Cloud security intrusion analysis method applied to industrial data processing

Abstract

The invention belongs to the technical field of industrial internet security, and particularly relates to a cloud security intrusion analysis method applied to industrial data processing, which comprises edge side real-time detection, cloud collaborative analysis and dynamic defense optimization. According to the cloud security intrusion analysis method applied to industrial data processing, in edge side real-time detection, the data processing efficiency is improved by using a lightweight model and standardized preprocessing; the cloud collaborative analysis comprehensively analyzes the state of the industrial control system through topology learning and a dynamic partitioning strategy; the security and privacy of the system are enhanced through dynamic defense optimization and privacy protection training; the reliability and the resource utilization rate of the system are further improved through attack tracing and resource dynamic scheduling; and a model self-evolution mechanism enables the system to adapt to continuously changing environments, so that the analysis accuracy is continuously improved.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet security technology, and specifically relates to a cloud security intrusion analysis method applied to industrial data processing. Background Art

[0002] With the advent of Industry 4.0, industrial production is rapidly evolving toward intelligent and networked processes. Industrial control systems, at the core of industrial production, are widely used in numerous critical infrastructure sectors, including power, water conservancy, manufacturing, and transportation. These systems utilize sensors, controllers, actuators, and other devices to monitor and control industrial processes in real time, significantly improving production efficiency and quality.

[0003] However, while industrial control systems enjoy the benefits of informatization, they also face increasingly severe security threats. For one thing, the increasing connectivity between industrial control systems and external networks is making traditional physical isolation protection measures less effective, exposing systems to greater cyberattack risks. Hackers can exploit network vulnerabilities to launch various attacks against industrial control systems, such as malicious code injection, denial of service attacks, and man-in-the-middle attacks. These attacks can lead to serious consequences such as production disruptions, equipment damage, and data leaks, resulting in significant economic losses and security risks for businesses and society.

[0004] On the other hand, industrial data has unique characteristics, such as time series, high dimensionality, and massive volume. Traditional security intrusion analysis methods are primarily designed for general information technology systems and suffer from the following deficiencies when processing industrial data.

[0005] Traditional methods have difficulty effectively capturing temporal correlations and abnormal patterns in data; when faced with complex network topologies and dynamically changing working conditions in industrial environments, traditional methods lack flexibility and adaptability and are unable to accurately identify and defend against new security threats. Summary of the Invention

[0006] In order to make up for the deficiencies of the prior art, at least one technical problem raised in the background technology is solved.

[0007] The technical solution adopted by the present invention to solve the technical problem is: a cloud security intrusion analysis method applied to industrial data processing, comprising:

[0008] Real-time detection at the edge: A lightweight bidirectional LSTM model is deployed on the 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a dropout layer, and an output layer.

[0009] Standardize and preprocess the sensor time series data:

[0010]

[0011] Where μ is the mean of the sliding window and σ is the standard deviation of the sliding window;

[0012] When the abnormal probability output is greater than 0.85 for three consecutive sampling periods, a level 3 alarm is triggered; when it is greater than 0.9 for five consecutive periods, a level 1 alarm is triggered;

[0013] Cloud-based collaborative analysis: After receiving edge alarms, the topology of the industrial control system is constructed. The node coding rules are as follows: PLC devices use the "IP_Function Code" format, and sensors use the "Modbus Address_Range" format.

[0014] Edge attributes include communication protocol type, average transmission frequency, and historical anomaly count;

[0015] The GraphSAGE algorithm is used for topology learning, with the sampling depth set to 3, the number of neighbors set to 8, and the aggregation function set to mean aggregation;

[0016] Dynamic defense optimization: Threshold adjustment based on Double DQN, state space S = {device operation stage, CPU load rate, network throughput, topology anomaly score}

[0017] Reward Function

[0018] Among them, TP is the number of true positive samples; FP is the number of false positive samples; λ is the weight coefficient.

[0019] A further improvement of the technical solution of the present invention is that the sliding window size in the preprocessing of the edge side real-time detection stage is set to 10 sampling cycles, and the step length is 1 cycle.

[0020] A further improvement of the technical solution of the present invention is that the LSTM model optimization specifically includes: training data annotation adopts a three-level annotation system:

[0021] Level 1 marking refers to simultaneous protocol anomalies and value out-of-bounds conditions; level 2 marking refers to a single anomaly lasting longer than 10 seconds; level 3 marking refers to a transient anomaly that self-recovers;

[0022] Focal Loss is used to handle category imbalance, with γ = 2.0 and α = 0.75.

[0023] A further improvement of the technical solution of the present invention is that the topological analysis further includes:

[0024] Dynamic block strategy: If the number of nodes is greater than 150, block them by physical area, with 30-40 nodes per block; if the number of nodes is greater than 50 and less than or equal to 150, block them by functional module; otherwise, full graph analysis is performed;

[0025] The comprehensive judgment formula for abnormal edges is:

[0026]

[0027] Among them, Score is the comprehensive judgment score of abnormal edges, which is used to measure the abnormality of the edge. The higher the score, the more likely the edge is an abnormal edge.

[0028] x i is the i-th eigenvalue of the current edge, i.e., the flow size and connection frequency;

[0029] The average value of the eigenvalues ​​corresponding to the edge in historical data or a statistical benchmark value, used for comparison with the current eigenvalue;

[0030] σ i is the standard deviation of the eigenvalue in the historical data, reflecting the degree of dispersion of the eigenvalue in the historical data;

[0031] N abnormal is the number of abnormal protocols involved in the current edge;

[0032] N total is the total number of all protocols involved in the current edge.

[0033] A further improvement of the technical solution of the present invention is that the dynamic defense optimization further includes:

[0034] Experience replay buffer management:

[0035] The buffer capacity is 50,000 entries;

[0036] Prioritize sampling of records with TD error > 0.6;

[0037] Importance sampling weighting is performed every 1000 iterations;

[0038] The exploration strategy adopts ∈-greedy, where ∈ decays linearly from 0.5 to 0.1.

[0039] A further improvement of the technical solution of the present invention is that it also includes privacy protection training:

[0040] Federated learning parameter aggregation uses the FedProx algorithm to process non-IID data, with a proximal term coefficient μ = 0.15;

[0041] Gradient clipping is performed before uploading the model gradient, with a threshold of L2 = 1.5;

[0042] The Paillier algorithm is used to encrypt model parameters. It supports matrix point addition operations in ciphertext state, and the key length is 3072 bits. The calculation formula is:

[0043]

[0044] Among them, Enc represents the encryption function, which is used to convert plaintext data into ciphertext data;

[0045] A and B are plaintext data, which can be in the form of scalar, vector, or matrix data. In the context of matrix dot addition, A and B are matrices of the same dimension;

[0046] It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

[0047] A further improvement of the technical solution of the present invention is that the privacy protection training further includes:

[0048] Differential privacy protection: Rényi differential privacy (α=2) is adopted, and each round of training satisfies ∈ epoch =0.08,δ=10 -6 ;

[0049] The noise addition formula is:

[0050]

[0051] in, represents the model parameters after adding noise; θ represents the original model parameters, which are the parameter values ​​obtained when the model is trained without adding noise; N represents the size of the dataset, that is, the number of samples participating in the training; C represents the parameter clipping boundary, which limits the range of parameter variation; δ represents the failure probability in differential privacy; ∈ is the privacy budget of differential privacy; N(0, σ 2 ) means the mean is 0 and the variance is σ 2 Gaussian distribution.

[0052] A further improvement of the technical solution of the present invention is that it also includes attack tracing:

[0053] Tracing analysis based on causal reasoning: Constructing a directed graph of attack propagation, with nodes representing abnormal events; using Granger causality tests to determine event correlation;

[0054] The formula for calculating the output attack path probability is:

[0055]

[0056] Where P represents the attack path probability, that is, the probability of the entire attack path from the attack source to the target node; n represents the number of edges in the attack propagation directed graph, that is, the total number of all edges that constitute the attack path; e i represents the probability of attacking the i-th edge in the directed graph;

[0057] Dynamic forensic log generation: Record fields include nanosecond timestamps, device fingerprints, and operation context;

[0058] Merkle Patricia Tree is used to store logs, and blocks are generated every 5 minutes.

[0059] A further improvement of the technical solution of the present invention is that it also includes a dynamic resource scheduling stage:

[0060] Calculate the resource allocation weight using the following formula:

[0061]

[0062] Among them, P represents the task priority; S i represents the security risk score, ω i represents the resource allocation weight of the i-th task, which is a value between 0 and 1 and is used to determine the proportion of each task in resource allocation. The larger the weight, the more resources are allocated. n represents the total number of tasks, that is, the number of all tasks participating in resource allocation. Indicates all tasks The sum of the values ​​is used to normalize the resource allocation weights of each task to ensure that the sum of the weights of all tasks is 1;

[0063] Elastic scaling policy: When the CPU usage exceeds 85% for 2 minutes, add one GPU instance;

[0064] When the CPU usage is less than 40% for 5 minutes, the redundant instance is released.

[0065] A further improvement of the technical solution of the present invention is that it also includes model self-evolution:

[0066] Online learning mechanism:

[0067] Set the confidence threshold θ = 0.9;

[0068] When the prediction confidence is greater than θ, it is automatically added to the training set;

[0069] Incremental updates:

[0070] Model updates are performed weekly;

[0071] The knowledge distillation algorithm is used, with the teacher model weight α = 0.7 and the student model β = 0.3.

[0072] Beneficial effects

[0073] In real-time detection on the edge, lightweight models and standardized preprocessing are used to improve data processing efficiency; cloud-based collaborative analysis comprehensively analyzes the status of industrial control systems through topology learning and dynamic segmentation strategies; dynamic defense optimization and privacy protection training enhance the security and privacy of the system; attack tracing and dynamic resource scheduling further improve the system's reliability and resource utilization; the model's self-evolution mechanism enables the system to adapt to the ever-changing environment, thereby continuously improving analysis accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The present invention will be further described below with reference to the accompanying drawings.

[0075] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0076] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0077] See also Figure 1 ,

[0078] This embodiment provides: a cloud security intrusion analysis method applied to industrial data processing, comprising:

[0079] S1. Real-time detection at the edge: A lightweight bidirectional LSTM model is deployed on the 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a dropout layer, and an output layer.

[0080] LSTM model optimization specifically includes: training data annotation using a three-level annotation system:

[0081] Level 1 marking refers to simultaneous protocol anomalies and value out-of-bounds conditions; level 2 marking refers to a single anomaly lasting longer than 10 seconds; level 3 marking refers to a transient anomaly that self-recovers;

[0082] Focal Loss is used to handle category imbalance, with γ = 2.0 and α = 0.75.

[0083] Standardize and preprocess the sensor time series data:

[0084]

[0085] Where μ is the mean of the sliding window and σ is the standard deviation of the sliding window;

[0086] In the preprocessing of the edge-side real-time detection stage, the sliding window size is set to 10 sampling periods and the step size is 1 period.

[0087] When the abnormal probability output is greater than 0.85 for three consecutive sampling periods, a level 3 alarm is triggered; when it is greater than 0.9 for five consecutive periods, a level 1 alarm is triggered;

[0088] The lightweight model can detect anomalies in real time and respond quickly to anomalies. The three-level labeling system improves the accuracy of anomaly identification. Focal Loss enhances the model's ability to learn various types of anomalies. Standardized preprocessing and sliding windows help improve data quality and anomaly detection effects. Different levels of warnings allow staff to take corresponding measures based on the severity of the anomaly.

[0089] It should be noted that the training dataset primarily comes from historical sensor time series data from industrial sites, covering data under both normal production conditions and various abnormal conditions. Data augmentation methods include adding Gaussian noise and time warping. Adding Gaussian noise can simulate sensor measurement errors and enhance the model's robustness to noisy data. Time warping increases the diversity of the data in the temporal order by changing the temporal order of the data. To calculate anomaly probabilities, the output layer of the bidirectional LSTM model typically uses a Sigmoid function, mapping the output value to a range between 0 and 1. This output value represents the anomaly probability. For example, the model predicts the data for each sampling period and outputs a value between 0 and 1. When this value exceeds the corresponding threshold, it is considered an anomaly and an alarm is triggered.

[0090] S2. Cloud-based collaborative analysis: After receiving edge alarms, the topology of the industrial control system is constructed. The node coding rules are as follows: PLC devices use the "IP_Function Code" format, and sensors use the "Modbus Address_Range" format.

[0091] Edge attributes include communication protocol type, average transmission frequency, and historical anomaly count;

[0092] The GraphSAGE algorithm is used for topology learning, with the sampling depth set to 3, the number of neighbors set to 8, and the aggregation function set to mean aggregation;

[0093] Topology analysis also includes:

[0094] Dynamic block strategy: If the number of nodes is greater than 150, block them by physical area, with 30-40 nodes per block; if the number of nodes is greater than 50 and less than or equal to 150, block them by functional module; otherwise, full graph analysis is performed;

[0095] Furthermore, dividing by physical areas is suitable for large industrial plants. The functions of different physical areas are relatively independent. After dividing, local analysis can be carried out in their respective areas to reduce the amount of calculation and facilitate monitoring and management by regional managers. Dividing by functional modules is suitable for industrial systems with clear functional divisions. For example, multiple devices in a production process constitute a functional module. After dividing, in-depth analysis can be carried out on specific functions to improve the accuracy of anomaly detection. Full-graph analysis is suitable for industrial control systems with a small number of nodes or a relatively simple system structure, and can fully grasp the overall status of the system.

[0096] The comprehensive judgment formula for abnormal edges is:

[0097]

[0098] Among them, Score is the comprehensive judgment score of abnormal edges, which is used to measure the abnormality of the edge. The higher the score, the more likely the edge is an abnormal edge.

[0099] x i is the i-th eigenvalue of the current edge, i.e., the flow size and connection frequency;

[0100] The average value of the eigenvalues ​​corresponding to the edge in historical data or a statistical benchmark value, used for comparison with the current eigenvalue;

[0101] σ i is the standard deviation of the eigenvalue in the historical data, reflecting the degree of dispersion of the eigenvalue in the historical data;

[0102] N abnormal is the number of abnormal protocols involved in the current edge;

[0103] N total is the total number of all protocols involved in the current edge.

[0104] Topology graph construction and attribute definition help to fully understand the structure of industrial control systems. The GraphSAGE algorithm can effectively extract topological features. The dynamic blocking strategy can flexibly adjust the analysis method according to the system scale to improve analysis efficiency. The comprehensive judgment formula for abnormal edges provides a quantitative standard for accurately identifying abnormal edges, which helps to promptly discover potential security threats in the system.

[0105] It should be noted that the topology map construction algorithm and process are as follows: The topology map is constructed using a method based on network scanning and device configuration information collection. First, network scanning tools are used to discover PLC devices, sensors, and other nodes in the industrial control system and obtain basic information such as their IP addresses. Then, based on the device configuration information, such as the PLC function code and the sensor address and range, they are encoded according to established node encoding rules. Edge construction is determined based on the communication connection relationships between devices, and edge attributes are obtained by analyzing communication logs and historical data statistics between devices. For the initial screening of abnormal edges, a threshold is set based on the number of historical anomalies in the edge attributes. When the number of historical anomalies exceeds this threshold, the edge is marked as a suspected abnormal edge, and subsequent comprehensive judgment is carried out.

[0106] S3. Dynamic defense optimization:

[0107] S31: Threshold adjustment based on Double DQN, state space S = {device operation stage, CPU load rate, network throughput, topology anomaly score}

[0108] S32: Dynamic defense optimization also includes:

[0109] Experience replay buffer management:

[0110] The buffer capacity is 50,000 entries;

[0111] Prioritize sampling of records with TD error > 0.6;

[0112] Importance sampling weighting is performed every 1000 iterations;

[0113] The exploration strategy uses ∈-greedy, where ∈ decays linearly from 0.5 to 0.1

[0114] Furthermore, the TD error (temporal difference error) is calculated by comparing the estimated and actual returns of the current Q value. The specific formula is: Where r is the immediate reward, γ is the discount factor, s is the current state, a is the current action, and s' is the next state. The exploration strategy uses ∈-greedy, with an initial ∈ value of 0.5 and linearly decaying to 0.1 as the number of iterations increases. This means that in the early stages of training, the model has a high probability of random exploration to fully learn the action values ​​under different states. As training progresses, the exploration ratio gradually decreases, and more decision-making is made based on the learned knowledge, improving model stability.

[0115] Reward Function

[0116] Among them, TP is the number of true positive samples; FP is the number of false positive samples; λ is the weight coefficient.

[0117] Double DQN can adjust defense thresholds in real time based on system status, improving defense targeting. Experience replay buffer management optimizes the model learning process, improving learning efficiency and stability. The reward function enables the model to learn more effective defense strategies, enhancing the overall security of the system.

[0118] It's worth noting that DoubleDQN is an improvement on DQN, designed to address the problem of overestimating Q values ​​in DQN. It utilizes two Q networks with identical structures but different parameters: one for selecting actions and the other for evaluating their value. In this approach, the state space S contains information such as the device's operating stage, CPU load, network throughput, and topology anomaly scores. DoubleDQN selects the optimal defensive action based on the current state, such as adjusting the security threshold. By continuously interacting with the environment and updating network parameters according to the reward function, it learns the optimal defense strategy.

[0119] S4. Privacy protection training:

[0120] S41: Federated learning parameter aggregation uses the FedProx algorithm to process non-IID data, with a proximal term coefficient μ = 0.15;

[0121] It is worth mentioning that the specific algorithm steps for parameter aggregation in federated learning are as follows: During the federated learning process, each participant (such as different industrial equipment or edge nodes) trains the model locally and uploads the model gradient to the cloud. The cloud uses the FedProx algorithm for parameter aggregation. First, the uploaded gradient is constrained by the proximal term, and the proximal term coefficient μ = 0.15. This proximal term helps maintain the similarity between the aggregated model and each local model. Then, the gradients are weighted averaged according to certain weights. The weights can be allocated according to the amount of data or importance of the participants, and finally the aggregated model parameters are obtained.

[0122] Gradient clipping is performed before uploading the model gradient, with a threshold of L2 = 1.5;

[0123] The Paillier algorithm is used to encrypt model parameters. It supports matrix point addition operations in ciphertext state, and the key length is 3072 bits. The calculation formula is:

[0124]

[0125] Among them, Enc represents the encryption function, which is used to convert plaintext data into ciphertext data;

[0126] A and B are plaintext data, which can be in the form of scalar, vector, or matrix data. In the context of matrix dot addition, A and B are matrices of the same dimension;

[0127] It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

[0128] Privacy protection training also includes:

[0129] S42: Differential privacy protection: using Rényi differential privacy (α=2), each round of training satisfies ∈ epoch =0.08,δ=10 -6 ;

[0130] The noise addition formula is:

[0131]

[0132] in, represents the model parameters after adding noise; θ represents the original model parameters, which are the parameter values ​​obtained when the model is trained without adding noise; N represents the size of the dataset, that is, the number of samples participating in the training; C represents the parameter clipping boundary, which limits the range of parameter variation; δ represents the failure probability in differential privacy; ∈ is the privacy budget of differential privacy; N(0, σ 2 ) means the mean is 0 and the variance is σ 2 Gaussian distribution.

[0133] Furthermore, the selection of the privacy budget and failure probability requires a comprehensive consideration of privacy protection strength and data availability. Smaller values ​​of and provide stronger privacy protection, but may reduce data availability and lead to degraded model performance; larger values ​​have the opposite effect. In practical applications, appropriate parameters should be selected based on the sensitivity of the industrial data and the model's requirements for data accuracy. For example, for highly sensitive industrial data, smaller values ​​of and can maximize privacy protection. For model training with high data accuracy requirements, a trade-off between privacy protection and data availability must be made.

[0134] Federated learning solves the problems of data dispersion and privacy. The parameter aggregation method processes non-IID data to improve model performance. Gradient clipping and encryption algorithms ensure data privacy. Differential privacy provides stronger privacy protection, ensuring that sensitive information of industrial data is not leaked, meeting industrial data security requirements.

[0135] S5. Attack Source Tracing:

[0136] S51: Tracing back analysis based on causal reasoning:

[0137] Construct an attack propagation directed graph with nodes representing abnormal events; use Granger causality test to determine event correlation;

[0138] The formula for calculating the output attack path probability is:

[0139]

[0140] Where P represents the attack path probability, that is, the probability of the entire attack path from the attack source to the target node; n represents the number of edges in the attack propagation directed graph, that is, the total number of all edges that constitute the attack path; e i represents the probability of attacking the i-th edge in the directed graph;

[0141] Furthermore, the Granger causality test method is used to determine the causal relationship between events by analyzing the predictive relationship between two time series data. The specific steps are: establish two time series models: an autoregressive model that only contains its own historical information, and a model that contains its own historical information and historical information of other variables. By comparing the prediction accuracy of the two models, if the prediction accuracy of the model is significantly improved after adding the historical information of other variables, it is considered that there is a Granger causal relationship between the variable in question and the predicted variable. The judgment criteria are usually determined by F-test or likelihood ratio test. When the test statistic exceeds a certain critical value, a causal relationship is considered to exist.

[0142] S52: Dynamic forensic log generation:

[0143] Record fields include nanosecond timestamps, device fingerprints, and operation context;

[0144] Merkle Patricia Tree is used to store logs, and blocks are generated every 5 minutes.

[0145] The attack propagation directed graph and causal verification help to accurately trace the source and path of the attack. The attack path probability calculation provides a basis for defense decision-making. The dynamic forensic log provides reliable data support for post-analysis and auditing, which helps to improve the security and maintainability of the system.

[0146] S6, dynamic resource scheduling stage:

[0147] S61: Calculate resource allocation weights using the following formula:

[0148]

[0149] Among them, P represents the task priority; S i represents the security risk score, ω i represents the resource allocation weight of the i-th task, which is a value between 0 and 1 and is used to determine the proportion of each task in resource allocation. The larger the weight, the more resources are allocated. n represents the total number of tasks, that is, the number of all tasks participating in resource allocation. Indicates all tasks The sum of the values ​​is used to normalize the resource allocation weights of each task to ensure that the sum of the weights of all tasks is 1;

[0150] It's important to note that task priorities can be assessed based on their importance and urgency. For example, tasks related to critical production processes are given higher priority, while auxiliary tasks are given lower priority. The security risk score comprehensively considers factors such as the data sensitivity and operational permissions involved in the task. Tasks involving core process parameters and high-authority operations are given higher security risk scores. Resource allocation weights are determined using a calculation formula based on task priority and security risk scores, and computing resources are then allocated to each task in proportion to the weight.

[0151] S62: Elastic scaling strategy:

[0152] When the CPU usage is greater than 85% for 2 minutes, add one GPU instance;

[0153] When the CPU usage is less than 40% for 5 minutes, the redundant instance is released.

[0154] Furthermore, adding a GPU instance when CPU usage exceeds 85% for two minutes can increase the system's computing power, meet sudden computing demands, and avoid task delays or failures due to insufficient resources. However, adding GPU instances increases costs. Releasing redundant instances when CPU usage falls below 40% for five minutes can save resource costs. However, setting the threshold too low can lead to frequent instance releases and restarts, affecting system stability. Therefore, the CPU usage threshold should be adjusted appropriately based on the actual business load and cost budget of the industrial control system.

[0155] The resource allocation weight formula ensures a rational allocation of resources, improving system efficiency. The elastic scaling strategy dynamically adjusts resources based on system load, avoiding resource waste and shortages, reducing costs, and ensuring stable system operation under varying loads.

[0156] S7. Model self-evolution:

[0157] S71: Online learning mechanism:

[0158] Set the confidence threshold θ = 0.9;

[0159] When the prediction confidence is greater than θ, it is automatically added to the training set;

[0160] It is important to note the data screening and processing methods used in the online learning mechanism: During online learning, when the prediction confidence level is greater than θ = 0.9, the corresponding data is added to the training set. Before adding it to the training set, the data is cleaned and preprocessed to remove noise and outliers. Furthermore, the data is standardized or normalized to a consistent scale to facilitate model training. Data augmentation methods, such as random rotation and translation, can also be used to increase data diversity for newly added data.

[0161] S72: Incremental update:

[0162] Model updates are performed weekly;

[0163] The knowledge distillation algorithm is used, with the teacher model weight α = 0.7 and the student model β = 0.3.

[0164] The online learning mechanism enables the model to adapt to the ever-changing security environment in a timely manner and improve its ability to detect new attacks. The knowledge distillation algorithm reduces the amount of computation and storage requirements while ensuring model performance, enabling the model to continue to evolve and improve the long-term security of the system.

[0165] The above-mentioned front, back, left, right, up and down are all based on the Figure 1 As a benchmark, according to the person's observation perspective, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0166] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the scope of protection of the present invention.

[0167] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A cloud security intrusion analysis method applied to industrial data processing, characterized in that: include: Real-time detection at the edge: A lightweight bidirectional LSTM model is deployed on the 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a dropout layer, and an output layer. Standardize and preprocess the sensor time series data: Where μ is the mean of the sliding window and σ is the standard deviation of the sliding window; When the abnormal probability output is greater than 0.85 for three consecutive sampling periods, a level 3 alarm is triggered; when it is greater than 0.9 for five consecutive periods, a level 1 alarm is triggered; Cloud-based collaborative analysis: After receiving edge alarms, the topology of the industrial control system is constructed. The node coding rules are as follows: PLC devices use the "IP_Function Code" format, and sensors use the "Modbus Address_Range" format. Edge attributes include communication protocol type, average transmission frequency, and historical anomaly count; The GraphSAGE algorithm is used for topology learning, with the sampling depth set to 3, the number of neighbors set to 8, and the aggregation function set to mean aggregation; Dynamic defense optimization: Threshold adjustment based on Double DQN, state space S = {device operation stage, CPU load rate, network throughput, topology anomaly score} Reward Function Among them, TP is the number of true positive samples; FP is the number of false positive samples; λ is the weight coefficient.

2. The cloud security intrusion analysis method for industrial data processing according to claim 1 is characterized in that: In the preprocessing of the edge-side real-time detection phase, the sliding window size is set to 10 sampling cycles, and the step length is 1 cycle.

3. The cloud security intrusion analysis method for industrial data processing according to claim 2, characterized in that: The LSTM model optimization specifically includes: training data annotation using a three-level annotation system: Level 1 marking refers to simultaneous protocol anomalies and value out-of-bounds conditions; level 2 marking refers to a single anomaly lasting longer than 10 seconds; level 3 marking refers to a transient anomaly that self-recovers; Focal Loss is used to handle category imbalance, with γ = 2.0 and α = 0.

75.

4. The cloud security intrusion analysis method for industrial data processing according to claim 1 is characterized in that: The topology analysis also includes: Dynamic block strategy: If the number of nodes is greater than 150, block them by physical area, with 30-40 nodes per block; if the number of nodes is greater than 50 and less than or equal to 150, block them by functional module; otherwise, full graph analysis is performed; The comprehensive judgment formula for abnormal edges is: Among them, Score is the comprehensive judgment score of abnormal edges, which is used to measure the abnormality of the edge. The higher the score, the more likely the edge is an abnormal edge. x i is the i-th eigenvalue of the current edge, i.e., the flow size and connection frequency; The average value of the eigenvalues ​​corresponding to the edge in historical data or a statistical benchmark value, used for comparison with the current eigenvalue; σ i is the standard deviation of the eigenvalue in the historical data, reflecting the degree of dispersion of the eigenvalue in the historical data; N abnormal is the number of abnormal protocols involved in the current edge; N total is the total number of all protocols involved in the current edge.

5. The cloud security intrusion analysis method for industrial data processing according to claim 4 is characterized in that: The dynamic defense optimization also includes: Experience replay buffer management: The buffer capacity is 50,000 entries; Prioritize sampling of records with TD error > 0.6; Importance sampling weighting is performed every 1000 iterations; The exploration strategy adopts ∈-greedy, where ∈ decays linearly from 0.5 to 0.

1.

6. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: Also includes privacy training: Federated learning parameter aggregation uses the FedProx algorithm to process non-IID data, with a proximal term coefficient μ = 0.15; Gradient clipping is performed before uploading the model gradient, with a threshold of L2 = 1.5; The Paillier algorithm is used to encrypt model parameters. It supports matrix point addition operations in ciphertext state, and the key length is 3072 bits. The calculation formula is: Where Enc represents the encryption function, which is used to convert plaintext data into ciphertext data; A and B are plaintext data, which can be in the form of scalar, vector, or matrix data. In the context of matrix dot addition, A and B are matrices of the same dimension. It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

7. The cloud security intrusion analysis method for industrial data processing according to claim 6, characterized in that: The privacy protection training also includes: differential privacy protection: using Rényi differential privacy (α=2), each round of training satisfies ∈ epoch =0.08,δ=10 -6 ; The noise addition formula is: in, represents the model parameters after adding noise; θ represents the original model parameters, which are the parameter values ​​obtained when the model is trained without adding noise; N represents the size of the dataset, that is, the number of samples participating in the training; C represents the parameter clipping boundary, which limits the range of parameter variation; δ represents the failure probability in differential privacy; ∈ is the privacy budget of differential privacy; N(0, σ 2 ) means the mean is 0 and the variance is σ 2 Gaussian distribution.

8. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: Also includes attack tracing: Tracing analysis based on causal reasoning: Constructing a directed graph of attack propagation, with nodes representing abnormal events; using Granger causality tests to determine event correlation; The formula for calculating the output attack path probability is: Where P represents the attack path probability, that is, the probability of the entire attack path from the attack source to the target node; n represents the number of edges in the attack propagation directed graph, that is, the total number of all edges that constitute the attack path; e i represents the probability of attacking the i-th edge in the directed graph; Dynamic forensic log generation: Record fields include nanosecond timestamps, device fingerprints, and operation context; Merkle Patricia Tree is used to store logs, and blocks are generated every 5 minutes.

9. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: It also includes the dynamic resource scheduling stage: Calculate the resource allocation weight using the following formula: Among them, P represents the task priority; S i represents the security risk score, ω i represents the resource allocation weight of the i-th task, which is a value between 0 and 1 and is used to determine the proportion of each task in resource allocation. The larger the weight, the more resources are allocated. n represents the total number of tasks, that is, the number of all tasks participating in resource allocation. Indicates all tasks The sum of the values ​​is used to normalize the resource allocation weights of each task to ensure that the sum of the weights of all tasks is 1; Elastic scaling policy: When the CPU usage exceeds 85% for 2 minutes, add one GPU instance; When the CPU usage is less than 40% for 5 minutes, the redundant instance is released.

10. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: Also includes model self-evolution: Online learning mechanism: Set the confidence threshold θ = 0.9; When the prediction confidence is greater than θ, it is automatically added to the training set; Incremental updates: Model updates are performed weekly; The knowledge distillation algorithm is used, with the teacher model weight α = 0.7 and the student model β = 0.3.

Images