Network security communication method and system based on commercial password

Abstract

The invention belongs to the technical field of industrial network security communication, and particularly relates to a network security communication method and system based on a commercial password, and the method comprises the steps: obtaining a historical data sequence and a real-time target data sequence; generating adversarial data and a sequence in combination with historical data; and calculating the confrontation disturbance degree according to the similarity and difference between the historical data and the confrontation data. Inputting the adversarial data sequence into a discriminator A as a to-be-detected sequence, and calculating a to-be-detected anomaly index according to byte feature differences; and calculating the accuracy and error degree of the discriminator A according to the difference between the confrontation disturbance degree and the index and the confrontation degree of the adjacent data of the sequence to be detected and the fluctuation consistency of the abnormal index. And inputting the accuracy and the error degree into discriminators B and C, and obtaining a false distinguishing model through multiple game iterations. And inputting the target data into the model to calculate a target anomaly index, and performing encryption according to the security level. According to the invention, the problem of insufficient adaptability and dynamic property of intrusion data identification in the prior art is solved.

Description

Technical Field

[0001] This invention relates to the field of industrial network security communication technology. More specifically, this invention relates to a network security communication method and system based on commercial cryptography. Background Technology

[0002] With the deep integration of the Industrial Internet and intelligent manufacturing, real-time communication between equipment in industrial scenarios such as high-end CNC machine tool clusters has become a core support for production efficiency and precision. Workshop operating condition data usually contains a large amount of sensitive information, such as equipment parameters, temperature, and tool pressure. During transmission, this data is typically encrypted using commercial cryptographic technologies.

[0003] However, due to intense commercial competition, attackers often tamper with data through multiple means, including direct access to industrial equipment, exploiting industrial network vulnerabilities, and attacking data platforms and accounts. Tampered operational data, such as altered tool compensation parameters or false temperature or pressure readings, can lead to decreased machining accuracy, batch scrapping of parts, and even equipment collisions if used as normal data for production decisions, resulting in significant economic losses. The tampering process involves subtle alterations to multiple operational data points, making individual data points appear normal, but causing overall deviations in the production process. Traditional encryption-based detection methods struggle to detect these subtle alterations.

[0004] To address the difficulty in detecting subtle alterations to operating data, existing technologies based on machine learning and deep learning improve the accuracy and efficiency of identifying anomalous data by building models from a large amount of normal operating data. However, their strong reliance on massive amounts of high-quality normal data contradicts the characteristics of industrial data, which often contains noise and missing data. This makes it difficult for the models to function stably in actual production, and they are also unable to identify new attack patterns in a timely manner, requiring retraining and updates, and failing to meet the real-time and dynamic requirements of industrial production. Summary of the Invention

[0005] To address the technical problems of insufficient adaptability and dynamism in identifying intrusion data in the prior art, the present invention provides solutions in the following aspects.

[0006] In a first aspect, the present invention provides a network security communication method based on commercial cryptography, comprising: Historical operating condition data representing the same type of time period in the workshop are recorded as historical data sequences, and real-time operating condition data of the same type are recorded as target data sequences. The historical data sequences and target data sequences include the byte frequency, adjacent bytes, and byte percentage of the corresponding data. Based on the fluctuation level of the historical data sequences, random perturbation is applied to the historical data sequences to generate adversarial data and adversarial data sequences. The degree of adversarial perturbation is calculated based on the similarity between the historical data sequences and adversarial data sequences, combined with the size difference between the historical data and adversarial data. The adversarial data sequences are input into discriminator A and recorded as the test sequence. Based on the test... The anomaly index is calculated based on the differences in byte frequency, adjacent bytes, and byte proportion of the sequence. The accuracy of discriminator A is calculated based on the difference between the degree of adversarial perturbation and the anomaly index. The error of discriminator A is calculated based on the consistency between the adversarial degree of adjacent data in the sequence and the fluctuation of the anomaly index. The accuracy and error of discriminator A are input into discriminators B and C. After multiple games and iterations, discriminators A, B, and C are adjusted to obtain the counterfeit detection model. The target data is input into the counterfeit detection model to calculate the target anomaly index. Security levels are then classified according to the target data type, and corresponding encryption algorithms are applied.

[0007] This invention effectively solves the problem of difficulty in identifying subtle data anomalies in existing technologies. By generating adversarial data that closely resembles real-world scenarios, it provides ample training samples for the identification tool, eliminating the need to rely on massive amounts of historical normal data. Even with some interference or missing data, it can accurately identify anomalies. Furthermore, by comprehensively judging data anomalies from multiple perspectives and continuously optimizing the model, it can promptly detect newly emerging anomaly patterns without frequent readjustments. The entire process is highly efficient and rapid, meeting the real-time data processing requirements of industrial production. It ensures that various subtle problems arising during data transmission can be detected and addressed promptly, guaranteeing the security of data communication.

[0008] Preferably, the adversarial data satisfies the following expression: ; In the formula, This is the i-th adversarial data; This represents the i-th historical data point in the historical data sequence; n represents the number of historical data points in the historical data sequence. This represents the historical data mean of a historical data series. This represents the random perturbation coefficient of the i-th historical data in the historical data sequence, and the random perturbation coefficient is randomly generated within the range of [-1, 1]. Represents the absolute value function; This represents the normalization function.

[0009] The method of generating adversarial data in this invention combines the overall fluctuations of historical data with appropriate random variations. The generated adversarial data is related to the original historical data but also possesses certain anomalous characteristics, much like simulating various subtle changes that might occur in real-world data. Such adversarial data can provide more realistic samples for subsequent anomaly identification, allowing tools used to identify anomalies to encounter various potential problematic data in advance, thus enabling them to more accurately detect anomalies in actual use.

[0010] Preferably, the degree of resistance to disturbance satisfies the following expression: ; In the formula, Indicates the degree of resistance to disturbance; This represents the correlation between a historical data sequence of length j and an adversarial data sequence of length j; n represents the number of data points in the historical data sequence and the adversarial data sequence. This represents the i-th adversarial data in the adversarial data sequence; This represents the i-th historical data point in the historical data sequence. Represents the absolute value function; Represents an exponential function with the natural constant as the base; This represents the normalization function.

[0011] This invention calculates the degree of adversarial perturbation by considering both the overall similarity of historical and adversarial data and the differences in individual data points. This approach avoids the one-sidedness of focusing solely on whether a single data point is abnormal, and also prevents the overlooking of local anomalies simply because the overall data appears similar.

[0012] Preferably, the calculation of the anomaly index to be tested includes: Obtain the entropy, variance, and percentage of the byte to be tested; The anomaly index to be tested satisfies the following expression: ; In the formula, This represents the anomaly index of the i-th data point in the test sequence; , , This represents the entropy, variance, and percentage of the i-th data in the test sequence. , , This represents the mean entropy, mean variance, and mean percentage of the tested bytes in the sequence under test. Represents the absolute value function; This represents the normalization function.

[0013] Preferably, the entropy, variance, and percentage of the byte to be tested are obtained, including: The adversarial data sequence is input into discriminator A and denoted as the test sequence. Discriminator A converts the test sequence into a byte array and then into a test byte array. The frequency of each byte in the test byte array is counted and denoted as the test byte frequency. The test byte frequencies of all test sequences are extracted and the entropy value is calculated and denoted as the test byte entropy. The variance of adjacent bytes of the test data in the test byte array is calculated and denoted as the test variance. The proportion of 0x00 bytes and 0xFF bytes in the test data in the test byte array is calculated to obtain the test byte proportion.

[0014] Preferably, the accuracy of discriminator A includes: ; In the formula, This represents the accuracy of discriminator A; n represents the number of data points in the test data sequence. This indicates the degree of resistance to perturbation of the i-th data point in the data sequence. This represents the anomaly index of the i-th data point in the data sequence to be tested. Represents the absolute value function; This represents an exponential function with the natural constant as its base.

[0015] This invention calculates the accuracy of the judgment tool by comparing the degree of anomaly in the adversarial data with the judged anomaly index, clearly revealing the tool's accuracy. A small difference indicates accurate judgment, while a large difference suggests room for improvement. This method objectively reflects the tool's performance, helps identify its shortcomings, and allows for targeted adjustments, enabling the tool to more accurately identify anomalies in subsequent uses.

[0016] Preferably, calculating the error of discriminator A includes: Extract the adversarial degree sequence and the test anomaly index sequence. Calculate the difference in adversarial perturbation degree between adjacent test data of the i-th test data, denoted as adversarial perturbation degree fluctuation. Calculate the difference in test anomaly index between adjacent test data of the i-th test data, denoted as test anomaly index fluctuation. Calculate the difference between the ratio of adversarial perturbation degree fluctuation to test anomaly index fluctuation and 1, and take a positive absolute value to indicate whether the adversarial degree of adjacent data of the i-th test data and the fluctuation trend of the test anomaly index are consistent, denoted as the fluctuation consistency of the i-th test data. Calculate the fluctuation consistency of all test data and calculate the mean, denoted as the error of discriminator A.

[0017] Preferably, the model for obtaining the counterfeit detection includes: The accuracy and error of discriminator A are simultaneously input into discriminators B and C. Discriminators B and C engage in multiple games, and the method of discriminator A is iteratively adjusted. Finally, a discriminator model with extremely high discriminator accuracy is obtained. The discriminator model includes discriminator A, which is used to judge the degree of abnormality of the test data, and discriminators B and C, which improve the discriminator A's discrimination accuracy through continuous games.

[0018] This invention achieves a final falsification detection model through the interplay and continuous adjustment of multiple judgment tools, allowing the model to continuously optimize in the competitive process. Each judgment tool drives model improvement from different angles, enabling the model to accurately identify anomalies in individual data points while also stably judging changes in continuous data. The resulting model can adapt to various complex situations and accurately identify different types of anomalous data, significantly improving its reliability and adaptability in practical applications.

[0019] Preferably, the calculation of the target anomaly index includes: The target data is input into the anti-spoofing model, and the anomaly index of the target data is calculated and recorded as the target anomaly index. A first threshold is preset. If the target anomaly index is greater than or equal to the first threshold, the target data is considered to be fake data and is marked. If the target anomaly index is less than the first threshold, the target data is treated as normal data and classified according to the security level.

[0020] Secondly, the present invention provides a network security communication system based on commercial cryptography, including a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the aforementioned network security communication method based on commercial cryptography is implemented.

[0021] By adopting the above technical solution, a computer program is generated from the above-mentioned network security communication method based on commercial cryptography and stored in the memory so that it can be loaded and executed by the processor. In this way, a terminal device can be made based on the memory and the processor for convenient use.

[0022] In industrial production, data communication security between devices is paramount, and this invention provides reliable protection in this field. It can keenly detect subtle data alterations, preventing these alterations from causing production errors such as parts scrapping or equipment damage, thus reducing economic losses. Simultaneously, by rationally classifying security levels and handling them accordingly, it ensures security without affecting data transmission efficiency, making the production process smoother. This method adapts to the complexities of data in industrial scenarios, can function stably over the long term, provides strong support for the secure use of data in industry, and helps promote safer and more efficient industrial production. Attached Figure Description

[0023] Figure 1This is a flowchart illustrating a network security communication method based on commercial cryptography according to the present invention; Figure 2 This is a schematic diagram illustrating the structure of the counterfeit detection model in this invention – the architecture diagram of discriminators A, B, and C. Detailed Implementation

[0024] This invention discloses a network security communication method based on commercial cryptography, referring to... Figure 1 This includes steps S1-S4: S1: Obtain historical data sequences and target data sequences.

[0025] It should be noted that this invention is primarily applied to network communication environments for equipment such as CNC machine tools in industrial workshops. In these scenarios, equipment needs to transmit large amounts of operational data in real time. This data directly affects production accuracy and efficiency; for example, tool compensation parameters affect part machining dimensions, and cutting force data reflects the equipment's operating status. Due to the continuous nature of the production process, data transmission must be highly efficient and real-time, without significant delays caused by security checks. Furthermore, this data often contains core equipment information, making it a target for tampering. Tampering often involves subtle adjustments, which may be difficult to detect when examining a single data point, but can accumulate and lead to serious production problems. This invention simulates real data tampering, identifies anomalies from multiple dimensions, utilizes a game-like competition between discriminators to dynamically optimize and form a counterfeit detection model, and combines this with commercial cryptographic encryption. This ensures real-time communication while accurately intercepting abnormal data, meeting the dual requirements of safety and efficiency in industrial production.

[0026] It should be noted that dividing the same type of working condition data into independent historical data sequences and target data sequences is because different types of data, such as the fluctuation patterns and byte distribution characteristics of tool compensation parameters and cutting time under normal working conditions, are different. Processing them separately can avoid interference between data with different characteristics, and make subsequent anomaly analysis more in line with the actual characteristics of each type of data.

[0027] Specifically, data such as tool compensation parameters, cutting forces, and cutting times for a certain period are obtained from the historical database of CNC machine tools. This data, representing the same type of historical operating conditions over a specific time period, is recorded as a historical data sequence. Similarly, data on tool compensation parameters, cutting forces, and cutting times during a specific period of the machining process are collected in real-time, and this real-time operating condition data is recorded as a target data sequence. Both the historical and target data sequences contain information such as the byte frequency, adjacent bytes, and byte percentage of the corresponding data. It should be noted that the byte frequency, adjacent bytes, and byte percentage information contained in the historical and target data sequences directly reflect the underlying data structure. Even if the numerical changes on the data surface are subtle, these byte-level characteristics may exhibit anomalies, providing crucial evidence for identifying seemingly normal but tampered data.

[0028] S2: Combining the volatility of historical data sequences, randomly perturb the historical data sequences to generate adversarial data and adversarial data sequences; based on the similarity between historical data sequences and adversarial data sequences, and combined with the size difference between historical data and adversarial data, calculate the degree of adversarial perturbation.

[0029] It should be noted that the core purpose of generating adversarial data sequences is to simulate data tampering injected by attackers and noise interference in transmission links that may occur in industrial scenarios. These anomalous data often have a high degree of similarity to normal historical data, such as a consistent overall trend but with subtle local deviations, which are difficult to effectively identify directly using simple thresholds. Therefore, this step generates adversarial data by controlling the perturbation of historical data, so that it retains the basic characteristics of historical data while including a specific degree of perturbation.

[0030] Specifically, extract any historical data sequence, preset a sliding window with a window size of 'a' data points and a sliding window movement step of 'a' data points; combine the variance of the data in the sliding window to calculate the fluctuation degree of the data in the sliding window, denoted as the window fluctuation degree; calculate the window perturbation coefficient based on the window fluctuation degree; combine the window perturbation coefficient with the window where the historical data is located to obtain the perturbation coefficient of all data in the historical data sequence; calculate each perturbed historical data in the historical data sequence, denoted as adversarial data.

[0031] It should be noted that performing local analysis of historical data sequences and generating adversarial data through a sliding window is to make the perturbation characteristics of the adversarial data more closely match the local temporal characteristics of data in industrial scenarios. The operating data of CNC machine tools often exhibit different fluctuation patterns at different machining stages. For example, the cutting force fluctuates significantly during the roughing stage, while it remains relatively stable during the finishing stage.

[0032] It should be noted that operating data naturally fluctuates due to material differences, equipment vibration, and environmental changes, and attackers often subtly tamper with parameters. To accurately simulate real threats, when constructing adversarial data, we first use the average fluctuation level of historical data as a basis to ensure that the adversarial data conforms to normal production characteristics and does not deviate from a reasonable range. Then, we normalize the fluctuation scale of different data to avoid unfair perturbations caused by differences in the absolute values ​​of large and small data. Next, we use random perturbations of [-1,1] to cover the tampering methods of attackers adjusting the data upwards or downwards. Finally, we adjust the original data ratio to generate adversarial data, making the perturbations as subtle and covert as real attacks.

[0033] Adversarial data satisfies the following expression: ; In the formula, This is the i-th adversarial data; This represents the i-th historical data point in the historical data sequence; n represents the number of historical data points in the historical data sequence. This represents the historical data mean of a historical data series. This represents the random perturbation coefficient of the i-th historical data in the historical data sequence, and the random perturbation coefficient is randomly generated within the range of [-1, 1]. Represents the absolute value function; This represents the normalization function.

[0034] In the formula, This represents the difference between the i-th data point in the historical data sequence and the mean of the historical data sequence. This represents the average difference between all historical data points in a historical data series and the mean of the historical data series. It is used to describe the degree of volatility of the historical data series; that is, the larger this value is, the greater the volatility of the historical data. This represents the product of the volatility of a historical data sequence and the random disturbance coefficient, i.e., the disturbance level value. The greater the volatility of the historical data sequence, the greater the degree to which the historical data sequence is disturbed by the random disturbance threshold. This represents the perturbated data, also known as adversarial data. Adversarial data is composed of historical data plus the product of the perturbation level and the historical data. It should be noted that the random perturbation coefficient is limited to [-1, 1] to ensure that the perturbation direction is random, so that the adversarial data covers both positive and negative tampering scenarios. This provides comprehensive anomalous data samples for subsequent training of the fake data detection model, ensuring that the model can identify various potential attacks or anomalous data.

[0035] Preferably, adversarial data corresponding to all historical data in the historical data sequence is calculated, and this adversarial data is recorded as an adversarial data sequence. It should be noted that by integrating the adversarial data corresponding to all historical data into an adversarial data sequence, a comparison sample set with the same structure as the historical data sequence is constructed. Its sequence form retains temporal characteristics and is adapted to the continuity and correlation of CNC machine tool operating data.

[0036] At this point, the adversarial data sequence has been obtained.

[0037] It should be noted that the correlation patterns of CNC machine tool operating data differ between short-cycle (single-process) and long-cycle (full-day) production. Integrating correlations across multiple timeframes allows for a more comprehensive assessment of the overall similarity between adversarial data sequences and historical data sequences. By converting the overall similarity into an adversarial degree index, and then multiplying it by the normalized deviation of individual data points, the degree of adversarial perturbation in the data is ultimately obtained.

[0038] Preferably, historical data sequences and perturbation data sequences are acquired, and the same data points in the historical data sequences and perturbation data sequences are aligned; the correlation between the historical data sequences and perturbation data sequences at different lengths is calculated using the Pearson correlation coefficient, and denoted as the correlation between the historical data sequences and perturbation data sequences; the deviation degree of the adversarial data sequence is calculated; based on the deviation degree of the adversarial data sequence and combined with the characteristics of historical data, the perturbation degree of the adversarial data is calculated, and denoted as the adversarial perturbation degree.

[0039] The degree of resistance to disturbances satisfies the following expression: ; In the formula, Indicates the degree of resistance to disturbance; This represents the correlation between a historical data sequence of length j and an adversarial data sequence of length j; n represents the number of data points in the historical data sequence and the adversarial data sequence. This represents the i-th adversarial data in the adversarial data sequence; This represents the i-th historical data point in the historical data sequence. Represents the absolute value function; Represents an exponential function with the natural constant as the base; This represents the normalization function.

[0040] In the formula, This represents the sum of correlations between historical data sequences and adversarial data sequences of all lengths. Here, n represents the number of data points in each sequence, indicating that there are n correlation values ​​between them. The smaller the sum of correlations across all lengths, the lower the similarity between the historical and adversarial data sequences, and consequently, the greater the deviation of the adversarial data sequences. The larger the value of ; This represents the difference between the i-th adversarial data in the adversarial data sequence and the i-th historical data in the historical data sequence, i.e., the deviation of the adversarial data. The larger this value is, the greater the degree of perturbation of the i-th adversarial data in the adversarial data sequence. The degree of perturbation of the i-th adversarial data point in the adversarial data sequence is represented by the product of the deviation of the adversarial data sequence and the deviation of the adversarial data and historical data. This value is denoted as the adversarial perturbation degree. The larger the value, the greater the perturbation. It should be noted that the adversarial perturbation degree is calculated by multiplying the overall sequence correlation by the deviation of individual data points. This avoids the incompleteness of judging solely based on the deviation of a single data point, such as an anomaly in a single data point while the overall trend remains consistent. It also compensates for the deficiency of relying solely on overall sequence similarity while ignoring the manipulation of key data, such as a similar overall data sequence trend but maliciously adjusted core parameters.

[0041] S3: Input the adversarial data sequence into discriminator A, denoted as the test sequence; calculate the test anomaly index based on the byte frequency, adjacent bytes, and byte ratio differences of the test sequence; calculate the accuracy of discriminator A based on the difference between the adversarial perturbation degree and the test anomaly index; calculate the error of discriminator A based on the consistency between the adversarial degree of adjacent data in the test sequence and the fluctuation of the test anomaly index; input the accuracy and error of discriminator A into discriminators B and C, and obtain the counterfeit detection model by repeatedly playing games and iterating to adjust discriminators A, B, and C.

[0042] It should be noted that discriminator A calculates the anomaly index of the target data by using multi-dimensional feature differences at the byte level. This is to accurately capture the subtle differences between adversarial data and historical data at the underlying data structure. After converting the data into a byte array, statistically analyzing the byte frequency and calculating the entropy value can reflect the randomness of the data. The byte distribution of normal operating data usually shows a stable pattern, while tampered adversarial data often breaks this pattern, resulting in abnormal byte entropy values.

[0043] Specifically, the adversarial data sequence is input into discriminator A and denoted as the test sequence; discriminator A converts the test sequence into a byte array, which is then converted into a test byte array; the frequency of each byte in the test byte array is counted and denoted as the test byte frequency; the test byte frequencies of all test sequences are extracted, and the entropy value is calculated and denoted as the test byte entropy; the variance of adjacent bytes of the test data in the test byte array is calculated and denoted as the test variance; the proportion of 0x00 bytes and 0xFF bytes in the test data in the test byte array is calculated to obtain the test byte proportion.

[0044] Preferably, by combining the entropy of the byte to be tested, the variance of the byte to be tested, and the proportion of the byte to be tested, the degree of abnormality of any sequence in the sequence to be tested composed of adversarial data sequences in the discriminator A is calculated and denoted as the abnormality index to be tested.

[0045] The anomaly index to be tested satisfies the following expression: ; In the formula, This represents the anomaly index of the i-th data point in the test sequence; , , This represents the entropy, variance, and percentage of the i-th data in the test sequence. , , This represents the mean entropy, mean variance, and mean percentage of the tested bytes in the sequence under test. Represents the absolute value function; This represents the normalization function.

[0046] In the formula, , , The values ​​represent the differences between the entropy, variance, and percentage of the i-th data in the test sequence and the mean entropy, variance, and percentage of the test bytes in the test sequence, respectively. The larger the difference, the greater the anomaly index.

[0047] At this point, the anomaly index to be tested has been obtained.

[0048] It should be noted that discriminator A is used to identify anomalies in the input test data, and the anomalies are output through the anomaly index. However, the discriminator relies solely on the differences between the byte frequency, adjacent bytes, and byte proportions of the test data in the test sequence and their corresponding mean values ​​to identify anomalies. This identification method cannot completely and accurately identify anomalies in the test data. This step judges the accuracy of discriminator A in calculating the anomaly index based on the difference between the degree of resistance to perturbation and the anomaly index, and this is denoted as the accuracy of discriminator A.

[0049] Preferably, in discriminator A, all test anomaly indices of the test data are calculated and denoted as the test anomaly index sequence; the degree of adversarial action of all data in the adversarial data sequence is calculated and denoted as the adversarial degree sequence; and the accuracy of discriminator A is calculated based on the adversarial degree sequence and the test anomaly index sequence.

[0050] It's important to note that using the degree of adversarial perturbation as a metric for the accuracy of discriminator A is crucial because it serves as a known benchmark for anomalies within the adversarial data sequence. The adversarial data sequence is generated by subjecting historical data sequences to controlled random perturbations. The degree of adversarial perturbation quantifies the extent to which each adversarial data point deviates from the original historical data, acting as a benchmark for the true degree of data anomaly. Discriminator A's function is to identify anomalies and calculate a test anomaly index. The degree of adversarial perturbation, as a true standard, can be used to verify the accuracy of discriminator A's identification by comparing it to the test anomaly index; the smaller the difference, the more accurate the identification.

[0051] The accuracy of discriminator A satisfies the following expression: ; In the formula, This represents the accuracy of discriminator A; n represents the number of data points in the test data sequence. This indicates the degree of resistance to perturbation of the i-th data point in the data sequence. This represents the anomaly index of the i-th data point in the data sequence to be tested. Represents the absolute value function; This represents an exponential function with the natural constant as its base.

[0052] In the formula, This represents the difference between the adversarial perturbation level of the i-th data point in the test data sequence and the test anomaly index of the i-th data point; This represents the mean of the difference between the degree of resistance to disturbance of the i-th data in the test data sequence and the test anomaly index, and is used to describe the accuracy of the test anomaly index output by discriminator A.

[0053] It should be noted that the game logic between discriminators B and C and discriminator A is essentially about maximizing their respective targets for their respective metrics. This drives discriminator A to achieve a balance between accuracy and stability during iterations, adapting to the continuous data security identification needs of industrial scenarios. Discriminator B aims to maximize the accuracy of discriminator A.

[0054] The maximization behavior of discriminator B is essentially training discriminator A from the perspective of a single data recognition dimension. By strengthening the requirements for the accuracy of discriminator A, discriminator A is forced to continuously correct the anomaly judgment bias of a single data during training, thereby improving the recognition accuracy of isolated anomaly data.

[0055] Discriminator C aims to maximize the error rate of discriminator A, which reflects discriminator A's ability to consistently capture the temporal fluctuation trends of continuous data. The maximization behavior of discriminator C engages in a game-like process with discriminator A from the perspective of continuous trend identification. Specifically, by amplifying discriminator A's shortcomings in the synchronicity of continuous data fluctuations, it exposes discriminator A's deficiencies in capturing overall abnormal trends, thus driving discriminator A to iteratively optimize its ability to adapt to the patterns of continuous data fluctuations.

[0056] Preferably, the error of discriminator A is calculated based on the adversarial degree sequence and the anomaly index sequence to be tested.

[0057] The error of discriminator A satisfies the following formula: ; In the formula, This represents the error rate of discriminator A; n represents the number of data points in the test data sequence. , This indicates the degree of resistance to perturbation of the (i+1)th and ithth data points in the data sequence to be tested; , This represents the anomaly index of the (i+1)th and ithth data points in the data sequence to be tested. Represents a very small positive number, ensuring that the denominator is not zero; Represents the absolute value function; This represents the normalization function.

[0058] In the formula, The temporal fluctuation represents the degree of resistance to disturbance of the (i+1)th test data. This represents the temporal fluctuation of the anomaly index of the (i+1)th test data. The ratio of the temporal fluctuation of the resistance to disturbance of the (i+1)th test data to the temporal fluctuation of the test anomaly index; The ratio of the time series fluctuation representing the degree of resistance to disturbance to the time series fluctuation of the anomaly index under test deviates from 1. The greater the deviation, the more asynchronous the fluctuations. This represents the average deviation of all the data to be tested. The larger this value is, the greater the error of the discriminator A.

[0059] It should be noted that this game of discriminator B maximizing accuracy and discriminator C maximizing error means that discriminator A, under the pressure of the two opposing forces, needs to improve the accuracy of individual data judgments and enhance the stability of continuous trend capture. Ultimately, the counterfeit detection model formed through multiple rounds of iteration can better adapt to the scenario of continuous and large-scale data interaction in industrial networks.

[0060] Preferably, the accuracy and error of discriminator A are simultaneously input into discriminators B and C, allowing discriminators B and C to engage in multiple games and iteratively adjust discriminator A, ultimately obtaining a highly accurate anti-counterfeiting model. The anti-counterfeiting model includes discriminator A, which is used to determine the degree of abnormality of the data to be tested, and discriminators B and C, which continuously improve the discrimination accuracy of discriminator A through games.

[0061] It should be noted that the discriminators A, B, and C, as well as the game and iterative adjustment process described here, are models proposed in this invention to optimize the performance of the counterfeit detection model. Figure 2 The following is a diagram of the falsification detection model structure, including the architecture of discriminators A, B, and C. This model can be implemented using well-known and mature techniques in the field of machine learning. The specific correspondences and implementation paths are as follows: Discriminator A is a parameterizable computational model. It is an industrial-grade data feature analysis module that can be developed at the software level using the Python / TensorFlow framework. Its core consists of three sub-modules, with the following specific structure and functions: The first module is a byte array conversion sub-module. It receives adversarial data sequences, such as CNC machine tool compensation parameters. The data type is 32-bit floating-point numbers. Following little-endian storage rules, it converts each data point into a 4-byte array. For example, the tool compensation parameter 0.12 corresponds to the 32-bit floating-point hexadecimal number 0x3D99999A, which is converted into a byte array [0x9A, 0x9 ... [x99,0x3D] ensures that the underlying byte features of the data can be extracted; the second module is a multi-dimensional feature extraction submodule, which is a low-level data feature analysis module adapted to the characteristics of industrial working condition data. Through multi-dimensional operations such as byte frequency statistics, Shannon entropy calculation, adjacent byte variance solution, and specific byte proportion analysis, it transforms the underlying byte features of industrial working condition data, such as CNC machine tool tool compensation parameters, into more intuitive indicators; the third module is an anomaly index calculation submodule. This module is a conversion module for multi-dimensional feature extraction and fake product identification model judgment, that is, it transforms the underlying byte features into specific indicators that can be directly used for anomaly judgment.

[0062] Discriminators B and C are both parameter optimization game modules, which can be developed at the software level using the PyTorch framework. In the counterfeit detection model composed of discriminators B, C, and discriminator A: Discriminator B maximizes the accuracy of discriminator A to ensure that A accurately identifies anomalies in individual data points. First, an accuracy index is defined, which is obtained by dividing the sum of the number of correctly identified anomalous data points and the number of correctly identified normal data points by the total number of data points. Then, a loss function is constructed, transforming maximizing accuracy into minimizing this loss function. The gradient of the loss function with respect to the parameters of discriminator A is calculated through an automatic differentiation mechanism and backpropagated. Finally, the gradient signal is fed back to discriminator A to guide A in fine-tuning its parameters.

[0063] Discriminator C maximizes the error rate of discriminator A, amplifying A's shortcomings in identifying continuous data fluctuations. This, in turn, prompts A to improve its temporal consistency. An error rate index is defined, obtained by dividing the number of groups of three or more consecutive abnormal data that A misclassifies as normal by the total number of consecutive abnormal groups. A second loss function is then constructed, transforming maximizing the error rate into minimizing this loss function. Similarly, using an automatic differentiation mechanism, the gradient of the second loss function with respect to the discriminator A's parameters is calculated and backpropagated, feeding the gradient signal back to A to adjust its parameters. In the collaborative game, each iteration inputs a batch of industrial data. Discriminator A outputs an anomaly index, and discriminators B and C calculate the accuracy, error rate, and corresponding loss function, respectively. Then, the gradients of the two are merged according to their weights, and the Adam optimizer adjusts the parameters of discriminator A based on the total gradient. After several iterations, discriminator A can accurately identify individual abnormal data and keenly capture continuous data fluctuation anomalies, ultimately forming a high-performance anti-spoofing model. Among them, the construction of the loss function according to the little-endian storage rule, the automatic differentiation mechanism to calculate the gradient and backpropagate, and the Adam optimizer to adjust the parameters are all existing technologies.

[0064] S4: Input the target data into the anti-counterfeiting model to calculate the target anomaly index, and classify the security level and corresponding algorithm encryption according to the target data type.

[0065] It's important to note that in CNC machine tool cluster communication, the primary goal for spoofed data is to block its propagation. For normal data, different encryption strengths need to be matched according to its sensitivity to avoid delays caused by excessive encryption, thus ensuring both security and communication efficiency. By calculating the anomaly index of target data using a spoofing detection model and comparing it with a first threshold, rapid security screening of target data is achieved. This process directly adapts to the high real-time communication requirements in industrial scenarios. Setting a first threshold as a judgment threshold can quickly identify and promptly mark spoofed data that significantly deviates from normal characteristics, preventing it from entering subsequent communication processes and causing equipment malfunctions.

[0066] Specifically, the target data is input into the anti-spoofing model, and the anomaly index of the target data is calculated and recorded as the target anomaly index. A first threshold is preset. When the target anomaly index is greater than or equal to the first threshold, the target data is considered to be fake data and is marked. If the target anomaly index is less than the first threshold, the target data is treated as normal data and classified according to its security level.

[0067] It should be noted that the Chinese patent document with authorization announcement number CN103780622B, entitled "A Data Classification and Encryption Method for Cloud Storage," analyzes the risk of data leakage and the degree of business impact, classifying industrial data into three levels: general level L1, sensitive level L2, and secret level L3, providing an industry-standard classification logic for this method. Building upon this, this method further integrates commercial cryptography compliance requirements, deeply adapting the level classification to the domestic SM series algorithms. Furthermore, this step, by classifying security levels and encrypting them accordingly, avoids resource waste and communication delays caused by over-encrypting low-sensitivity data, while ensuring that highly sensitive data receives sufficient protection.

[0068] Preferably, all target data sequences are classified into security levels according to their types. For example, tool compensation parameters are classified as L3, cutting forces as L3, equipment vibration and noise as L2, and ambient temperature as L1, and represented as target data L1, target data L2, and target data L3, respectively. Commercial cryptographic algorithms from the SM series are obtained. For target data L1, a low-sensitivity commercial encryption algorithm is used, such as the SM4 encryption algorithm, which is suitable for encrypting publicly available and frequently collected data with low security requirements. For target data L2, a medium-sensitivity commercial encryption algorithm or cryptographic combination is used, such as the SM4+SM3 encryption algorithm, to meet the requirements of balancing encryption efficiency and identity credibility. For target data L3, a high-sensitivity commercial encryption algorithm or cryptographic combination is used, such as the SM2+SM4 encryption algorithm, to prevent the encrypted data from being cracked and leaked.

[0069] This completes the secure communication of data.

[0070] This invention also discloses a network security communication system based on commercial cryptography, including a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement a network security communication method based on commercial cryptography according to the present invention.

[0071] The system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.

[0072] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A network security communication method based on commercial cryptography, characterized in that, include: Historical working condition data of the workshop representing the same type of time period are recorded as historical data sequence, and real-time working condition data of the same type are recorded as target data sequence; the historical data sequence and the target data sequence contain the byte frequency, adjacent bytes and byte ratio of the corresponding data; By combining the volatility of historical data sequences, random perturbation is applied to the historical data sequences to generate adversarial data and adversarial data sequences; based on the similarity between the historical data sequences and adversarial data sequences, and combined with the difference in size between the historical data and adversarial data, the degree of adversarial perturbation is calculated. The adversarial data sequence is input into discriminator A and denoted as the test sequence. The test anomaly index is calculated based on the differences in byte frequency, adjacent bytes, and byte proportion of the test sequence. The accuracy of discriminator A is calculated based on the difference between the degree of adversarial perturbation and the test anomaly index. The error of discriminator A is calculated based on the consistency between the degree of adversarial perturbation of adjacent data and the fluctuation of the test anomaly index. The accuracy and error of discriminator A are input into discriminators B and C. Discriminators A, B, and C are adjusted through multiple games and iterations to obtain the counterfeit detection model. The target data is input into the anti-counterfeiting model to calculate the target anomaly index, and the security level is classified and corresponding encryption algorithm is applied according to the target data type.

2. The network security communication method based on commercial cryptography according to claim 1, characterized in that, The adversarial data satisfies the following expression: ； In the formula, This is the i-th adversarial data; This represents the i-th historical data point in the historical data sequence; n represents the number of historical data points in the historical data sequence. This represents the historical data mean of a historical data series. This represents the random perturbation coefficient of the i-th historical data in the historical data sequence, and the random perturbation coefficient is randomly generated within the range of [-1, 1]. Represents the absolute value function; This represents the normalization function.

3. The network security communication method based on commercial cryptography according to claim 1, characterized in that, The degree of resistance to disturbance satisfies the following expression: ； In the formula, Indicates the degree of resistance to disturbance; This represents the correlation between a historical data sequence of length j and an adversarial data sequence of length j; n represents the number of data points in the historical data sequence and the adversarial data sequence. This represents the i-th adversarial data in the adversarial data sequence; This represents the i-th historical data point in the historical data sequence. Represents the absolute value function; Represents an exponential function with the natural constant as its base; This represents the normalization function.

4. The network security communication method based on commercial cryptography according to claim 1, characterized in that, The calculation of the anomaly index to be tested includes: Obtain the entropy, variance, and percentage of the byte to be tested; The anomaly index to be tested satisfies the following expression: ； In the formula, This represents the anomaly index of the i-th data point in the test sequence; , , This represents the entropy, variance, and percentage of the i-th data in the test sequence. , , This represents the mean entropy, mean variance, and mean percentage of the tested bytes in the sequence under test. Represents the absolute value function; This represents the normalization function.

5. A network security communication method based on commercial cryptography according to claim 4, characterized in that, The acquisition of the entropy, variance, and percentage of the byte to be tested includes: The adversarial data sequence is input into discriminator A and denoted as the test sequence. Discriminator A converts the test sequence into a byte array and then into a test byte array. The frequency of each byte in the test byte array is counted and denoted as the test byte frequency. The test byte frequencies of all test sequences are extracted and the entropy value is calculated and denoted as the test byte entropy. The variance of adjacent bytes of the test data in the test byte array is calculated and denoted as the test variance. The proportion of 0x00 bytes and 0xFF bytes in the test data in the test byte array is calculated to obtain the test byte proportion.

6. A network security communication method based on commercial cryptography according to claim 1, characterized in that, The accuracy of the discriminator A includes: ； In the formula, This represents the accuracy of discriminator A; n represents the number of data points in the test data sequence. This indicates the degree of resistance to perturbation of the i-th data point in the data sequence. This represents the anomaly index of the i-th data point in the data sequence to be tested. Represents the absolute value function; This represents an exponential function with the natural constant as its base.

7. A network security communication method based on commercial cryptography according to claim 1, characterized in that, The error rate of the discriminator A is calculated as follows: Extract the adversarial degree sequence and the test anomaly index sequence. Calculate the difference in adversarial perturbation degree between adjacent test data of the i-th test data, denoted as adversarial perturbation degree fluctuation. Calculate the difference in test anomaly index between adjacent test data of the i-th test data, denoted as test anomaly index fluctuation. Calculate the difference between the ratio of adversarial perturbation degree fluctuation to test anomaly index fluctuation and 1, and take a positive absolute value to indicate whether the adversarial degree of adjacent data of the i-th test data and the fluctuation trend of the test anomaly index are consistent, denoted as the fluctuation consistency of the i-th test data. Calculate the fluctuation consistency of all test data and calculate the mean, denoted as the error of discriminator A.

8. A network security communication method based on commercial cryptography according to claim 1, characterized in that, The obtained counterfeit detection model includes: The accuracy and error of discriminator A are simultaneously input into discriminators B and C. Discriminators B and C engage in multiple games, and the method of discriminator A is iteratively adjusted. Finally, a discriminator model with extremely high discriminator accuracy is obtained. The discriminator model includes discriminator A, which is used to judge the degree of abnormality of the test data, and discriminators B and C, which improve the discriminator A's discrimination accuracy through continuous games.

9. A network security communication method based on commercial cryptography according to claim 1, characterized in that, The calculation of the target anomaly index includes: The target data is input into the anti-spoofing model, and the anomaly index of the target data is calculated and recorded as the target anomaly index. A first threshold is preset. If the target anomaly index is greater than or equal to the first threshold, the target data is considered to be fake data and is marked. If the target anomaly index is less than the first threshold, the target data is treated as normal data and classified according to the security level.

10. A network security communication system based on commercial cryptography, characterized in that, include: A processor and a memory, the memory storing computer program instructions that, when executed by the processor, implement a network security communication method based on commercial cryptography as described in any one of claims 1-9.

Images