A real-time analysis and monitoring method for port network security information data

Abstract

The application discloses a real-time analysis and monitoring method for port network security information data and relates to the technical field of information security. The method comprises the following steps: deploying a lightweight probe to collect port network information heterogeneous data, and mapping the collected data to three-dimensional space coordinates; constructing a three-dimensional point cloud model according to each port network information point of the three-dimensional space coordinates; adding point attribute information and establishing a space index structure; performing layered encryption transmission on the three-dimensional point cloud model; the receiver uses the corresponding key to decrypt the data layer by layer according to the hierarchical order at the time of encryption; and performing security neural network reasoning based on PointNet homomorphism machine learning. The application collects port network information heterogeneous data by deploying a lightweight probe, constructs a three-dimensional point cloud model according to the port network information heterogeneous data, and performs layered encryption transmission on the three-dimensional point cloud model, so that the layered encryption allows different levels of data to implement differentiated protection strategies, and the security and efficiency are taken into account.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method for real-time analysis and monitoring of port network security information data. Background Technology

[0002] With the accelerating digitalization of global trade, ports, as critical infrastructure, are facing increasingly severe cybersecurity threats. Current port network systems suffer from the following technical deficiencies:

[0003] Real-time limitations: A unified analysis model has not yet been established for physical sensor (such as container RFID), IT network traffic (Modbus TCP protocol) and OT equipment status data, making it difficult to detect hybrid attacks such as container positioning spoofing and crane PLC tampering.

[0004] Insufficient privacy protection: Although existing homomorphic encryption schemes (such as HElib) support ciphertext computation, they suffer from computational bloat when processing neural port network inference (ciphertext size increases by more than 1,000 times), and lack organic integration with blockchain auditing, making it difficult to meet compliance requirements such as GDPR.

[0005] Quantum resistance: Mainstream surveillance systems rely on asymmetric encryption such as RSA / SM2, which NIST predicts will be broken by quantum computers before 2030. Existing quantum-resistant solutions (such as lattice-based Crystals-Kyber) are not optimized for machine learning loads, resulting in an 80% decrease in inference throughput.

[0006] Data silo problem: Traditional monitoring systems often run independently in subsystems such as logistics management, equipment control, and ship scheduling, and adopt a distributed log storage architecture (such as Syslog server), making it difficult to correlate and analyze cross-system attack behaviors.

[0007] To address the aforementioned issues, this application provides a method for real-time analysis and monitoring of port network security information data. Summary of the Invention

[0008] The purpose of this invention is to provide a real-time analysis and monitoring method for port network security information data. By deploying lightweight probes to collect heterogeneous port network information data, and constructing a three-dimensional point cloud model based on the heterogeneous port network information data, the method uses the three-dimensional point cloud model for layered encrypted transmission, thereby solving the problems of insufficient security, low transmission efficiency, and inaccurate analysis in existing port network security monitoring systems.

[0009] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0010] This invention relates to a real-time analysis and monitoring method for port network security information data, comprising the following steps:

[0011] Step S1: Deploy a lightweight probe to collect heterogeneous data of port network information and map the collected data to three-dimensional spatial coordinates;

[0012] Step S2: Construct a 3D point cloud model based on the port network information points in the 3D spatial coordinates;

[0013] Step S3: Add point attribute information and establish a spatial index structure;

[0014] Step S4: Perform layered encrypted transmission of the 3D point cloud model;

[0015] Step S5: The receiver decrypts the data layer by layer using the corresponding key according to the encryption layer order;

[0016] Step S6: Perform secure neural network inference based on PointNet homomorphic machine learning;

[0017] Step S7: Blockchain-based evidence storage via encrypted audit trail to enable response feedback.

[0018] As a preferred technical solution, in step S1, a regular polygon is constructed according to the type of port network information collected by the deployed lightweight probe. The plane in which the regular polygon is located is defined as the plane in which the XY axis of the three-dimensional space is located. The center of the regular polygon is set as the Z axis in the three-dimensional space and is perpendicular to the plane in which the XY axis is located. The unit of the Z axis is time t. The heterogeneous data of the collected port network information is mapped to the three-dimensional space coordinates.

[0019] As a preferred technical solution, the specific process of constructing a 3D point cloud model based on the port network information points in 3D spatial coordinates in step S2 is as follows:

[0020] Step S21: Collect all 3D spatial coordinate point data and convert the coordinate point data into a point cloud structure; use a professional library (such as PCL or Open3D) to create a point cloud container object, assign an N×3 NumPy array (each row represents the XYZ coordinates of a point) to the point cloud object, and you can also add RGB values ​​(0-1 range) to each point.

[0021] Step S22: Add point attribute information to the generated point cloud and establish a spatial index structure; when establishing the spatial index, the basic data structure for fast neighborhood search is used, supporting radius search and K-nearest neighbor search; construct the local topology by searching the neighborhood (radius or K-nearest neighbor) of each point, calculate the point cloud density and distribution characteristics, and identify features such as edges and corners;

[0022] Step S23: Filter and denoise the generated point cloud, and then simplify it.

[0023] As a preferred technical solution, in step S3, the index of the 3D point cloud model adopts an octree structure with a hierarchical index structure. The specific process is as follows: First, determine the spatial boundary of the point cloud and calculate the smallest cube containing all points as the root node; then set the maximum recursion depth and minimum voxel size parameters to control the fineness of the tree; starting from the root node, check whether the number of points in the current node exceeds the threshold and has not reached the maximum depth. If the condition is met, the current cube is divided into 8 equal sub-cubes, and the points are assigned to the corresponding child nodes; recursively process each non-empty child node until all nodes no longer meet the subdivision conditions or reach the maximum depth; finally, a hierarchical spatial structure is formed, with upper-level nodes representing large spatial regions and lower-level nodes representing finer sub-regions; during the construction process, a dynamic subdivision strategy can be adopted to perform deeper subdivision in densely populated areas and maintain a coarser granularity in sparse areas, while parallel processing can accelerate the construction process. The completed octree supports efficient spatial query operations, such as range search, nearest neighbor search, and collision detection.

[0024] As a preferred technical solution, the specific process for layered encrypted transmission of the 3D point cloud model in step S4 is as follows:

[0025] Step S41: Divide the 3D point cloud data into three levels according to the detail level or spatial region division of the point cloud; Since the height of the 3D point cloud increases over time, under normal circumstances, the heterogeneous data of port network information collected by the lightweight probe does not change significantly, so the area with a large range of change is used as the key feature point for strong encryption.

[0026] Step S42: Perform layered encryption on each level of the 3D point cloud; wherein, the first layer: strong encryption is performed on key feature points; the second layer: medium-strength encryption is performed on attachment points; the third layer: light encryption is performed on the remaining point cloud or partial plaintext encryption is maintained.

[0027] The recommended encryption algorithms for the first layer are AES-256 and RSA-2048 (for digital signatures).

[0028] The recommended encryption algorithms for the second layer are ChaCha20 and Threefish.

[0029] The recommended encryption algorithms for the third layer are lightweight algorithms such as SPECK and SIMON.

[0030] For particularly sensitive point cloud data, a composite encryption strategy can be adopted, such as first encrypting the coordinate data with AES, then generating an integrity check value with SHA-3, and finally performing digital signature via RSA;

[0031] Step S43: Use an independent key for each level, while the first-level key protects the second and third-level keys. Derive the sub-keys for each level from the master key using the HKDF algorithm. When distributing keys, use attribute-based encryption (ABE) to achieve fine-grained access control. When rotating keys, the first-level key rotation cycle is short (e.g., 1 hour), while the second and third levels have longer cycles (e.g., 1 week).

[0032] As a preferred technical solution, in step S5, the receiver decrypts the data layer by layer using the corresponding key according to the encryption layer order. The specific process is as follows:

[0033] Step S51: The secure channel obtains keys for each layer from the key distribution center and performs authentication and key validity checks;

[0034] Step S52: Dynamically derive the decryption key based on user attributes to achieve fine-grained access control;

[0035] Step S53: Derive subkeys from the master key to ensure the hierarchical relationship between keys;

[0036] Step S54: Decrypt metadata, feature semantics, attribute information, and basic set in sequence according to the hierarchy.

[0037] As a preferred technical solution, the specific process of decrypting metadata, feature semantics, attribute information, and basic set in step S54 according to the hierarchy is as follows:

[0038] Step S541, Metadata layer decryption (first layer): Decrypt the metadata using the highest security level key (such as RSA-2048), verify the integrity of the metadata, and obtain the decryption parameters of other layers;

[0039] Step S542, Feature semantic layer encryption (second layer): Use a medium-strength algorithm (such as ChaCha20) to decrypt the semantic information and verify the logical consistency of the feature data;

[0040] Step S543, Attribute Information Layer Decryption (Third Layer): Use a lightweight algorithm (such as SPECK) to decrypt attributes such as color and intensity, and detect the correspondence between attribute values ​​and geometric data;

[0041] Step S544, Basic Geometry Layer Decryption: Based on the decryption results of the previous layers, select an appropriate decryption method to finally decrypt the coordinate data and restore the original point cloud geometry.

[0042] As a preferred technical solution, after step S54, the decrypted data still needs to be processed and verified. The specific process is as follows:

[0043] Step S55, Data Reassembly: Reassemble the decrypted data from each layer according to the original structure to ensure the correct correspondence between geometric data and attribute data;

[0044] Step S56, Integrity Verification: Check whether the hash value of the decrypted data is consistent with the record before encryption, and verify the rationality of the point cloud topology and attribute range;

[0045] Step S57, Quality Assessment: Evaluate the geometric accuracy and attribute fidelity of the decrypted point cloud, and check for any data loss or outliers.

[0046] As a preferred technical solution, the specific process of performing secure neural network inference based on PointNet homomorphic machine learning in step S6 is as follows:

[0047] Step S61: Learn a 3*3 affine transformation matrix to perform coordinate transformation on the input point cloud to enhance the rotation invariance of the model to the input data, thereby making the port network more robust to rotation;

[0048] Step S62: The transformation result is passed through a multilayer perceptron mlp(64, 64) to increase the dimension to 64.

[0049] Step S63: By learning the 64*64 transformation matrix, the 64-dimensional features are transformed to improve permutation invariance, thereby making the arrangement order of points in the port network more robust.

[0050] Step S64: Pass the transformation result through a multilayer perceptron (mlp) (64, 128, 1024) layer to increase the dimension to 1024, and obtain the maximum n*1024 output result;

[0051] Step S65: Max pooling yields a 1024-dimensional global feature, which can specifically represent the original input model;

[0052] Step S66: Perform dimensionality reduction on the 1024-dimensional global features using a multilayer perceptron mlp(512, 256, k) and calculate cosine similarity to achieve 3D model matching. Select PointNet to extract significant k-dimensional features to ensure that the overall features of different scan data of the same entity remain consistent.

[0053] Cosine similarity measures the degree of similarity between two vectors in a given direction. It calculates the cosine of the angle between the vectors to assess similarity and is widely used in text processing, information retrieval, and recommender systems. This paper utilizes cosine similarity to calculate the k-dimensional feature similarity of point clouds to determine whether 3D model data corresponds to the same entity model.

[0054] Geometrically, the dot product of two vectors is equal to the product of their lengths and the cosine of their included angle. A positive dot product indicates an angle less than 90 degrees, meaning they are similar in direction; a value of 0 degrees indicates they are perpendicular; and a negative dot product indicates an angle greater than 90 degrees, meaning they are opposite in direction. Cosine similarity utilizes this property, calculating the dot product by dividing by the product of the two vector lengths to measure the cosine of the angle between them. The cosine similarity is 1 when the vectors are completely coincident (0 degrees), -1 when they are completely opposite (180 degrees), and 0 when they are perpendicular (90 degrees).

[0055] As a preferred technical solution, in step S7, verifiable cryptographic audit traces are achieved through the deep integration of blockchain and zero-knowledge proofs: First, a notarization framework based on a consortium blockchain is constructed, and each block records operation logs in the form of an SM3 hash chain (previous block hash + current operation fingerprint + timestamp), and threshold signatures are used to ensure consensus in block generation; key operations generate legitimacy proofs through zk-SNARK (such as proving that "data decryption requests comply with RBAC policy"), and the verification process relies on elliptic curve pairing operations to compress the proof data to 288 bytes; at the same time, a hybrid index structure (MerklePatricia Trie + Bloom Filter) is designed to achieve second-level audit queries, and the destruction of keys for violations is automatically triggered through smart contracts.

[0056] The present invention has the following beneficial effects:

[0057] This invention collects heterogeneous port network information data by deploying lightweight probes, constructs a three-dimensional point cloud model based on the heterogeneous port network information data, and uses the three-dimensional point cloud model for layered encrypted transmission. Layered encryption allows for differentiated protection strategies for data at different levels, balancing security and efficiency.

[0058] This invention employs layered encryption transmission of 3D point cloud models. After layering, the transmission granularity can be dynamically adjusted according to the port network conditions, which reduces bandwidth consumption compared to overall encrypted transmission. At the same time, it uses LWE encryption of core geometric data in a lattice cryptosystem, which can resist quantum computing attacks such as Shor's algorithm. Layered encryption allows terminals to decrypt different levels according to their permissions (e.g., the public can only access the decrypted low-precision layer, while planning departments can obtain complete data), realizing a "one data, multiple uses" sharing mode.

[0059] This invention utilizes LWE (Learning with Error) homomorphic machine learning based on lattice cryptography to achieve efficient encrypted computation through dynamic noise adjustment and RLWE ciphertext compression. It combines the GSW scheme to support asymmetric operations and employs a polynomial approximation of the ReLU function to solve nonlinear problems. Secure neural network inference is achieved through the hybrid engine of the Gazelle protocol stack (HE handles linear layers, GC handles nonlinear layers) and quantum-resistant extension (NTRU-KEM / NewHope), combined with a distributed sharding model and zk-STARK verifiable computation. This enables neural port network inference with near-plaintext efficiency in the encrypted state, while also possessing post-quantum security and lossless protocol switching capabilities.

[0060] This invention achieves verifiable cryptographic audit trails through the deep integration of blockchain and zero-knowledge proofs: First, a consortium blockchain-based evidence storage framework is constructed, with each block recording operation logs in the form of an SM3 hash chain (previous block hash + current operation fingerprint + timestamp), and threshold signatures are used to ensure consensus in block generation; key operations generate legitimacy proofs through zk-SNARK (such as proving "data decryption request conforms to RBAC policy"), and the verification process relies on elliptic curve pairing operations to compress the proof data to 288 bytes; simultaneously, a hybrid index structure (Merkle Patricia Trie + Bloom Filter) is designed to achieve second-level audit queries, and the key destruction of violations is automatically triggered through smart contracts; the entire system achieves three-layer audit capabilities—full lifecycle traceability of operations, verifiable key behaviors, and early warning of abnormal events—while maintaining operational privacy.

[0061] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0062] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a flowchart of a real-time analysis and monitoring method for port network security information data according to the present invention. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0066] To make the purpose, technical solution, and advantages of this application clearer, the following description is provided in conjunction with the appendix. Figure 1 The present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application.

[0067] Please see Figure 1 As shown, this invention provides a real-time analysis and monitoring method for port network security information data, comprising the following steps:

[0068] Step S1: Deploy a lightweight probe to collect heterogeneous data of port network information and map the collected data to three-dimensional spatial coordinates;

[0069] Step S2: Construct a 3D point cloud model based on the port network information points in the 3D spatial coordinates;

[0070] Step S3: Add point attribute information and establish a spatial index structure;

[0071] Step S4: Perform layered encrypted transmission of the 3D point cloud model;

[0072] Step S5: The receiver decrypts the data layer by layer using the corresponding key according to the encryption layer order;

[0073] Step S6: Perform secure neural network inference based on PointNet homomorphic machine learning;

[0074] Step S7: Blockchain-based evidence storage via encrypted audit trail to enable response feedback.

[0075] In step S1, a regular polygon is constructed based on the types of port network information collected by the deployed lightweight probe. The plane containing this regular polygon is defined as the plane containing the XY axes in three-dimensional space. The center of this regular polygon is set as the Z-axis in three-dimensional space, perpendicular to the plane containing the XY axes. The unit of the Z-axis is time t. The heterogeneous data of the collected port network information is then mapped to three-dimensional spatial coordinates. For example, the multi-source heterogeneous data collected by the WiFi probe includes device MAC addresses (source MAC and destination MAC), WiFi signal strength (RSSI value), channel information (digital number between 1 and 14), frame type (management frame 00, control frame 01, data frame 02), and timestamp information; the WiFi probe data can then be converted into a regular pentagon. Since the MAC address is a 48-bit hardware identifier, it is usually represented as a 12-digit hexadecimal number, with the first 24 bits being the manufacturer identifier (OUI) and the last 24 bits being the device's unique identifier. The device's unique identifier can be used as the coordinate point of the plane containing the XY axes. The WiFi signal strength (RSSI value) is converted into distance using a path loss model, with the specific formula as follows:

[0076] ;

[0077] In the formula, As an environmental degradation factor, The reference strength is at 1 meter. For distance;

[0078] The obtained RSSI value can be used to determine the coordinates of the XY axis in the plane. To improve positioning accuracy, the signal strength of the same device can be collected by multiple lightweight probes, and the three-dimensional position of the device can be determined by triangulation.

[0079] In step S2, the specific process for constructing a 3D point cloud model based on the port network information points in 3D spatial coordinates is as follows:

[0080] Step S21: Collect all 3D spatial coordinate point data and convert the coordinate point data into a point cloud structure; use a professional library (such as PCL or Open3D) to create a point cloud container object, assign an N×3 NumPy array (each row represents the XYZ coordinates of a point) to the point cloud object, and you can also add RGB values ​​(0-1 range) to each point.

[0081] Step S22: Add point attribute information to the generated point cloud and establish a spatial index structure; when establishing the spatial index, the basic data structure for fast neighborhood search is used, supporting radius search and K-nearest neighbor search; construct the local topology by searching the neighborhood (radius or K-nearest neighbor) of each point, calculate the point cloud density and distribution characteristics, and identify features such as edges and corners;

[0082] Step S23: Filter and denoise the generated point cloud, and then simplify it. In order to improve the matching efficiency of the 3D model, this embodiment adopts a variable shrinkage algorithm based on two error measures to simplify the triangular mesh model. This algorithm is efficient and flexible, and the degree of simplification can be controlled by adjusting the stopping condition. Therefore, the shrinkage cost of each edge is calculated using two error matrices until the predetermined degree of simplification is reached.

[0083] In step S3, the index of the 3D point cloud model adopts an octree structure with a hierarchical index structure. The specific process is as follows: First, determine the spatial boundary of the point cloud and calculate the smallest cube containing all points as the root node; then set the maximum recursion depth and minimum voxel size parameters to control the fineness of the tree; starting from the root node, check whether the number of points in the current node exceeds the threshold but has not reached the maximum depth. If the condition is met, divide the current cube into 8 equal sub-cubes and assign the points to the corresponding child nodes; recursively process each non-empty child node until all nodes no longer meet the subdivision conditions or reach the maximum depth; finally, a hierarchical spatial structure is formed, with upper-level nodes representing large spatial regions and lower-level nodes representing finer sub-regions; during the construction process, a dynamic subdivision strategy can be adopted to perform deeper subdivision in densely populated areas and maintain a coarser granularity in sparse areas, while parallel processing can accelerate the construction process. The completed octree supports efficient spatial query operations, such as range search, nearest neighbor search, and collision detection.

[0084] Step S4 details the process of performing layered encrypted transmission of the 3D point cloud model:

[0085] Step S41: Divide the 3D point cloud data into three levels according to the detail level or spatial region division of the point cloud; Since the height of the 3D point cloud increases over time, under normal circumstances, the heterogeneous data of port network information collected by the lightweight probe does not change significantly, so the area with a large range of change is used as the key feature point for strong encryption.

[0086] Step S42: Perform layered encryption on each level of the 3D point cloud; wherein, the first layer: strong encryption is performed on key feature points; the second layer: medium-strength encryption is performed on attachment points; the third layer: light encryption is performed on the remaining point cloud or partial plaintext encryption is maintained.

[0087] The recommended encryption algorithms for the first layer are AES-256 and RSA-2048 (for digital signatures).

[0088] The recommended encryption algorithms for the second layer are ChaCha20 and Threefish.

[0089] The recommended encryption algorithms for the third layer are lightweight algorithms such as SPECK and SIMON.

[0090] For particularly sensitive point cloud data, a composite encryption strategy can be adopted, such as first encrypting the coordinate data with AES, then generating an integrity check value with SHA-3, and finally performing digital signature via RSA;

[0091] Step S43: Use an independent key for each level, while the first-level key protects the second and third-level keys. Derive the sub-keys for each level from the master key and use the HKDF algorithm. When distributing keys, use attribute-based encryption (ABE) to achieve fine-grained access control. When rotating keys, the first-level key rotation cycle is short (e.g., 1 hour), while the second and third levels have longer cycles (e.g., 1 week).

[0092] In step S5, the receiver decrypts the data layer by layer using the corresponding key according to the encryption layer order. The specific process is as follows:

[0093] Step S51: The secure channel obtains keys for each layer from the key distribution center and performs authentication and key validity checks;

[0094] Step S52: Dynamically derive the decryption key based on user attributes to achieve fine-grained access control;

[0095] Step S53: Derive subkeys from the master key to ensure the hierarchical relationship between keys;

[0096] Step S54: Decrypt metadata, feature semantics, attribute information, and basic set in sequence according to the hierarchy.

[0097] In step S54, the specific process of decrypting metadata, feature semantics, attribute information, and basic sets in sequence according to hierarchy is as follows:

[0098] Step S541, Metadata layer decryption (first layer): Decrypt the metadata using the highest security level key (such as RSA-2048), verify the integrity of the metadata, and obtain the decryption parameters of other layers;

[0099] Step S542, Feature semantic layer encryption (second layer): Use a medium-strength algorithm (such as ChaCha20) to decrypt the semantic information and verify the logical consistency of the feature data;

[0100] Step S543, Attribute Information Layer Decryption (Third Layer): Use a lightweight algorithm (such as SPECK) to decrypt attributes such as color and intensity, and detect the correspondence between attribute values ​​and geometric data;

[0101] Step S544, Basic Geometry Layer Decryption: Based on the decryption results of the previous layers, select an appropriate decryption method to finally decrypt the coordinate data and restore the original point cloud geometry.

[0102] After step S54, the decrypted data still needs to be processed and verified. The specific process is as follows:

[0103] Step S55, Data Reassembly: Reassemble the decrypted data from each layer according to the original structure to ensure the correct correspondence between geometric data and attribute data;

[0104] The basic process of data reorganization is as follows:

[0105] 1. Hierarchical data alignment: Establish mapping relationships between different levels using index information in the metadata layer, and achieve precise matching between the geometric layer and the attribute layer through point cloud ID or spatial coordinates;

[0106] 2. Data Structure Reconstruction: Reorganize the point cloud spatial structure based on octree or KD-tree to restore the original point cloud topology connection relationship;

[0107] 3. Attribute association verification: Check the correspondence between attributes such as color (RGB) and reflection intensity and geometric points to verify the consistency between feature semantic labels and geometric regions;

[0108] Step S56, Integrity Verification: Check whether the hash value of the decrypted data is consistent with the record before encryption, and verify the rationality of the point cloud topology and attribute range;

[0109] The basic process of integrity verification is as follows:

[0110] Acquisition of pre-stored hash values: During the encryption phase, the hash value of the original point cloud is calculated using a secure hash algorithm such as SHA-256 and stored securely. The hash value is usually stored separately from the encrypted data or protected by digital signature.

[0111] Post-decryption hash calculation: The same hash algorithm is used to recalculate the check value on the decrypted point cloud data. The calculation process must include the complete binary representation of the geometric coordinates and attribute data.

[0112] Hash value comparison: The newly calculated hash value is compared bit by bit with the pre-stored value. Tools such as CertUtil are used to automate the comparison process, avoiding human error. Any discrepancies indicate that the data may have been tampered with or that the decryption process has failed.

[0113] Step S57, Quality Assessment: Assess the geometric accuracy and attribute fidelity of the decrypted point cloud, and check for any data loss or outliers.

[0114] In step S6, the specific process of performing secure neural network inference based on PointNet homomorphic machine learning is as follows:

[0115] Step S61: Learn a 3*3 affine transformation matrix to perform coordinate transformation on the input point cloud to enhance the rotation invariance of the model to the input data, thereby making the port network more robust to rotation;

[0116] Step S62: The transformation result is passed through a multilayer perceptron mlp(64, 64) to increase the dimension to 64.

[0117] Step S63: By learning the 64*64 transformation matrix, the 64-dimensional features are transformed to improve permutation invariance, thereby making the arrangement order of points in the port network more robust.

[0118] Step S64: Pass the transformation result through a multilayer perceptron (mlp) (64, 128, 1024) layer to increase the dimension to 1024, and obtain the maximum n*1024 output result;

[0119] Step S65: Max pooling yields a 1024-dimensional global feature, which can specifically represent the original input model;

[0120] Step S66: Perform dimensionality reduction on the 1024-dimensional global features using a multilayer perceptron mlp(512, 256, k) and calculate cosine similarity to achieve 3D model matching. Select PointNet to extract significant k-dimensional features to ensure that the overall features of different scan data of the same entity remain consistent.

[0121] Cosine similarity measures the degree of similarity between two vectors in a given direction. It calculates the cosine of the angle between the vectors to assess similarity and is widely used in text processing, information retrieval, and recommender systems. This paper utilizes cosine similarity to calculate the k-dimensional feature similarity of point clouds to determine whether 3D model data corresponds to the same entity model.

[0122] Geometrically, the dot product of two vectors is equal to the product of their lengths and the cosine of their included angle. A positive dot product indicates an angle less than 90 degrees, meaning they are similar in direction; a value of 0 indicates they are perpendicular; and a negative dot product indicates an angle greater than 90 degrees, meaning they are opposite in direction. Cosine similarity utilizes this property, calculating the dot product by dividing by the product of the two vector lengths to measure the cosine of the angle between them. When the vectors are completely coincident (angle 0 degrees), the cosine similarity is 1; when they are completely opposite (angle 180 degrees), it is -1; and when they are perpendicular (angle 90 degrees), it is 0.

[0123] For two given vectors A and B, their cosine similarity can be expressed by the following formula:

[0124] .

[0125] In step S7, verifiable cryptographic audit trails are achieved through the deep integration of blockchain and zero-knowledge proofs: First, a notarization framework based on a consortium blockchain is constructed. Each block records operation logs in the form of an SM3 hash chain (previous block hash + current operation fingerprint + timestamp), and threshold signatures are used to ensure consensus in block generation. Key operations generate legitimacy proofs through zk-SNARK (such as proving that "data decryption requests comply with RBAC policy"). The verification process relies on elliptic curve pairing operations to compress the proof data to 288 bytes. At the same time, a hybrid index structure (Merkle Patricia Trie + Bloom Filter) is designed to achieve second-level audit queries, and the destruction of keys for violations is automatically triggered through smart contracts.

[0126] It is worth noting that the various units included in the above system embodiments are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0127] Furthermore, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware, and the corresponding program can be stored in a computer-readable storage medium.

[0128] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for real-time analysis and monitoring of port cyber-security information data, characterized in that, Comprise the following steps: Step S1: Deploy lightweight probe to collect port network information heterogeneous data, and map the collected data to three-dimensional space coordinates; Step S2: Construct a three-dimensional point cloud model according to each port network information point in the three-dimensional space coordinates; Step S3: Add point attribute information and establish a spatial index structure; Step S4: Layered encryption transmission of three-dimensional point cloud model; Step S5: The receiver uses the corresponding key to decrypt the data layer by layer according to the hierarchical order at the time of encryption; Step S6: Based on PointNet homomorphic machine learning, security neural network inference is performed; Step S7: Through encryption audit tracking, block chain storage is realized, and response feedback is realized; In the step S4, the specific process of layered encryption transmission of three-dimensional point cloud model is as follows: Step S41: According to the point cloud detail level or space region division, the three-dimensional point cloud data is divided into three levels; Step S42: Each level of the three-dimensional point cloud is encrypted; wherein, the first layer: the key feature points are strongly encrypted; the second layer: the attached points are moderately encrypted; the third layer: the remaining point cloud is lightly encrypted or part of the plaintext is encrypted; Step S43: Use independent key for each level, and the first layer key protects the second layer and third layer keys.

2. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S1, according to the type of port network information collected by the deployed lightweight probe, a regular polygon is constructed, the plane where the regular polygon is located is defined as the XY axis plane of the three-dimensional space, the center of the regular polygon is set as the Z axis of the three-dimensional space and is perpendicular to the plane where the XY axis is located, and the collected port network information heterogeneous data is mapped to the three-dimensional space coordinates.

3. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S2, the specific process of constructing a three-dimensional point cloud model according to each port network information point in the three-dimensional space coordinates is as follows: Step S21: Collect all three-dimensional space coordinate point data, and convert the coordinate point data into point cloud structure; Step S22: Add point attribute information to the generated point cloud, and establish a spatial index structure; Step S23: Filter and denoise the generated point cloud, and perform simplification processing.

4. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S3, the index of the three-dimensional point cloud model adopts the octree structure of hierarchical index structure, and the specific process is as follows: first, determine the space boundary of the point cloud, calculate the minimum cube containing all points as the root node; then set the maximum recursion depth and minimum voxel size parameters to control the fineness of the tree; from the root node, check whether the number of points in the current node exceeds the threshold and does not reach the maximum depth, if the conditions are met, the current cube is equally divided into 8 sub-cubes, and the points are distributed to the corresponding sub-nodes; recursively process each non-empty sub-node until all nodes no longer meet the subdivision condition or reach the maximum depth; finally, a hierarchical space structure is formed, the upper layer nodes represent large space regions, and the lower layer nodes represent finer sub-regions.

5. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S5, the receiver uses the corresponding key to decrypt the data layer by layer according to the hierarchical order at the time of encryption, and the specific process is as follows: Step S51: The secure channel obtains each layer key from the key distribution center; Step S52: Dynamically derive the decryption key according to the user attribute; Step S53: Deriving each layer sub-key from the master key; Step S54: Decrypting metadata, feature semantics, attribute information and basic set in order according to the hierarchy.

6. The method for real-time analysis and monitoring of security information data of a port network according to claim 5, characterized in that, In the step S54, the specific process of decrypting metadata, feature semantics, attribute information and basic set in order according to the hierarchy is as follows: Step S541, metadata layer decryption: decrypting metadata using the highest security level key, verifying metadata integrity, and obtaining decryption parameters of other levels; Step S542, feature semantic layer encryption: decrypting semantic information using a medium-strength algorithm, and verifying the logical consistency of feature data; Step S543, attribute information layer decryption: decrypting color and intensity attributes using a lightweight algorithm, and detecting the correspondence between attribute values and geometric data; Step S544, basic geometry layer decryption: final decryption of coordinate data to restore the original point cloud geometry.

7. The method for real-time analysis and monitoring of security information data of a port network according to claim 6, characterized in that, After the step S54, the decrypted data needs to be processed and verified, and the specific process is as follows: Step S55, data reorganization: recombining the decrypted data of each layer according to the original structure; Step S56, integrity verification: checking whether the hash value of the decrypted data is consistent with the record before encryption; Step S57, quality evaluation: evaluating the geometric accuracy and attribute fidelity of the decrypted point cloud.

8. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S6, based on the homomorphic machine learning of PointNet, the specific process of secure neural network inference is as follows: Step S61: Learning a 3*3 affine transformation matrix to perform coordinate transformation on the input point cloud; Step S62: The transformation result is passed through a multi-layer perceptron mlp (64, 64) to increase the dimension to 64; Step S63: Transforming the 64-dimensional features by learning a 64*64 transformation matrix; Step S64: The transformation result is passed through a multi-layer perceptron mlp (64, 128, 1024) layer to increase the dimension to 1024, obtaining an output result of maximum n*1024; Step S65: Through maximum pooling, a 1024-dimensional global feature can be obtained; Step S66: The 1024-dimensional global feature is reduced in dimension by a multi-layer perceptron mlp (512, 256, k), and the cosine similarity is calculated to realize 3D model matching.

9. The method for real-time analysis and monitoring of security information data of a port network according to claim 1, characterized in that, In the step S7, the deep integration of blockchain and zero-knowledge proof is realized to realize verifiable encryption audit tracking: first, a storage framework based on a consortium chain is constructed, each block records operation logs in the form of an SM3 hash chain, and threshold signature is used to ensure block generation consensus; ZK-SNARK is used to generate legality proof, and the verification process relies on elliptic curve pairing operation, which compresses the proof data to 288 bytes; At the same time, according to the hybrid index structure, the audit query is realized in seconds, and the key destruction of illegal operation is automatically triggered through the smart contract.

Images