Network security defense method and device of automatic fire alarm system

Abstract

This invention discloses a network security defense method and apparatus for an automatic fire alarm system. The method includes acquiring the exposed interfaces, main lines, and redundant lines of the automatic fire alarm system; obtaining secondary network domains based on the network topology of the main lines; performing time-series encryption based on the secondary network domains and associated secondary network domains to obtain the defense consumption of the main lines; obtaining secure lines and hidden redundant lines by simulating the failure path after masking the command object based on current contact information; obtaining a predicted damage model from associated secondary network domains based on the secure lines; continuously monitoring interaction records using the hidden redundant lines; and outputting a defense scheme for the secure lines based on the interaction records and the predicted damage model using LSTM anomaly detection. This method reduces the resource consumption of network security defense and improves the real-time performance of the defense by utilizing attack diffusion coefficients, dynamic partitioned defense, redundant line optimization, and real-time anomaly monitoring.

Description

Technical Field

[0001] This invention relates to the field of security defense, and in particular to a network security defense method and device for an automatic fire alarm system. Background Technology

[0002] As a core infrastructure for building fire safety, automatic fire alarm systems undertake the key functions of early fire monitoring, real-time alarm, and linkage control of fire-fighting equipment. Their stable operation is directly related to the safety of people's lives and property. With the popularization of digital and network technologies, modern automatic fire alarm systems have been upgraded from traditional stand-alone architectures to multi-node interconnected intelligent network systems, which have greatly improved the real-time performance of fire monitoring and the efficiency of fire response. Therefore, building a precise and dynamic network security defense system for automatic fire alarm systems has become an urgent need to ensure fire safety.

[0003] Existing cybersecurity protection technologies for automatic fire alarm systems lack quantitative risk assessment mechanisms, relying heavily on static topology analysis or single vulnerability scans. This fails to accurately depict the attack propagation path and scope of impact, leading to an imbalance in defense resource allocation and isolated defense strategies. Furthermore, the lack of layered and zoned protection tailored to fire service characteristics makes over-defense or blind spots likely. These deficiencies directly impact the reliability of automatic fire alarm systems in cyberattack environments. Therefore, quantifying attack propagation risks, implementing dynamic zoned defense, intelligent optimization of redundant lines, and real-time anomaly monitoring are urgent issues to be addressed. Summary of the Invention

[0004] The purpose of this invention is to provide a network security defense method and device for an automatic fire alarm system.

[0005] To achieve the above objectives, the present invention is implemented according to the following technical solution:

[0006] The first aspect of this invention provides a network security defense method for an automatic fire alarm system, comprising:

[0007] Obtain the exposed interfaces, main lines, and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, use the centralized controller as the root node, the area controller as the intermediate node, and the detection and linkage devices as leaf nodes. Obtain a hierarchical tree-like network topology based on the root node, intermediate nodes, and leaf nodes.

[0008] Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface.

[0009] The contact area is obtained through a time-series decay window based on the attack diffusion coefficient and the network node exposure time. The secondary network domain is obtained through graph neural network clustering based on the contact area and the node traffic limit.

[0010] Based on the historical contact information and preset fire protection weights of the secondary network domains, the associated secondary network domains are obtained. The secondary network domains and associated secondary network domains are then encrypted in a time sequence according to the current contact information to obtain the main line defense consumption.

[0011] Based on the target node of the instruction and the main line defense consumption of the current contact information, the redundant line is simulated for failure and overload through discrete event simulation. The failure path after the instruction object is masked is obtained to obtain the safe line and the hidden redundant line.

[0012] Based on the security line, a predicted damage model is obtained from the associated secondary network domain. The interaction records are continuously monitored using a hidden redundant line. Based on the interaction records and the predicted damage model, a defense scheme for the security line is output through LSTM anomaly detection.

[0013] Furthermore, the method for obtaining the secondary domain includes:

[0014] Based on the attack diffusion coefficient, network node exposure time, real-time communication frequency, and node traffic limit of network nodes, the network node exposure time within 3 days is taken as the short-term exposure time, and the exposure time exceeding 3 days is taken as the long-term exposure time. The short-term exposure time is multiplied by an exponential decay of 10%, and the long-term exposure time is multiplied by an exponential decay of 1%. The sum of the exponential decay results is multiplied by the attack diffusion coefficient to obtain the contact area.

[0015] Traffic saturation is obtained by comparing the ratio of communication frequency to real-time communication frequency within the node's traffic limit. The traffic saturation and contact area are concatenated to form a node feature vector. The adjacency matrix of the nodes is obtained based on the network topology. The node feature vectors and adjacency matrices are then used to train a graph neural network using a clustering loss function until the maximum number of iterations is reached, yielding the node network feature vector. The expression for the clustering loss function is:

[0016]

[0017] in The basic clustering loss for graph neural networks, For the first A set of nodes in each secondary domain. This represents the total number of secondary domains. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient, For nodes Contact area The maximum contact area of ​​the network. For nodes and Real-time communication frequency, The maximum communication frequency of the network. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient;

[0018] Using the node type of the network topology as the minimum sample size and the contact area as the neighborhood radius, DBSCAN clustering is performed on the node network feature vectors based on the minimum sample size and neighborhood radius to obtain the secondary network.

[0019] Furthermore, the method for obtaining the associated secondary domain includes:

[0020] Based on historical contact information of secondary domains, the number of communications and attacks per hour between each domain is statistically analyzed. The attack co-occurrence rate is obtained by dividing the number of common attacks by the number of independent attacks. Based on historical contact information, the proportion of non-critical command traffic in contact commands is obtained through preset fire protection weights. Domains with an attack co-occurrence rate greater than or equal to 0.5 and a non-critical command traffic proportion of less than 50% are designated as initial associated domains. The initial associated domains of contact commands within a short exposure period are classified as associated secondary domains.

[0021] Furthermore, the method for obtaining the main line defense consumption includes:

[0022] Based on the current contact information, extract the timestamp and command length of the interaction command. Based on the secondary network domains traversed by the interaction command and the associated secondary network domains, obtain the attack diffusion coefficient and attack co-occurrence. Use the timestamp, command length, maximum attack diffusion coefficient, and attack co-occurrence as encryption parameters. Use the encryption parameters to hash and encrypt the interaction command, and append the timestamp of the most recent attack suffered by the secondary network domain.

[0023] The main line defense consumption is obtained based on the encryption parameters, instruction length, and real-time communication frequency of the secondary network and associated secondary network. The defense consumption formula is as follows:

[0024]

[0025] in Mainly for defensive consumption, For secondary domains The highest attack diffusion coefficient within, The average contact area, For attack co-occurrence, The timestamp of the current interaction command. For secondary domains The timestamp of the most recent attack For secondary domains and associated secondary domains Real-time communication frequency, This is the length of the interactive command. This is a critical instruction indicator function. If the interactive instruction is a critical instruction, the value is 1; otherwise, it is 0.

[0026] Furthermore, the method for obtaining the secure line and the hidden redundant line includes:

[0027] A directed graph of redundant lines is constructed based on network topology nodes and redundant line nodes. The destination node, source node, and secondary network domains traversed by the instruction are extracted based on the current contact information. The simulation time step and trigger frequency are determined according to the fire instruction response requirements. Based on the simulation time step, trigger frequency, and directed graph, the redundant lines are triggered to fail through discrete event simulation. The average alarm rate of the secondary network domains in the past month is used as the trigger probability. When a failure is triggered, the redundant lines between the secondary network domains and the associated secondary network domains are cut off. If the attack co-occurrence of the associated secondary network domains is greater than 0.7, the trigger probability is increased by 3 times. The remaining bandwidth of the network nodes is counted in real time. If the remaining bandwidth is less than 20%, it is determined to be an overload failure. The failure path and the overload path are obtained.

[0028] Based on the failed paths, overloaded paths, and directed graph, a greedy algorithm is used to search for paths that are neither failed nor overloaded. The path with the fewest hops and the most remaining bandwidth among the remaining paths is designated as a safe path. The average fault interval time is calculated based on the safe path, and the path among the remaining paths that does not overlap with the safe path on the logical line is designated as a hidden redundant path.

[0029] Furthermore, the method for obtaining the predicted damage model includes:

[0030] Based on the secure line, the contact area and attack co-occurrence are obtained from the associated secondary network domains. The historical maximum damage value of the secondary network domain is obtained based on the historical contact information. The damage product of the contact area and the historical maximum damage value is calculated. The damage product is divided by the average fault interval of the secure line to obtain the damage of a single network domain.

[0031] The geometric mean of damage is calculated based on the historical maximum damage values ​​of the secondary network domain and associated secondary network domains. The collaborative damage of associated network domains is obtained by multiplying the attack co-occurrence rate by the geometric mean of damage. The expected damage value of the secure line is calculated by weighted summation model based on the single network domain damage and the collaborative damage of associated network domains, thus obtaining the expected damage value and the expected damage model.

[0032] Furthermore, the method for obtaining the defense scheme includes:

[0033] Based on continuous monitoring of interaction records of hidden redundant lines, the critical command level and main line defense consumption are obtained through the expected damage model according to the interaction records. The comprehensive defense cost factor is then calculated based on the critical command level and main line defense consumption. The formula for the comprehensive defense cost factor is as follows:

[0034]

[0035]

[0036] in To take into account the overall defense cost factor, For the integral manifold of the network topology, The volume element in the topological space is obtained by summing the values ​​of nodes and links in a discrete scenario. This represents the rate of change of the expected damage value difference between adjacent secondary network domains. For Li Qun The harmonious group on the top, For a Lie group constructed through domain association and line connection modes, To associate secondary domains boundary, The loop integral of the attack co-occurrence degree, The disturbance factor is the average alarm rate of the secondary network domain over the past month. For node traffic fluctuations, This is a resource weighting coefficient, obtained based on the preset fire safety weights corresponding to the key instruction levels. For the domain's encrypted load balancing, 80% of the CPU limit;

[0037] The node traffic fluctuation, encryption error rate, and instruction retransmission count are obtained from the interaction records. The node traffic fluctuation, encryption error rate, and instruction retransmission count are concatenated into the LSTM input feature vector. The normalized comprehensive defense cost factor is used as the fourth dimension of the LSTM input feature. The LSTM model is trained based on the attack and normal instruction samples marked in the historical contact information. The LSTM input feature vector is input into the trained LSTM model to obtain the anomaly score.

[0038] If the anomaly score is less than 0.3 and the comprehensive defense cost factor is less than 1, the current secure line is maintained and the log is recorded. If the anomaly score is greater than or equal to 0.3 and less than 0.7, and the comprehensive defense cost factor is greater than or equal to 1 and less than 3, the sampling rate of the hidden redundant line is increased to 100%, and the firewall interception level of the associated secondary network domain is increased. If the anomaly score is greater than or equal to 0.7 and the comprehensive defense cost factor is greater than or equal to 3, the product of the comprehensive defense cost factor and the maximum instruction level in the interaction record is used as the blocking time. The anomaly source is blocked according to the blocking time, and the communication line is switched to the hidden redundant line.

[0039] A second aspect of the present invention provides a network security defense device for an automatic fire alarm system, comprising:

[0040] Attack diffusion coefficient acquisition module: used to acquire the exposed interfaces, main lines and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, the centralized controller is used as the root node, the area controller is used as the intermediate node, and the detection and linkage devices are used as leaf nodes. A hierarchical tree-like network topology is obtained according to the root node, intermediate node and leaf node.

[0041] Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface.

[0042] Secondary domain acquisition module: used to obtain the contact area through a time-series decay window based on the attack diffusion coefficient and network node exposure time, and to obtain the secondary domain through graph neural network clustering based on the contact area and node traffic limit;

[0043] Defense Consumption Acquisition Module: Used to obtain associated secondary network domains based on the historical contact information and preset fire protection weights of secondary network domains, and to perform time-series encryption on the secondary network domains and associated secondary network domains according to the current contact information to obtain the defense consumption of the main line;

[0044] Defense line division module: It is used to simulate the failure and overload of the redundant lines through discrete event simulation based on the instruction destination node and main line defense consumption of the current contact information, and to obtain the safe lines and hidden redundant lines after the instruction object is masked.

[0045] Defense scheme acquisition module: used to obtain the expected damage model from the associated secondary network domain based on the security line, continuously monitor the interaction records using hidden redundant lines, and output the defense scheme of the security line based on the interaction records and the expected damage model through LSTM anomaly detection.

[0046] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0047] This invention provides data support for the allocation of defense resources by fusing attack diffusion coefficients with exposed interface characteristics, node importance weights, and connection strength coefficients. It uses graph neural network clustering to generate secondary network domains and combines fire protection weights to identify associated domains and implement time-series encryption, thereby improving the interception capability of cross-domain attacks. Through discrete event simulation, it filters out safe and hidden redundant lines from redundant lines, ensuring the continuity and stability of the core communication link under attack. By continuously monitoring the interactive behavior in the interactive alarm system through LSTM anomaly detection, it balances defense costs and system performance while ensuring the stable operation of the core functions of the automatic fire alarm system, thus improving the reliability and security of the system in a network attack environment. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the steps of a network security defense method for an automatic fire alarm system according to an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0050] Reference Figure 1 As shown, the present invention provides a network security defense method for an automatic fire alarm system, comprising:

[0051] Obtain the exposed interfaces, main lines, and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, use the centralized controller as the root node, the area controller as the intermediate node, and the detection and linkage devices as leaf nodes. Obtain a hierarchical tree-like network topology based on the root node, intermediate nodes, and leaf nodes.

[0052] Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface.

[0053] In the actual assessment, for the automatic fire alarm system deployed by a certain organization, the central controller, area controllers, and detectors and moving devices in the area of ​​its main line were obtained. There is 1 root node, 3 intermediate nodes, and 30 leaf nodes. The exposed interface A is connected to the central controller and serves as a management interface for connecting to the cloud platform for maintenance. The exposure time is 24 hours and the historical attack rate is 0.1 times per day. Interface B is connected to the controller in area R1 and serves as a debugging interface for connecting to the engineer terminal. The exposure time is 12 hours and the historical attack rate is 0.05 times per day. The redundant line is a fiber optic backup link physically isolated from the main line. Based on the associated nodes of the exposed interface B, the product of 10 vertically connectable nodes and 2 horizontally connectable nodes is obtained. The normalized ratio of the product to 5 actual communication nodes is 4, which is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type, where the time weight is 0.5. The attack diffusion coefficient of 4 is obtained by multiplying the node level depth of the exposed interface B (2), the topology connectivity (4), and the interface risk factor (0.5).

[0054] The contact area is obtained through a time-series decay window based on the attack diffusion coefficient and the network node exposure time. The secondary network domain is obtained through graph neural network clustering based on the contact area and the node traffic limit.

[0055] In the actual assessment, based on the attack diffusion coefficient of the exposed interface and the exposure time of the network node, the short-term exposure was obtained. For example, the detector in region R1 was exposed for a cumulative 5 hours, resulting in an attenuation of 0.5. Conversely, long-term exposure was 3 hours, resulting in an attenuation of 0.03. The resulting contact area was... Traffic saturation is obtained by comparing the ratio of communication frequency to real-time communication frequency within the node's traffic limit. The traffic saturation and contact area are concatenated to form a node feature vector. The adjacency matrix of the nodes is obtained based on the network topology. A two-layer GCN is trained using the node feature vector and adjacency matrix through a clustering loss function. The hidden layer dimension is 64, activated by ReLU, with a learning rate of 0.001 and a batch size of 32. Training is completed after 200 iterations, yielding the node's network domain feature vector. This is based on the minimum sample size of 3 and the neighborhood radius. DBSCAN clustering was performed on the node network feature vectors to obtain three secondary network domains R1, R2, and R3.

[0056] Based on the historical contact information and preset fire protection weights of the secondary network domains, the associated secondary network domains are obtained. The secondary network domains and associated secondary network domains are then encrypted in a time sequence according to the current contact information to obtain the main line defense consumption.

[0057] In the actual assessment, based on the historical contact information of secondary network domains, the number of hourly communications and attacks between each network domain were statistically analyzed. R1 and R3 were attacked a total of 4 times historically, and R1 was attacked 5 times and R3 3 times independently, resulting in an attack co-occurrence rate of 1.03. Non-critical instructions accounted for 40% of the communication between R1 and R3, less than 50%, and the contact instructions occurred within the past day. Therefore, R1 and R3 are associated secondary network domains. Based on the current contact information, the timestamp and instruction length (100) of the interaction instructions were extracted. The attack diffusion coefficient (4) and attack co-occurrence rate (1.03) were obtained based on the secondary network domains traversed by the interaction instructions and the associated secondary network domains. The timestamp, instruction length, maximum attack diffusion coefficient, and attack co-occurrence rate were used as encryption parameters. The interaction instructions were hashed using these parameters, and the timestamp of the most recent attack on the secondary network domain was appended. Based on the encryption parameters, instruction length, and the real-time communication frequency (50) of the secondary network domains and associated secondary network domains, the main line defense consumption (1.08) was obtained using the defense consumption formula. ;

[0058] Based on the target node of the instruction and the main line defense consumption of the current contact information, the redundant line is simulated for failure and overload through discrete event simulation. The failure path after the instruction object is masked is obtained to obtain the safe line and the hidden redundant line.

[0059] In the actual assessment, a directed graph of redundant lines is constructed based on network topology nodes and redundant line nodes. The destination node, source node, and secondary network domains of the command are extracted based on the current contact information. The simulation time step is determined to be 1 second and the basic trigger frequency is 0.1 based on the fire command response requirements. Based on the simulation time step, trigger frequency, and directed graph, the redundant lines R1 and R3 are triggered to fail through discrete event simulation. The redundant line between R1 and R3 is cut off. Since the attack co-occurrence of 1.03 is greater than 0.7, the trigger probability is increased by 3 times to 0.3. The remaining bandwidth of the network nodes is counted in real time. When the bandwidth of the redundant line is 100Mbps and the real-time traffic is 90Mbps, the remaining bandwidth is less than 20%, which is judged as overload failure.

[0060] Based on the failed path, overloaded path and directed graph, a greedy algorithm is used to search for non-failed or non-overloaded paths to obtain path 1 from R1 to R2 and path 2 from R1 to R3. Path 1 has the minimum number of hops of 2 and a remaining bandwidth of 50Mbps, and is used as a safe line. The average fault interval of the safe line is 100h. Path 2, which does not overlap with path 1, is used as a hidden redundant line.

[0061] Based on the security line, a predicted damage model is obtained from the associated secondary network domain. The interaction records are continuously monitored using a hidden redundant line. Based on the interaction records and the predicted damage model, a defense scheme for the security line is output through LSTM anomaly detection.

[0062] In the actual assessment, the single-domain damage obtained based on path 1 was 2.12. The collaborative damage of the associated domains was calculated based on the historical maximum damage values ​​of the secondary domains and related secondary domains. The predicted damage value of the secure line is calculated using a weighted summation model based on single-domain damage and associated domain collaborative damage. The weight for single-domain damage is 0.6, and the weight for associated domain collaborative damage is 0.4. The predicted damage value is 37.49, and the predicted damage model is obtained. The normalized predicted damage value is 0.375.

[0063] Based on continuous monitoring of interaction records using hidden redundant lines, the critical command level and main line defense consumption are obtained through a predicted damage model. The comprehensive defense cost factor is calculated to be 3.787 based on the critical command level and main line defense consumption, where the predicted damage value of R1 is 37.49 and R2 is 35. The normalized rate of change of the difference is 0.6. The encryption load difference of the network domain is 0.8, and that of the Hele group is also 0.8, obtained from the non-overlapping degree of path 1 and path 2. The preset fire protection weight for the critical command level is 1.2. The node traffic fluctuation of 10Mbps, encryption error rate of 5%, and command retransmission count of 2 in the interaction records are concatenated to form an LS value. The LSTM input feature vector is normalized, and the normalized comprehensive defense cost factor is used as the fourth dimension of the LSTM input feature. The LSTM model is trained based on the attack and normal command samples marked in the historical contact information. The LSTM input feature vector is input into the trained LSTM model, and an anomaly score of 0.82 is obtained. Since the anomaly score is greater than or equal to 0.7 and the comprehensive defense cost factor is greater than or equal to 3, the product of the comprehensive defense cost factor 3.787 and the maximum command level 2 in the interaction record, 7.57, is used as the blocking time. The anomaly source is blocked for 7.57 minutes according to the blocking time, and the communication line is switched to the hidden redundant line path 2.

[0064] In this embodiment, the method for obtaining the secondary domain includes:

[0065] Based on the attack diffusion coefficient, network node exposure time, real-time communication frequency, and node traffic limit of network nodes, the network node exposure time within 3 days is taken as the short-term exposure time, and the exposure time exceeding 3 days is taken as the long-term exposure time. The short-term exposure time is multiplied by an exponential decay of 10%, and the long-term exposure time is multiplied by an exponential decay of 1%. The sum of the exponential decay results is multiplied by the attack diffusion coefficient to obtain the contact area.

[0066] Traffic saturation is obtained by comparing the ratio of communication frequency to real-time communication frequency within the node's traffic limit. The traffic saturation and contact area are concatenated to form a node feature vector. The adjacency matrix of the nodes is obtained based on the network topology. The node feature vectors and adjacency matrices are then used to train a graph neural network using a clustering loss function until the maximum number of iterations is reached, yielding the node network feature vector. The expression for the clustering loss function is:

[0067]

[0068] in The basic clustering loss for graph neural networks, For the first A set of nodes in each secondary domain. This represents the total number of secondary domains. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient, For nodes Contact area The maximum contact area of ​​the network. For nodes and Real-time communication frequency, The maximum communication frequency of the network. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient;

[0069] Using the node type of the network topology as the minimum sample size and the contact area as the neighborhood radius, DBSCAN clustering is performed on the node network feature vectors based on the minimum sample size and neighborhood radius to obtain the secondary network.

[0070] In this embodiment, the method for obtaining the associated secondary domain includes:

[0071] Based on historical contact information of secondary domains, the number of communications and attacks per hour between each domain is statistically analyzed. The attack co-occurrence rate is obtained by dividing the number of common attacks by the number of independent attacks. Based on historical contact information, the proportion of non-critical command traffic in contact commands is obtained through preset fire protection weights. Domains with an attack co-occurrence rate greater than or equal to 0.5 and a non-critical command traffic proportion of less than 50% are designated as initial associated domains. The initial associated domains of contact commands within a short exposure period are classified as associated secondary domains.

[0072] In this embodiment, the method for obtaining the main line defense consumption includes:

[0073] Based on the current contact information, extract the timestamp and command length of the interaction command. Based on the secondary network domains traversed by the interaction command and the associated secondary network domains, obtain the attack diffusion coefficient and attack co-occurrence. Use the timestamp, command length, maximum attack diffusion coefficient, and attack co-occurrence as encryption parameters. Use the encryption parameters to hash and encrypt the interaction command, and append the timestamp of the most recent attack suffered by the secondary network domain.

[0074] The main line defense consumption is obtained based on the encryption parameters, instruction length, and real-time communication frequency of the secondary network and associated secondary network. The defense consumption formula is as follows:

[0075]

[0076] in Mainly for defensive consumption, For secondary domains The highest attack diffusion coefficient within, The average contact area, For attack co-occurrence, The timestamp of the current interaction command. For secondary domains The timestamp of the most recent attack For secondary domains and associated secondary domains Real-time communication frequency, This is the length of the interactive command. This is a critical instruction indicator function. If the interactive instruction is a critical instruction, the value is 1; otherwise, it is 0.

[0077] In this embodiment, the method for obtaining the secure line and the hidden redundant line includes:

[0078] A directed graph of redundant lines is constructed based on network topology nodes and redundant line nodes. The destination node, source node, and secondary network domains traversed by the instruction are extracted based on the current contact information. The simulation time step and trigger frequency are determined according to the fire instruction response requirements. Based on the simulation time step, trigger frequency, and directed graph, the redundant lines are triggered to fail through discrete event simulation. The average alarm rate of the secondary network domains in the past month is used as the trigger probability. When a failure is triggered, the redundant lines between the secondary network domains and the associated secondary network domains are cut off. If the attack co-occurrence of the associated secondary network domains is greater than 0.7, the trigger probability is increased by 3 times. The remaining bandwidth of the network nodes is counted in real time. If the remaining bandwidth is less than 20%, it is determined to be an overload failure. The failure path and the overload path are obtained.

[0079] Based on the failed paths, overloaded paths, and directed graph, a greedy algorithm is used to search for paths that are neither failed nor overloaded. The path with the fewest hops and the most remaining bandwidth among the remaining paths is designated as a safe path. The average fault interval time is calculated based on the safe path, and the path among the remaining paths that does not overlap with the safe path on the logical line is designated as a hidden redundant path.

[0080] In this embodiment, the method for obtaining the predicted damage model includes:

[0081] Based on the secure line, the contact area and attack co-occurrence are obtained from the associated secondary network domains. The historical maximum damage value of the secondary network domain is obtained based on the historical contact information. The damage product of the contact area and the historical maximum damage value is calculated. The damage product is divided by the average fault interval of the secure line to obtain the damage of a single network domain.

[0082] The geometric mean of damage is calculated based on the historical maximum damage values ​​of the secondary network domain and associated secondary network domains. The collaborative damage of associated network domains is obtained by multiplying the attack co-occurrence rate by the geometric mean of damage. The expected damage value of the secure line is calculated by weighted summation model based on the single network domain damage and the collaborative damage of associated network domains, thus obtaining the expected damage value and the expected damage model.

[0083] In this embodiment, the method for obtaining the defense scheme includes:

[0084] Based on continuous monitoring of interaction records of hidden redundant lines, the critical command level and main line defense consumption are obtained through the expected damage model according to the interaction records. The comprehensive defense cost factor is then calculated based on the critical command level and main line defense consumption. The formula for the comprehensive defense cost factor is as follows:

[0085]

[0086]

[0087] in To take into account the overall defense cost factor, For the integral manifold of the network topology, The volume element in the topological space is obtained by summing the values ​​of nodes and links in a discrete scenario. The rate of change of the difference in expected damage values ​​between adjacent secondary domains. For Li Qun The harmonious group on the top, For a Lie group constructed through domain association and line connection modes, To associate secondary domains boundary, The loop integral of the attack co-occurrence degree, The disturbance factor is the average alarm rate of the secondary network domain over the past month. For node traffic fluctuations, This is a resource weighting coefficient, obtained based on the preset fire safety weights corresponding to the critical instruction levels. For the domain's encrypted load balancing, 80% of the CPU limit;

[0088] The node traffic fluctuation, encryption error rate, and instruction retransmission count are obtained from the interaction records. The node traffic fluctuation, encryption error rate, and instruction retransmission count are concatenated into the LSTM input feature vector. The normalized comprehensive defense cost factor is used as the fourth dimension of the LSTM input feature. The LSTM model is trained based on the attack and normal instruction samples marked in the historical contact information. The LSTM input feature vector is input into the trained LSTM model to obtain the anomaly score.

[0089] If the anomaly score is less than 0.3 and the comprehensive defense cost factor is less than 1, the current secure line is maintained and the log is recorded. If the anomaly score is greater than or equal to 0.3 and less than 0.7, and the comprehensive defense cost factor is greater than or equal to 1 and less than 3, the sampling rate of the hidden redundant line is increased to 100%, and the firewall interception level of the associated secondary network domain is increased. If the anomaly score is greater than or equal to 0.7 and the comprehensive defense cost factor is greater than or equal to 3, the product of the comprehensive defense cost factor and the maximum instruction level in the interaction record is used as the blocking time. The anomaly source is blocked according to the blocking time, and the communication line is switched to the hidden redundant line.

[0090] A second aspect of the present invention also provides a network security defense device for an automatic fire alarm system, comprising:

[0091] Attack diffusion coefficient acquisition module: used to acquire the exposed interfaces, main lines and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, the centralized controller is used as the root node, the area controller is used as the intermediate node, and the detection and linkage devices are used as leaf nodes. A hierarchical tree-like network topology is obtained according to the root node, intermediate node and leaf node.

[0092] Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface.

[0093] Secondary domain acquisition module: used to obtain the contact area through a time-series decay window based on the attack diffusion coefficient and network node exposure time, and to obtain the secondary domain through graph neural network clustering based on the contact area and node traffic limit;

[0094] Defense Consumption Acquisition Module: Used to obtain associated secondary network domains based on the historical contact information and preset fire protection weights of secondary network domains, and to perform time-series encryption on the secondary network domains and associated secondary network domains according to the current contact information to obtain the defense consumption of the main line;

[0095] Defense line division module: It is used to simulate the failure and overload of the redundant lines through discrete event simulation based on the instruction destination node and main line defense consumption of the current contact information, and to obtain the safe lines and hidden redundant lines after the instruction object is masked.

[0096] Defense scheme acquisition module: used to obtain the expected damage model from the associated secondary network domain based on the security line, continuously monitor the interaction records using hidden redundant lines, and output the defense scheme of the security line based on the interaction records and the expected damage model through LSTM anomaly detection.

[0097] The above description is merely an example and illustration of the structure of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the structure of the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

Claims

1. A network security defense method for an automatic fire alarm system, characterized in that, Includes the following steps: Obtain the exposed interfaces, main lines, and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, use the centralized controller as the root node, the area controller as the intermediate node, and the detection and linkage devices as leaf nodes. Obtain a hierarchical tree-like network topology based on the root node, intermediate nodes, and leaf nodes. Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface. The contact area is obtained through a time-series decay window based on the attack diffusion coefficient and the network node exposure time. The secondary network domain is obtained through graph neural network clustering based on the contact area and the node traffic limit. Based on the historical contact information and preset fire protection weights of the secondary network domains, the associated secondary network domains are obtained. The secondary network domains and associated secondary network domains are then encrypted in a time sequence according to the current contact information to obtain the main line defense consumption. Based on the target node of the instruction and the main line defense consumption of the current contact information, the redundant line is simulated for failure and overload through discrete event simulation. The failure path after the instruction object is masked is obtained to obtain the safe line and the hidden redundant line. Based on the security line, a predicted damage model is obtained from the associated secondary network domain. The interaction records are continuously monitored using a hidden redundant line. Based on the interaction records and the predicted damage model, a defense scheme for the security line is output through LSTM anomaly detection.

2. The network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the secondary domain includes: Based on the attack diffusion coefficient, network node exposure time, real-time communication frequency, and node traffic limit of network nodes, the network node exposure time within 3 days is taken as the short-term exposure time, and the exposure time exceeding 3 days is taken as the long-term exposure time. The short-term exposure time is multiplied by an exponential decay of 10%, and the long-term exposure time is multiplied by an exponential decay of 1%. The sum of the exponential decay results is multiplied by the attack diffusion coefficient to obtain the contact area. Traffic saturation is obtained by comparing the ratio of communication frequency to real-time communication frequency within the node's traffic limit. The traffic saturation and contact area are concatenated to form a node feature vector. The adjacency matrix of the nodes is obtained based on the network topology. The node feature vectors and adjacency matrices are then used to train a graph neural network using a clustering loss function until the maximum number of iterations is reached, yielding the node network feature vector. The expression for the clustering loss function is: in The basic clustering loss for graph neural networks, For the first A set of nodes in each secondary domain. This represents the total number of secondary domains. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient, For nodes Contact area The maximum contact area of ​​the network. For nodes and Real-time communication frequency, The maximum communication frequency of the network. For nodes The depth of the hierarchy For nodes The attack diffusion coefficient; Using the node type of the network topology as the minimum sample size and the contact area as the neighborhood radius, DBSCAN clustering is performed on the node network feature vectors based on the minimum sample size and neighborhood radius to obtain the secondary network.

3. The network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the associated secondary domain includes: Based on historical contact information of secondary domains, the number of communications and attacks per hour between each domain is statistically analyzed. The attack co-occurrence rate is obtained by dividing the number of common attacks by the number of independent attacks. Based on historical contact information, the proportion of non-critical command traffic in contact commands is obtained through preset fire protection weights. Domains with an attack co-occurrence rate greater than or equal to 0.5 and a non-critical command traffic proportion of less than 50% are designated as initial associated domains. The initial associated domains of contact commands within a short exposure period are classified as associated secondary domains.

4. A network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the main line defense consumption includes: Based on the current contact information, extract the timestamp and command length of the interaction command. Based on the secondary network domains traversed by the interaction command and the associated secondary network domains, obtain the attack diffusion coefficient and attack co-occurrence. Use the timestamp, command length, maximum attack diffusion coefficient, and attack co-occurrence as encryption parameters. Use the encryption parameters to hash and encrypt the interaction command, and append the timestamp of the most recent attack suffered by the secondary network domain. The main line defense consumption is obtained based on the encryption parameters, instruction length, and real-time communication frequency of the secondary network and associated secondary network. The defense consumption formula is as follows: in Mainly for defensive consumption, For secondary domains The highest attack diffusion coefficient within, The average contact area, For attack co-occurrence, The timestamp of the current interaction command. For secondary domains The timestamp of the most recent attack For secondary domains and associated secondary domains Real-time communication frequency, This is the length of the interactive command. This is a critical instruction indicator function. If the interactive instruction is a critical instruction, the value is 1; otherwise, it is 0.

5. A network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the secure line and the hidden redundant line includes: A directed graph of redundant lines is constructed based on network topology nodes and redundant line nodes. The destination node, source node, and secondary network domains traversed by the instruction are extracted based on the current contact information. The simulation time step and trigger frequency are determined according to the fire instruction response requirements. Based on the simulation time step, trigger frequency, and directed graph, the redundant lines are triggered to fail through discrete event simulation. The average alarm rate of the secondary network domains in the past month is used as the trigger probability. When a failure is triggered, the redundant lines between the secondary network domains and the associated secondary network domains are cut off. If the attack co-occurrence of the associated secondary network domains is greater than 0.7, the trigger probability is increased by 3 times. The remaining bandwidth of the network nodes is counted in real time. If the remaining bandwidth is less than 20%, it is determined to be an overload failure. The failure path and the overload path are obtained. Based on the failed paths, overloaded paths, and directed graph, a greedy algorithm is used to search for paths that are neither failed nor overloaded. The path with the fewest hops and the most remaining bandwidth among the remaining paths is designated as a safe path. The average fault interval time is calculated based on the safe path, and the path among the remaining paths that does not overlap with the safe path on the logical line is designated as a hidden redundant path.

6. A network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the predicted damage model includes: Based on the secure line, the contact area and attack co-occurrence are obtained from the associated secondary network domains. The historical maximum damage value of the secondary network domain is obtained based on the historical contact information. The damage product of the contact area and the historical maximum damage value is calculated. The damage product is divided by the average fault interval of the secure line to obtain the damage of a single network domain. The geometric mean of damage is calculated based on the historical maximum damage values ​​of the secondary network domain and associated secondary network domains. The collaborative damage of associated network domains is obtained by multiplying the attack co-occurrence rate by the geometric mean of damage. The expected damage value of the secure line is calculated by weighted summation model based on the single network domain damage and the collaborative damage of associated network domains, thus obtaining the expected damage value and the expected damage model.

7. A network security defense method for an automatic fire alarm system according to claim 1, characterized in that, The method for obtaining the defense scheme includes: Based on continuous monitoring of interaction records of hidden redundant lines, the critical command level and main line defense consumption are obtained through the expected damage model according to the interaction records. The comprehensive defense cost factor is then calculated based on the critical command level and main line defense consumption. The formula for the comprehensive defense cost factor is as follows: in To take into account the overall defense cost factor, For the integral manifold of the network topology, The volume element in the topological space is obtained by summing the values ​​of nodes and links in a discrete scenario. The rate of change of the difference in expected damage values ​​between adjacent secondary domains. For Li Qun The harmonious group on the top, For a Lie group constructed through domain association and line connection modes, To associate secondary domains boundary, The loop integral of attack co-occurrence The disturbance factor is the average alarm rate of the secondary network domain over the past month. For node traffic fluctuations, This is a resource weighting coefficient, obtained based on the preset fire safety weights corresponding to the key instruction levels. For the domain's encrypted load balancing, 80% of the CPU limit; The node traffic fluctuation, encryption error rate, and instruction retransmission count are obtained from the interaction records. The node traffic fluctuation, encryption error rate, and instruction retransmission count are concatenated into the LSTM input feature vector. The normalized comprehensive defense cost factor is used as the fourth dimension of the LSTM input feature. The LSTM model is trained based on the attack and normal instruction samples marked in the historical contact information. The LSTM input feature vector is input into the trained LSTM model to obtain the anomaly score. If the anomaly score is less than 0.3 and the comprehensive defense cost factor is less than 1, the current secure line is maintained and the log is recorded. If the anomaly score is greater than or equal to 0.3 and less than 0.7, and the comprehensive defense cost factor is greater than or equal to 1 and less than 3, the sampling rate of the hidden redundant line is increased to 100%, and the firewall interception level of the associated secondary network domain is increased. If the anomaly score is greater than or equal to 0.7 and the comprehensive defense cost factor is greater than or equal to 3, the product of the comprehensive defense cost factor and the maximum instruction level in the interaction record is used as the blocking time. The anomaly source is blocked according to the blocking time, and the communication line is switched to the hidden redundant line.

8. A network security defense device for an automatic fire alarm system, used to execute the network security defense method for an automatic fire alarm system as described in any one of claims 1 to 7, characterized in that, The system includes: Attack diffusion coefficient acquisition module: used to acquire the exposed interfaces, main lines and redundant lines of the automatic fire alarm system. Based on the main lines and redundant lines, the centralized controller is used as the root node, the area controller is used as the intermediate node, and the detection and linkage devices are used as leaf nodes. A hierarchical tree-like network topology is obtained according to the root node, intermediate node and leaf node. Based on the network topology, the exposure time, associated nodes, actual communication nodes, and interface type of the exposed interface are obtained. The product of the vertically connectable nodes and the horizontally connectable nodes is obtained based on the associated nodes. The normalized ratio of the product to the actual communication nodes is used as the topology connectivity. The interface risk factor is obtained by linear time weighting based on the exposure time and interface type. The attack diffusion coefficient is obtained by multiplying the node level depth, topology connectivity, and interface risk factor of the exposed interface. Secondary domain acquisition module: used to obtain the contact area through a time-series decay window based on the attack diffusion coefficient and network node exposure time, and to obtain the secondary domain through graph neural network clustering based on the contact area and node traffic limit; Defense Consumption Acquisition Module: Used to obtain associated secondary network domains based on the historical contact information and preset fire protection weights of secondary network domains, and to perform time-series encryption on the secondary network domains and associated secondary network domains according to the current contact information to obtain the defense consumption of the main line; Defense line division module: It is used to simulate the failure and overload of the redundant lines through discrete event simulation based on the instruction destination node and main line defense consumption of the current contact information, and to obtain the safe lines and hidden redundant lines after the instruction object is masked. Defense scheme acquisition module: used to obtain the expected damage model from the associated secondary network domain based on the security line, continuously monitor the interaction records using hidden redundant lines, and output the defense scheme of the security line based on the interaction records and the expected damage model through LSTM anomaly detection.

Images