stored industrial Internet sample data features includes: Acquire raw sample data and extract raw data features, wherein the raw sample data includes at least one of network traffic data, system log data, and device status data; The original data features are normalized to obtain the sample data features.

6. An industrial Internet intrusion detection method, characterized in that: include: Obtain the characteristics of the data to be tested in the Industrial Internet; Inputting the features of the data to be detected into a trained industrial Internet intrusion detection model to obtain a risk score output by the industrial Internet intrusion detection model, comparing the risk score with a preset risk threshold, and performing intrusion detection based on the comparison result; Among them, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method described in any one of claims 1 to 5.

7. The industrial Internet intrusion detection method according to claim 6, characterized in that: The risk threshold is determined based on the following steps: identifying multiple candidate hazard thresholds; Each candidate danger threshold is tested on a validation set to obtain a false positive rate and a false negative rate of the industrial Internet intrusion detection model under each candidate danger threshold; A ROC curve is drawn based on the false alarm rate and the missed alarm rate of the industrial Internet intrusion detection model under each candidate danger threshold, and the danger threshold is determined from the multiple candidate danger thresholds based on the ROC curve.

8. An industrial Internet intrusion detection model construction device, applied to all participants in federated learning, characterized in that: include: A sample data acquisition unit, used to acquire the characteristics of the industrial Internet sample data stored locally; a risk assessment unit, configured to perform risk assessment on the sample data features based on a risk assessment function to obtain a risk assessment score, wherein the risk assessment function is constructed based on the relative importance of each risk signal; A model training unit, configured to train a local model based on the risk assessment score of the sample data feature to obtain parameter update amounts of current parameters of the global model; A model determination unit is used to send the parameter update amount to a central server so that the central server aggregates the parameter update amount, iteratively updates the current parameters of the global model based on the aggregation result until the global model is trained, and determines the trained global model as the industrial Internet intrusion detection model.

9. An industrial Internet intrusion detection device, characterized in that: include: A unit for acquiring data to be tested, used to obtain characteristics of data to be tested on the industrial Internet; an intrusion detection unit, configured to input the features of the data to be detected into a trained industrial Internet intrusion detection model to perform intrusion detection, obtain a risk score output by the industrial Internet intrusion detection model, compare the risk score with a preset risk threshold, and perform intrusion detection based on the comparison result; Among them, the industrial Internet intrusion detection model is constructed based on the industrial Internet intrusion detection model construction method described in any one of claims 1 to 5.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, it implements the industrial Internet intrusion detection model construction method as described in any one of claims 1 to 5, or the industrial Internet intrusion detection method as described in any one of claims 6 to 7.

Images