A cloud security intrusion analysis method applied to industrial data processing

Abstract

This invention belongs to the field of industrial internet security technology, specifically a cloud security intrusion analysis method applied to industrial data processing, including real-time edge detection, cloud-based collaborative analysis, and dynamic defense optimization. In real-time edge detection, this cloud security intrusion analysis method utilizes lightweight models and standardized preprocessing to improve data processing efficiency; cloud-based collaborative analysis comprehensively analyzes the state of the industrial control system through topology learning and dynamic block partitioning strategies; dynamic defense optimization and privacy-preserving training enhance the system's security and privacy; attack tracing and dynamic resource scheduling further improve the system's reliability and resource utilization; and the model's self-evolution mechanism enables the system to adapt to constantly changing environments, thereby continuously improving analytical accuracy.

Description

Technical Field

[0001] This invention belongs to the field of industrial internet security technology, specifically a cloud security intrusion analysis method applied to industrial data processing. Background Technology

[0002] With the advent of Industry 4.0, industrial production is rapidly developing towards intelligence and networking. Industrial control systems, as the core of industrial production, are widely used in many critical infrastructure sectors such as power, water conservancy, manufacturing, and transportation. These systems, through sensors, controllers, actuators, and other equipment, achieve real-time monitoring and control of industrial production processes, greatly improving production efficiency and quality.

[0003] However, while enjoying the convenience brought by information technology, industrial control systems also face increasingly severe security threats. On the one hand, the connection between industrial control systems and external networks is becoming increasingly close, and traditional physical isolation and protection measures are gradually becoming ineffective, exposing the systems to more cyberattack risks. Hackers can exploit network vulnerabilities to launch various attacks on industrial control systems, such as malicious code injection, denial-of-service attacks, and man-in-the-middle attacks, leading to serious consequences such as production interruptions, equipment damage, and data leaks, causing huge economic losses and security risks to enterprises and society.

[0004] On the other hand, industrial data has unique characteristics, such as temporal sequence, high dimensionality, and massive volume. Traditional security intrusion analysis methods are mainly designed for general information technology systems and have the following shortcomings when processing industrial data.

[0005] Traditional methods struggle to effectively capture temporal correlations and abnormal patterns in data. Furthermore, when faced with complex network topologies and dynamically changing operating conditions in industrial environments, traditional methods lack flexibility and adaptability, making it difficult to accurately identify and defend against new security threats. Summary of the Invention

[0006] In order to overcome the shortcomings of the prior art, at least one technical problem raised in the background art is solved.

[0007] The technical solution adopted by this invention to solve its technical problem is: a cloud security intrusion analysis method applied to industrial data processing, comprising:

[0008] Real-time edge detection: Deploy a lightweight bidirectional LSTM model on a 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a Dropout layer, and an output layer.

[0009] Standardize and preprocess the sensor time-series data:

[0010]

[0011] Where μ is the mean of the sliding window and σ is the standard deviation of the sliding window;

[0012] A level 3 alarm is triggered when the abnormal probability output is greater than 0.85 for 3 consecutive sampling periods, and a level 1 alarm is triggered when it is greater than 0.9 for 5 consecutive periods.

[0013] Cloud-based collaborative analysis: After receiving edge alarms, an industrial control system topology diagram is constructed. The node coding rules are as follows: PLC devices use the "IP_function code" format, and sensors use the "Modbus address_range" format.

[0014] The edge attributes include the communication protocol type, average transmission frequency, and number of historical anomalies.

[0015] The GraphSAGE algorithm was used for topology learning, with a sampling depth of 3, a number of neighbors of 8, and mean aggregation as the aggregation function.

[0016] Dynamic defense optimization: Threshold adjustment based on Double DQN, state space S = {Device operation phase, CPU load rate, network throughput, topology anomaly score}

[0017] reward function

[0018] Where TP is the number of true positive samples; FP is the number of false positive samples; and λ is the weighting coefficient.

[0019] A further improvement of the technical solution of the present invention is that: in the preprocessing of the real-time edge detection stage, the sliding window size is set to 10 sampling periods and the step size is 1 period.

[0020] A further improvement to the technical solution of this invention lies in the following: the LSTM model optimization specifically includes: the training data annotation adopts a three-level annotation system.

[0021] Level 1 labels are those that simultaneously satisfy both protocol exceptions and numerical out-of-bounds errors; Level 2 labels are those that are single exceptions lasting longer than 10 seconds; and Level 3 labels are those that are transient exceptions and self-recovering.

[0022] Focal Loss was used to handle class imbalance, with γ = 2.0 and α = 0.75.

[0023] A further improvement to the technical solution of the present invention is that the topology analysis further includes:

[0024] Dynamic partitioning strategy: If the number of nodes is greater than 150, partition by physical region, with each block containing 30-40 nodes; if the number of nodes is greater than 50 and less than or equal to 150, partition by functional module; otherwise, perform full graph analysis.

[0025] The formula for determining abnormal edges is:

[0026]

[0027] Among them, Score is the comprehensive judgment score of abnormal edges, which is used to measure the degree of abnormality of the edge. The higher the score, the more likely the edge is to be an abnormal edge.

[0028] x i Let i be the i-th feature value of the current edge, i.e., traffic size and connection frequency;

[0029] This is the average value or a statistical benchmark value of the feature value corresponding to this edge in historical data, used for comparison with the current feature value;

[0030] σ i The standard deviation of this feature value in historical data reflects the degree of dispersion of this feature value in historical data;

[0031] N abnormal This represents the number of abnormal protocols involved in the current edge;

[0032] N total This represents the total number of protocols involved in the current edge.

[0033] A further improvement to the technical solution of this invention is that the dynamic defense optimization also includes:

[0034] Experience replay buffer management:

[0035] The buffer capacity is 50,000 entries;

[0036] Prioritize sampling records with a TD error > 0.6;

[0037] Importance sampling weighting is performed every 1000 iterations;

[0038] The exploration strategy uses ∈-greedy, where ∈ decreases linearly from 0.5 to 0.1.

[0039] A further improvement to the technical solution of this invention is that it also includes privacy-preserving training.

[0040] Federated learning parameter aggregation uses the FedProx algorithm to process non-IID data, with a proximal term coefficient μ = 0.15;

[0041] Gradient clipping is performed before uploading the model gradients, with a threshold of L2 = 1.5;

[0042] The Paillier algorithm is used to encrypt the model parameters, supporting matrix dot addition operations in the ciphertext state, with a key length of 3072 bits. The operation formula is as follows:

[0043]

[0044] Here, Enc represents an encryption function used to convert plaintext data into ciphertext data;

[0045] A and B are plaintext data, which can be in the form of scalar, vector, or matrix data. In the context of matrix addition, A and B are matrices with the same dimension.

[0046] It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

[0047] A further improvement to the technical solution of the present invention is that the privacy protection training also includes:

[0048] Differential privacy protection: Rényi differential privacy (α=2) is adopted, and each training round satisfies ∈ epoch =0.08, δ=10 -6 ;

[0049] The formula for adding noise is:

[0050]

[0051] in, θ represents the model parameters after adding noise; θ represents the original model parameters, which are the parameter values ​​obtained during model training without adding noise; N represents the size of the dataset, i.e., the number of samples participating in training; C represents the parameter pruning boundary, which limits the range of parameter variation; δ represents the failure probability in differential privacy; ∈ Differential Privacy's privacy budget; N(0, σ 2 ) indicates that the mean is 0 and the variance is σ. 2 The Gaussian distribution.

[0052] A further improvement to the technical solution of this invention is that it also includes attack attribution tracing:

[0053] Source tracing analysis based on causal reasoning: Construct a directed graph of attack propagation, with nodes representing anomalous events; use Granger causality test to determine the correlation between events;

[0054] The formula for calculating the probability of output attack paths is:

[0055]

[0056] Where P represents the attack path probability, i.e., the probability of the entire attack path from the attack source to the target node occurring; n represents the number of edges in the directed graph of attack propagation, i.e., the total number of edges constituting the attack path; e i This represents the probability of an attack propagating along the i-th edge in the directed graph.

[0057] Dynamic forensic log generation: Record fields include nanosecond-level timestamps, device fingerprints, and operation context;

[0058] The logs are stored using a Merkle Patricia Tree, and blocks are generated every 5 minutes.

[0059] A further improvement to the technical solution of this invention is that it also includes a dynamic resource scheduling stage.

[0060] The resource allocation weights are calculated using the following formula:

[0061]

[0062] Where P represents task priority; S i Indicates the safety risk score, ω i The resource allocation weight of the i-th task is a value between 0 and 1, which determines the proportion of resources allocated to each task. The larger the weight, the more resources are allocated to it. n represents the total number of tasks, that is, the number of all tasks participating in the resource allocation. Represents all tasks The sum of values ​​is used to normalize the resource allocation weights of each task, ensuring that the sum of the weights of all tasks is 1.

[0063] Elastic scaling strategy: When CPU utilization is greater than 85% for 2 consecutive minutes, add 1 GPU instance;

[0064] Release redundant instances when CPU utilization is below 40% for 5 consecutive minutes.

[0065] A further improvement to the technical solution of this invention is that it also includes model self-evolution.

[0066] Online learning mechanism:

[0067] Set the confidence threshold θ = 0.9;

[0068] When the prediction confidence is greater than θ, it is automatically added to the training set;

[0069] Incremental update:

[0070] The model is updated weekly.

[0071] The knowledge distillation algorithm is used, with the teacher model weight α = 0.7 and the student model weight β = 0.3.

[0072] Beneficial effects

[0073] In real-time edge detection, lightweight models and standardized preprocessing are used to improve data processing efficiency; cloud-based collaborative analysis comprehensively analyzes the state of industrial control systems through topology learning and dynamic block partitioning strategies; dynamic defense optimization and privacy-preserving training enhance the system's security and privacy; attack tracing and dynamic resource scheduling further improve the system's reliability and resource utilization; and the model's self-evolution mechanism enables the system to adapt to constantly changing environments, thereby continuously improving the accuracy of analysis. Attached Figure Description

[0074] The invention will now be further described with reference to the accompanying drawings.

[0075] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] Please see Figure 1 ,

[0078] This embodiment provides: a cloud security intrusion analysis method applied to industrial data processing, including:

[0079] S1. Real-time edge detection: Deploy a lightweight bidirectional LSTM model on the 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a Dropout layer, and an output layer.

[0080] LSTM model optimization specifically includes: using a three-level annotation system for training data.

[0081] Level 1 labels are those that simultaneously satisfy both protocol exceptions and numerical out-of-bounds errors; Level 2 labels are those that are single exceptions lasting longer than 10 seconds; and Level 3 labels are those that are transient exceptions and self-recovering.

[0082] Focal Loss was used to handle class imbalance, with γ = 2.0 and α = 0.75.

[0083] Standardize and preprocess the sensor time-series data:

[0084]

[0085] Where μ is the mean of the sliding window and σ is the standard deviation of the sliding window;

[0086] In the preprocessing stage of real-time edge detection, the sliding window size is set to 10 sampling periods, and the step size is 1 period.

[0087] A level 3 alarm is triggered when the abnormal probability output is greater than 0.85 for 3 consecutive sampling periods, and a level 1 alarm is triggered when it is greater than 0.9 for 5 consecutive periods.

[0088] The lightweight model can detect and respond to anomalies in real time. The three-level labeling system improves the accuracy of anomaly identification. Focal Loss enhances the model's ability to learn from various anomalies. Standardized preprocessing and sliding windows help improve data quality and anomaly detection performance. Different levels of alerts allow staff to take appropriate measures based on the severity of the anomalies.

[0089] It should be noted that the training dataset mainly comes from historical sensor time-series data from industrial sites, covering data under normal production conditions and various abnormal conditions. Data augmentation methods include adding Gaussian noise and time warping. Adding Gaussian noise can simulate sensor measurement errors and enhance the model's robustness to noisy data. Time warping increases the temporal diversity of the data by changing the time series order. For calculating the anomaly probability, the output layer of the bidirectional LSTM model typically uses the Sigmoid function to map the output value to a range of 0-1; this output value is the anomaly probability. For example, the model predicts the data for each sampling period and outputs a value between 0 and 1. When this value is greater than a corresponding threshold, it is judged as an anomaly and an alarm is triggered.

[0090] S2. Cloud-based collaborative analysis: After receiving edge alarms, construct an industrial control system topology diagram. The node coding rules are as follows: PLC devices use the "IP_function code" format, and sensors use the "Modbus address_range" format.

[0091] The edge attributes include the communication protocol type, average transmission frequency, and number of historical anomalies.

[0092] The GraphSAGE algorithm was used for topology learning, with a sampling depth of 3, a number of neighbors of 8, and mean aggregation as the aggregation function.

[0093] Topology analysis also includes:

[0094] Dynamic partitioning strategy: If the number of nodes is greater than 150, partition by physical region, with each block containing 30-40 nodes; if the number of nodes is greater than 50 and less than or equal to 150, partition by functional module; otherwise, perform full graph analysis.

[0095] Furthermore, segmentation by physical region is suitable for large industrial plants where different physical regions have relatively independent functions. After segmentation, local analysis can be performed within each region, reducing the amount of computation and facilitating monitoring and management by regional managers. Segmentation by functional module is suitable for industrial systems with clear functional divisions, such as multiple devices in a production process forming a functional module. After segmentation, in-depth analysis can be performed on specific functions, improving the accuracy of anomaly detection. Full graph analysis is suitable for industrial control systems with a small number of nodes or a relatively simple system structure, enabling a comprehensive understanding of the overall system status.

[0096] The formula for determining abnormal edges is:

[0097]

[0098] Among them, Score is the comprehensive judgment score of abnormal edges, which is used to measure the degree of abnormality of the edge. The higher the score, the more likely the edge is to be an abnormal edge.

[0099] x i Let i be the i-th feature value of the current edge, i.e., traffic size and connection frequency;

[0100] This is the average value or a statistical benchmark value of the feature value corresponding to this edge in historical data, used for comparison with the current feature value;

[0101] σ i The standard deviation of this feature value in historical data reflects the degree of dispersion of this feature value in historical data;

[0102] N abnormal This represents the number of abnormal protocols involved in the current edge;

[0103] N total This represents the total number of protocols involved in the current edge.

[0104] Topology graph construction and attribute definition help to fully understand the structure of industrial control systems. The GraphSAGE algorithm can effectively extract topological features. The dynamic block strategy can flexibly adjust the analysis method according to the system scale, improving analysis efficiency. The abnormal edge comprehensive judgment formula provides a quantitative standard for accurately identifying abnormal edges, which helps to discover potential security threats in the system in a timely manner.

[0105] It should be noted that the topology graph construction algorithm and process are as follows: A topology graph is constructed using network scanning and device configuration information collection. First, network scanning tools are used to discover nodes such as PLC devices and sensors in the industrial control system, and their basic information, such as IP addresses, is obtained. Then, based on the device configuration information, such as the PLC's function code, the sensor's address and range, they are encoded according to predetermined node encoding rules. For edge construction, the communication connections between devices are determined, and edge attributes are obtained by analyzing communication logs and historical data statistics between devices. For the initial screening of abnormal edges, a threshold can be set based on the number of historical anomalies in the edge attributes. When the number of historical anomalies exceeds this threshold, the edge is marked as a suspicious abnormal edge, and further comprehensive judgment is performed.

[0106] S3, Dynamic Defense Optimization:

[0107] S31: Threshold adjustment based on Double DQN, state space S = {Device operation phase, CPU load rate, network throughput, topology anomaly score}

[0108] S32: Dynamic defense optimizations also include:

[0109] Experience replay buffer management:

[0110] The buffer capacity is 50,000 entries;

[0111] Prioritize sampling records with a TD error > 0.6;

[0112] Importance sampling weighting is performed every 1000 iterations;

[0113] The exploration strategy employs ∈-greedy, where ∈ decreases linearly from 0.5 to 0.1.

[0114] Furthermore, the TD error (time-series difference error) is calculated by comparing the estimated current Q value with the actual return, using the following formula: Where r is the immediate reward, γ is the discount factor, s is the current state, a is the current action, and s' is the next state. The exploration strategy uses ∈-greedy, with an initial ∈ value of 0.5, which linearly decays to 0.1 as the number of iterations increases. This means that in the early stages of training, the model has a higher probability of random exploration to fully learn the action value in different states; as training progresses, the exploration ratio is gradually reduced, and more of the learned knowledge is used for decision-making, improving the model's stability.

[0115] reward function

[0116] Where TP is the number of true positive samples; FP is the number of false positive samples; and λ is the weighting coefficient.

[0117] Double DQN can adjust the defense threshold in real time according to the system status, improving the targeting of defense; experience replay buffer management optimizes the model learning process, improving learning efficiency and stability; the reward function enables the model to learn more effective defense strategies, improving the overall security of the system.

[0118] It's worth noting that DoubleDQN is an improvement on DQN, aiming to address the problem of overestimating Q-values ​​in DQN. It uses two Q-networks with identical structures but different parameters: one for selecting actions and the other for evaluating the value of those actions. In this method, the state space S contains information such as device operating phase, CPU load, network throughput, and topology anomaly scores. DoubleDQN selects the optimal defense action based on the current state, such as adjusting security thresholds. By continuously interacting with the environment and updating network parameters according to the reward function, it learns the optimal defense strategy.

[0119] S4. Privacy Protection Training:

[0120] S41: Federated learning parameter aggregation uses the FedProx algorithm to process non-IID data, with a proximal term coefficient μ = 0.15;

[0121] It is worth mentioning that the specific algorithm steps for parameter aggregation in federated learning are as follows: During the federated learning process, each participant (such as different industrial equipment or edge nodes) trains the model locally and uploads the model gradient to the cloud. The cloud uses the FedProx algorithm to aggregate the parameters. First, the uploaded gradient is constrained by a proximal term with a proximal term coefficient μ = 0.15. This proximal term helps to maintain the similarity between the aggregated model and each local model. Then, the gradients are weighted and averaged according to certain weights. The weights can be allocated according to the amount of data or importance of the participants, and finally, the aggregated model parameters are obtained.

[0122] Gradient clipping is performed before uploading the model gradients, with a threshold of L2 = 1.5;

[0123] The Paillier algorithm is used to encrypt the model parameters, supporting matrix dot addition operations in the ciphertext state, with a key length of 3072 bits. The operation formula is as follows:

[0124]

[0125] Here, Enc represents an encryption function used to convert plaintext data into ciphertext data;

[0126] A and B are plaintext data, which can be in the form of scalar, vector, or matrix data. In the context of matrix addition, A and B are matrices with the same dimension.

[0127] It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

[0128] Privacy protection training also includes:

[0129] S42: Differential Privacy Guarantee: Rényi differential privacy (α = 2) is adopted, and each training round satisfies ∈ epoch =0.08, δ=10 -6 ;

[0130] The formula for adding noise is:

[0131]

[0132] in, θ represents the model parameters after adding noise; θ represents the original model parameters, which are the parameter values ​​obtained during model training without adding noise; N represents the size of the dataset, i.e., the number of samples participating in training; C represents the parameter pruning boundary, which limits the range of parameter variation; δ represents the failure probability in differential privacy; ∈ Differential Privacy's privacy budget; N(0, σ 2 ) indicates that the mean is 0 and the variance is σ. 2 The Gaussian distribution.

[0133] Furthermore, the choice between privacy budget and failure probability requires a comprehensive consideration of both the strength of privacy protection and data availability. Smaller values ​​for privacy budget and failure probability can provide stronger privacy protection but may reduce data availability, leading to a decline in model performance; larger values ​​have the opposite effect. In practical applications, appropriate parameters need to be selected based on the sensitivity of the industrial data and the model's requirements for data accuracy. For example, for highly sensitive industrial data, smaller values ​​for privacy budget and failure probability can be chosen to maximize privacy protection; for model training with high data accuracy requirements, a trade-off must be struck between privacy protection and data availability.

[0134] Federated learning addresses the issues of data fragmentation and privacy. Parameter aggregation methods improve model performance by handling non-IID data. Gradient pruning and encryption algorithms safeguard data privacy, while differential privacy provides stronger privacy protection, ensuring that sensitive information in industrial data is not leaked and meeting industrial data security requirements.

[0135] S5, Attack Origin Tracing:

[0136] S51: Source analysis based on causal reasoning:

[0137] Construct a directed graph of attack propagation, with nodes representing anomalous events; use Granger causality testing to determine the correlation between events;

[0138] The formula for calculating the probability of output attack paths is:

[0139]

[0140] Where P represents the attack path probability, i.e., the probability of the entire attack path from the attack source to the target node occurring; n represents the number of edges in the directed graph of attack propagation, i.e., the total number of edges constituting the attack path; e i This represents the probability of an attack propagating along the i-th edge in the directed graph.

[0141] Furthermore, the Granger causality test is employed to determine the causal relationship between events by analyzing the predictive relationship between two time series data. The specific steps are as follows: two time series models are established: one is an autoregressive model containing only its own historical information, and the other includes its own historical information as well as historical information from other variables. By comparing the predictive accuracy of the two models, if the predictive accuracy of the model significantly improves after incorporating historical information from other variables, a Granger causal relationship is considered to exist between that variable and the predicted variable. The judgment criterion is usually determined using an F-test or likelihood ratio test; when the test statistic exceeds a certain critical value, a causal relationship is considered to exist.

[0142] S52: Dynamic forensic log generation:

[0143] The record fields include nanosecond-level timestamps, device fingerprints, and operation context;

[0144] The logs are stored using a Merkle Patricia Tree, and blocks are generated every 5 minutes.

[0145] Directed graphs of attack propagation and causal verification help to accurately trace the source and path of attacks, attack path probability calculations provide a basis for defense decisions, and dynamic forensic logs provide reliable data support for post-event analysis and auditing, which helps to improve the security and maintainability of the system.

[0146] S6, Dynamic Resource Scheduling Phase:

[0147] S61: Calculate resource allocation weights using the following formula:

[0148]

[0149] Where P represents task priority; S i Indicates the safety risk score, ω i The resource allocation weight of the i-th task is a value between 0 and 1, which determines the proportion of resources allocated to each task. The larger the weight, the more resources are allocated to it. n represents the total number of tasks, that is, the number of all tasks participating in the resource allocation. Represents all tasks The sum of values ​​is used to normalize the resource allocation weights of each task, ensuring that the sum of the weights of all tasks is 1.

[0150] It is important to note that task priorities can be assessed based on the importance and urgency of the tasks. For example, tasks related to critical production processes are given higher priority, while some auxiliary tasks are given lower priority. The safety risk score takes into account factors such as the data sensitivity and operational permissions involved in the task. Tasks involving core process parameters and high-level operations are given higher safety risk scores. The resource allocation weight is determined by a calculation formula based on the task priority and safety risk score, and then the computing resources are allocated to each task according to the weight ratio.

[0151] S62: Flexible scaling strategy:

[0152] If CPU utilization is greater than 85% for 2 consecutive minutes, add 1 GPU instance;

[0153] Release redundant instances when CPU utilization is below 40% for 5 consecutive minutes.

[0154] Furthermore, adding a GPU instance when CPU utilization exceeds 85% for two consecutive minutes can improve the system's computing power, meet sudden computing demands, and prevent task delays or failures due to insufficient resources. However, adding GPU instances increases costs. Releasing redundant instances when CPU utilization is below 40% for five consecutive minutes can save resource costs, but if the threshold is set too low, it may lead to frequent instance releases and starts, affecting system stability. Therefore, the CPU utilization threshold needs to be adjusted reasonably based on the actual workload and cost budget of the industrial control system.

[0155] The resource allocation weighting formula enables the rational allocation of resources, improving system operating efficiency. The elastic scaling strategy dynamically adjusts resources according to system load, avoiding resource waste and shortages, reducing costs, and ensuring stable system operation under different loads.

[0156] S7. Model self-evolution:

[0157] S71: Online learning mechanism:

[0158] Set the confidence threshold θ = 0.9;

[0159] When the prediction confidence is greater than θ, it is automatically added to the training set;

[0160] It's important to explain the data selection and processing methods used in the online learning mechanism: During online learning, when the prediction confidence level is greater than θ = 0.9, the corresponding data is added to the training set. Before adding it to the training set, the data needs to be cleaned and preprocessed to remove noisy data and outliers. Simultaneously, the data is standardized or normalized to ensure it has a uniform scale, facilitating model training. For newly added data, data augmentation methods, such as random rotation and translation, can be used to increase data diversity.

[0161] S72: Incremental Update:

[0162] The model is updated weekly.

[0163] The knowledge distillation algorithm is used, with the teacher model weight α = 0.7 and the student model weight β = 0.3.

[0164] Online learning mechanisms enable models to adapt to the ever-changing security environment and improve their ability to detect new types of attacks. Knowledge distillation algorithms reduce computational and storage requirements while ensuring model performance, enabling models to continuously evolve and improving the long-term security of the system.

[0165] The terms "front," "back," "left," "right," "top," and "bottom" all refer to the figures in the accompanying drawings. Figure 1 Based on the perspective of the observer, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0166] In the description of this invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting the scope of protection of this invention.

[0167] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A cloud security intrusion analysis method applied to industrial data processing, characterized in that, include: Real-time edge detection: Deploy a lightweight bidirectional LSTM model on a 5G smart gateway. The model structure consists of a 64-unit input layer, a 32-unit bidirectional LSTM layer, a Dropout layer, and an output layer. Standardize and preprocess the sensor time-series data: ； in, The mean of the sliding window. The standard deviation of the sliding window; A level 3 alarm is triggered when the abnormal probability output is greater than 0.85 for 3 consecutive sampling periods, and a level 1 alarm is triggered when it is greater than 0.9 for 5 consecutive periods. The output layer of a bidirectional LSTM model typically uses the Sigmoid function to map the output value to a range of 0-1, and this output value is the anomaly probability. Cloud-based collaborative analysis: After receiving edge alarms, a topology diagram of the industrial control system is constructed. The node coding rules are as follows: PLC devices use the format "IP_function code", and sensors use "...". The format is "address_range"; The edge attributes include the communication protocol type, average transmission frequency, and number of historical anomalies. The initial screening of abnormal edges is based on a threshold set according to the number of historical anomalies in the edge attributes. When the number of historical anomalies exceeds the threshold, the edge is marked as a suspicious abnormal edge, and then a comprehensive judgment is made. The formula for determining abnormal edges is: ； in, The score is used to determine the degree of abnormality of an edge. The higher the score, the more likely the edge is to be abnormal. Let i be the i-th feature value of the current edge, i.e., traffic size and connection frequency; This is the average or statistical benchmark value of the feature value corresponding to this edge in historical data, used for comparison with the current feature value; The standard deviation of this feature value in historical data reflects the degree of dispersion of this feature value in historical data; This represents the number of abnormal protocols involved in the current edge; This represents the total number of protocols involved in the current edge; use The algorithm performs topology learning, with a sampling depth of 3, a neighbor count of 8, and mean aggregation as the aggregation function. Dynamic defense optimization: Threshold adjustment based on Double DQN, state space S = {Device operation phase, CPU load rate, network throughput, topology anomaly score} reward function ; Where TP represents the number of true positive samples; FP represents the number of false positive samples; These are the weighting coefficients; DoubleDQN selects the optimal defense action based on the current state, and learns the optimal defense strategy by continuously interacting with the environment and updating network parameters according to the reward function.

2. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: In the preprocessing stage of the real-time edge detection, the sliding window size is set to 10 sampling periods, and the step size is 1 period.

3. The cloud security intrusion analysis method for industrial data processing according to claim 2, characterized in that: The LSTM model optimization specifically includes: A three-level annotation system is used for training data labeling. Level 1 labels are those that simultaneously satisfy both protocol exceptions and numerical out-of-bounds errors; Level 2 labels are those that are single exceptions lasting longer than 10 seconds; and Level 3 labels are those that are transient exceptions and self-recovering. Focal Loss is used to handle class imbalance, and settings are set. =2.0, =0.

75.

4. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: Topology analysis includes: Dynamic partitioning strategy: If the number of nodes is greater than 150, partition by physical region, with each block containing 30-40 nodes; if the number of nodes is greater than 50 and less than or equal to 150, partition by functional module; otherwise, perform full graph analysis.

5. A cloud security intrusion analysis method for industrial data processing according to claim 4, characterized in that: The dynamic defense optimization also includes: Experience replay buffer management: The buffer capacity is 50,000 entries; Prioritize sampling records with a TD error > 0.6; Importance sampling weighting is performed every 1000 iterations; Exploration strategy adopted , It decreases linearly from 0.5 to 0.

1.

6. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: It also includes privacy protection training: Federated learning parameter aggregation adopts Algorithm for processing non-IID data, proximal term coefficients =0.15; Gradient clipping is performed before uploading model gradients, with a threshold value. =1.5; use The algorithm's encryption model parameters support matrix dot addition operations in ciphertext, with a key length of 3072 bits. The calculation formula is as follows: ； Here, Enc represents an encryption function used to convert plaintext data into ciphertext data; and The data is plaintext and can be in scalar, vector, or matrix form. In the context of matrix addition, and They are matrices of the same dimension; It is an operation symbol on ciphertext, used to perform addition-like operations on ciphertext, and satisfies the above correspondence with plaintext addition.

7. A cloud security intrusion analysis method for industrial data processing according to claim 6, characterized in that: The privacy protection training also includes: differential privacy protection: employing... Differential privacy Each round of training satisfies , ; The formula for adding noise is: ； in, This represents the model parameters after adding noise; This represents the original model parameters, which are the parameter values ​​obtained during model training without adding noise; This indicates the size of the dataset, i.e., the number of samples used in training; It represents the clipping boundary of the parameter, limiting the range of parameter variation; This represents the failure probability in differential privacy; Privacy budgeting for differential privacy; This indicates that the mean is 0 and the variance is . The Gaussian distribution.

8. The cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: It also includes attack attribution: Source tracing analysis based on causal reasoning: Constructing a directed graph of attack propagation, with nodes representing anomalous events; employing... Causality tests determine the correlation between events; The formula for calculating the probability of output attack paths is: ； in, This represents the probability of an attack path, i.e., the probability of the entire attack path from the attack source to the target node occurring. This represents the number of edges in the directed graph of attack propagation, that is, the total number of all edges that constitute the attack path; This represents the th element in the directed graph representing attack propagation. The probability of an edge; Dynamic forensic log generation: Record fields include nanosecond-level timestamps, device fingerprints, and operation context; use Store logs and generate blocks every 5 minutes.

9. A cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: It also includes a dynamic resource scheduling phase: The resource allocation weights are calculated using the following formula: ； in, Indicates task priority; Indicates the safety risk score. This represents the resource allocation weight of the i-th task. It is a value between 0 and 1, used to determine the proportion of resources allocated to each task. The larger the weight, the more resources are allocated to it. This represents the total number of tasks, that is, the total number of all tasks involved in resource allocation; Represents all tasks The sum of values ​​is used to normalize the resource allocation weights of each task, ensuring that the sum of the weights of all tasks is 1. Elastic scaling strategy: When CPU utilization is greater than 85% for 2 consecutive minutes, add 1 GPU instance; Release redundant instances when CPU utilization is below 40% for 5 consecutive minutes.

10. A cloud security intrusion analysis method for industrial data processing according to claim 1, characterized in that: It also includes model self-evolution: Online learning mechanism: Set confidence threshold =0.9; When the prediction confidence is greater than When the time comes, it will be automatically added to the training set; Incremental update: The model is updated weekly. The knowledge distillation algorithm is used, and the teacher model weights are... =0.7, Student Model =0.3.

Images