A network risk assessment method for an industrial internet

Abstract

The present application relates to the technical field of data processing, more particularly, the present application relates to a network risk assessment method for industrial internet, comprising: acquiring network traffic value and network bandwidth value of industrial internet in real time; determining potential abnormal factors at the current time; determining algorithm bandwidth demand degree for self-adaptive correction of fixed bandwidth in mean shift clustering algorithm at the current time; determining adaptive bandwidth at the current time; clustering by using mean shift clustering algorithm to realize network risk assessment of industrial internet. The present application avoids two extreme problems caused by fixed bandwidth by dynamically adjusting bandwidth, so as to more accurately identify abnormal traffic; according to real-time network traffic value, historical data and potential abnormal factors, the optimal bandwidth suitable for the current situation is calculated, the clustering parameters are adjusted according to the network state, and more flexible and agile risk detection is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing. More particularly, the present application relates to a network risk assessment method for industrial internet. BACKGROUND

[0002] With the rapid development of industrial internet, many critical infrastructures, such as oil, electricity and high-end manufacturing, increasingly rely on network technology to realize the interconnection and intelligent management of equipment. Secure socket layer virtual private network (SSLVPN) technology is widely used as a key means to protect remote access security. SSLVPN builds an encrypted tunnel to provide secure and reliable remote access services for authorized users, thereby effectively protecting data from eavesdropping and tampering during transmission.

[0003] However, the traditional SSLVPN-based security protection system has inherent limitations. As the security boundary of the network, the main responsibility of the SSLVPN gateway is to protect the confidentiality and integrity of the communication link. However, due to its encryption feature, all traffic flowing through the gateway is encrypted traffic, which makes it impossible for conventional network security monitoring methods that rely on deep packet inspection (DPI) technology to effectively analyze the traffic content, forming an encrypted blind area. Therefore, industrial servers and control systems located after the gateway still face various internal risks, such as server downtime, distributed denial of service attacks, etc. These risks cannot be detected by the SSLVPN protocol itself. When a server experiences downtime or other emergency situations, manual intervention by the operations personnel is often required to coordinate the network or security team to manually adjust the security policies on the firewall and other devices. The entire emergency response process may be delayed for several hours, which cannot meet the requirements of business continuity and real-time performance in industrial scenarios. Therefore, the present application uses the Mean Shift clustering algorithm to detect network traffic data anomalies. When the server is down, all normal access requests from the client cannot be responded to, and the network traffic will show a sharp decline from the normal state, thereby achieving risk assessment and early warning for server downtime. Subsequently, the strategy engine of the SSLVPN is automatically called to isolate or reduce the weight of abnormal access sources in real time, depending on whether the server is down, thereby realizing an automatic closed loop from risk detection to active defense.

[0004] However, the performance of the mean shift clustering algorithm depends largely on the setting of its core parameter bandwidth, and the traditional way is usually to select a fixed size of bandwidth for all data points, which means that the neighborhood search range of all data points is exactly the same. This fixed way leads to the fact that if the bandwidth is set too large, the algorithm tends to converge all data points into a few large clusters, at this time, a few abnormal traffic data points caused by server downtime are easily submerged in the massive normal traffic clusters, resulting in false negatives and failing to accurately assess the downtime risk; on the contrary, if the bandwidth is set too small, the algorithm may split the data points into a large number of discrete small clusters, or even each data point forms a cluster, which will also lead to the fact that normal traffic fluctuations are misjudged as abnormal, resulting in a large number of false positives, which also affects the accuracy of the final network risk assessment. SUMMARY

[0005] In order to solve the problem of inaccurate server downtime risk assessment caused by mean shift clustering with fixed bandwidth in the prior art, which ultimately affects the accuracy of the policy engine scheduling of the SSLVPN, the present application proposes a network risk assessment method for industrial internet, which comprises the following steps:

[0006] Real-time acquisition of network traffic value and network bandwidth value of the industrial internet; record the time period to which the current time belongs as the current time period, record any adjacent two time points in the current time period as a time point pair, determine the stationary time point pair in the time point pair according to the difference of the network traffic value of the time points in the time point pair, determine the potential abnormal factor of the current time according to the network traffic value of the current time, the minimum value of the network traffic values of all time points in the current time period, and the stationary time point pair and the number of time point pairs; determine the algorithm bandwidth demand degree for adaptive correction of the fixed bandwidth in the mean shift clustering algorithm according to the potential abnormal factor, the network traffic value and the network bandwidth value of the current time, the mean value of the network traffic values of all historical time points with the same network bandwidth value as the current time in the network traffic history data, and the mean value of the network bandwidth values of all time points in the current time period; take the rounding result of the product of the algorithm bandwidth demand degree and the fixed bandwidth in the mean shift clustering algorithm as the adaptive bandwidth of the current time; based on the adaptive bandwidth, acquire the neighborhood of the current time in the mean shift clustering algorithm, and use the mean shift clustering algorithm to cluster the network traffic values of the current time and all time points in the neighborhood of the current time, to obtain abnormal traffic data, so as to realize the network risk assessment of the industrial internet.

[0007] The beneficial effects are that: by analyzing the difference of network flow values at adjacent time points to determine the stationary time point pair, and combining the current flow value, the historical minimum value and the stationarity statistics, an evaluation model of potential abnormal factors is constructed, which can effectively identify the abnormal fluctuation characteristics of network flow, and provide reliable input parameters for the calculation of bandwidth demand degree; by comprehensively considering the potential abnormal factors, real-time flow bandwidth, historical statistical data and period average bandwidth, an adaptive evaluation model of algorithm bandwidth demand degree is constructed, which can dynamically adjust the bandwidth parameters of the mean shift clustering algorithm according to the real-time changes of network state, and overcome the limitations of traditional fixed bandwidth setting; the fixed bandwidth is adaptively corrected based on the algorithm bandwidth demand degree, the intelligent adjustment of clustering parameters is realized, when the network flow fluctuates sharply or abnormally, the bandwidth is adaptively increased to avoid false negatives, when the network state is relatively stable, the bandwidth is adaptively reduced to improve the detection accuracy and avoid false positives; the adaptability and accuracy of the mean shift clustering algorithm in the industrial internet risk assessment are improved, a complete closed-loop control from server downtime risk detection to SSLVPN strategy automatic adjustment is realized, through adaptive bandwidth adjustment, the false negative rate and the false positive rate are effectively balanced, and reliable security protection is provided for the business continuity and real-time requirements of industrial scenarios.

[0008] Further, the network flow value is obtained by a flow monitoring tool in a network monitoring system, wherein the flow monitoring tool adopts Wireshark.

[0009] Further, the network bandwidth value is obtained by a bandwidth monitoring tool in a network monitoring system, wherein the bandwidth monitoring tool adopts iPerf.

[0010] Further, the stationary time point pair is obtained in the following manner: for any time point pair, the product of the mean value of the network flow values at the time points in the time point pair and a preset adjustment coefficient is taken as the fluctuation threshold of the time point pair; in response to the difference of the network flow values at the time points in the time point pair being less than the fluctuation threshold of the time point pair, the time point pair is recorded as a stationary time point pair.

[0011] The beneficial effects are that: the product of the mean value of the network flow values in each time point pair and the preset adjustment coefficient is used as the fluctuation threshold, which effectively reflects the network flow change range of different time periods, avoids false judgments caused by fixed threshold, and improves the detection accuracy of the stationary state; the fluctuation threshold is dynamically adjusted according to the actual flow change of each time point pair, so that the definition of the stationary time point is closer to the actual fluctuation level of the current network environment, and the sensitivity and adaptability of the algorithm to the network state change are enhanced.

[0012] Further, the potential abnormal factor satisfies:

[0013] ; in the formula, a potential abnormality factor for the current time, a network traffic value for the current time, a minimum value of network traffic values for all times in the current period, a number of pairs of stable times, a number of pairs of times, a standard normalization function, a natural exponential function, an absolute value symbol.

[0014] The beneficial effects are that the potential abnormality factor combines the normalized value of the traffic difference and the exponential decay term, fully considers the absolute deviation degree of the network traffic and the sensitivity of the abnormality factor to the number of pairs of stable times, and improves the expression ability of the abnormality index; the normalization function ensures the consistency of the index under different network traffic scales, and the introduction of the exponential function makes the influence of the potential abnormality factor dynamically change at different stages, enhancing the adaptive ability of the algorithm to network state changes.

[0015] Further, the algorithm bandwidth requirement degree satisfies:

[0016] ; in the formula, an algorithm bandwidth requirement degree for the current time for adaptively correcting the fixed bandwidth in the mean shift clustering algorithm, a potential abnormality factor for the current time, and respectively a network traffic value and a network bandwidth value for the current time, a mean value of network traffic values of all historical times in the network traffic historical data that are the same as the network bandwidth value of the current time, a mean value of network bandwidth values for all times in the current period, a hyperparameter, a preset adjustment factor for adjusting the value of the algorithm bandwidth requirement degree, a natural exponential function, a standard normalization function.

[0017] The beneficial effects are that by introducing multiple factors such as the potential abnormality factor and the difference between the network traffic and the bandwidth, the bandwidth requirement degree can be dynamically adjusted, so that the bandwidth allocation is more in line with the actual network state; calculating the mean value of the network traffic and the bandwidth mean value of the current time period using historical network data helps to filter out short-term fluctuations and improve the stability and robustness of bandwidth scheduling.

[0018] Further, the acquisition method of the neighborhood is that according to the adaptive bandwidth, a corresponding number of times are selected on both sides of the current time, and a data set composed of all times selected on both sides is recorded as the neighborhood of the current time in the mean shift clustering algorithm.

[0019] Further, the obtained abnormal traffic data comprises: for the clustering result containing the current time obtained by using the mean shift clustering algorithm, in response to the number of data points in the clustering result being less than a preset abnormal threshold, determining that the network traffic values of the time corresponding to all data points in the clustering result are abnormal traffic data.

[0020] Further, the network risk assessment of the industrial internet comprises: in response to the network traffic values of the continuous multiple time points containing the current time being all abnormal traffic data, determining that the industrial internet exists a server downtime risk, and completing the network risk assessment method for the industrial internet.

[0021] The present application has the following beneficial effects:

[0022] (1) Abandon the fixed bandwidth setting of the traditional mean shift clustering algorithm, realize self-adaptive adjustment through multi-dimensional parameter construction algorithm bandwidth demand, calculate potential abnormal factors based on adjacent time flow difference and stable time proportion, and quantify the abnormal tendency of the current flow; then, the real-time flow value, network bandwidth value and historical same bandwidth flow mean value are fused to accurately judge the bandwidth demand under the current scene, solve the contradiction of false alarm and false alarm caused by fixed bandwidth, and improve the identification accuracy of the clustering algorithm for abnormal flow.

[0023] (2) Since the adaptive bandwidth clustering can accurately distinguish between real abnormal flow and normal flow fluctuation, the output abnormal flow data can directly provide reliable decision basis for the SSLVPN policy engine, avoid the false alarm caused by the traditional fixed bandwidth, and avoid unnecessary isolation or missing risk source problems; for example, when the server downtime related abnormal flow is identified, the policy engine can accurately isolate the abnormal access source, and when it is determined to be normal fluctuation, there is no need to adjust the security policy redundantly, ensure that the defense action of the SSLVPN matches the actual risk, and improve the accuracy and efficiency of the network security protection of the industrial internet.

[0024] (3) Through the automatic process of real-time flow collection, adaptive bandwidth clustering and abnormal flow identification, the network risk assessment can be quickly completed, and the automatic isolation or weight reduction operation of the SSLVPN policy engine can be directly triggered, replacing the traditional manual intervention and manual adjustment of the lagging process of the policy, shortening the emergency response time, and ensuring that the server downtime, DDoS attack and other risks can be blocked in real time when the abnormal access occurs, avoiding business interruption or loss expansion. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is a step flow chart of a network risk assessment method for an industrial internet according to an embodiment of the present application.

[0026] Figure 2is a step flow chart of a network risk assessment method for an industrial internet according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below. The described embodiments are part of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0028] The specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0029] Please refer to Figure 1 which shows a step flow chart of a network risk assessment method for an industrial internet according to an embodiment of the present application. The method comprises the following steps:

[0030] S01: Real-time acquisition of network traffic value and network bandwidth value of the industrial internet.

[0031] It should be noted that the network monitoring system is used to acquire the network traffic value and the network bandwidth value (here, the acquired value is not the fixed network bandwidth of the device, but the real-time network bandwidth). For example, the acquisition frequency is ten times per second.

[0032] Specifically, the network traffic value is acquired by a traffic monitoring tool in the network monitoring system. For example, the traffic monitoring tool uses Wireshark.

[0033] Specifically, the network bandwidth value is acquired by a bandwidth monitoring tool in the network monitoring system. For example, the bandwidth monitoring tool uses iPerf.

[0034] S02: Determination of potential abnormal factor at the current time.

[0035] It should be noted that the smaller the network traffic value at a time, the more consistent it is with the numerical characteristics of the traffic data when the server is down, and the smaller the corresponding potential abnormal factor. However, there may be different numerical fluctuations in different time periods in the traffic data. Although such fluctuations are normal traffic data fluctuations, they may exhibit lower values. Therefore, it is necessary to continue to analyze the differences between the lower value data caused by normal fluctuations and the lower value data caused by abnormalities. The fewer the data pairs with small changes between adjacent network traffic values in the time period to which a time belongs, the greater the fluctuations in the traffic data in the time period to which the time belongs. The greater the probability that a time with a lower network traffic value belongs to normal data rather than abnormal data caused by server downtime.

[0036] A time period to which the current time belongs is recorded as a current time period, any two adjacent times in the current time period are recorded as a time pair, and a stable time pair in the time pair is determined according to a difference between network traffic values of the times in the time pair.

[0037] The implementer can set the size of the time period to which the current time belongs according to the specific implementation, for example, selecting 50 times before the current time and the current time to form the time period to which the current time belongs. It needs to be specially pointed out that the 50 times collected at the beginning of 5 seconds are used as the times for constructing the time period, and the subsequent step calculation is not performed.

[0038] Specifically, the stable time pair is obtained in the following manner:

[0039] For any time pair, a product of a mean value of network traffic values of the times in the time pair and a preset adjustment coefficient is taken as a fluctuation threshold of the time pair.

[0040] In response to the difference between the network traffic values of the times in the time pair being less than the fluctuation threshold of the time pair, the time pair is recorded as a stable time pair.

[0041] The implementer can set the adjustment coefficient according to the specific implementation, for example, .

[0042] According to the network traffic value of the current time, a minimum value of network traffic values of all times in the current time period, and a number of stable time pairs and time pairs, a potential abnormal factor of the current time is determined.

[0043] Specifically, the potential abnormal factor satisfies:

[0044] ;

[0045] In the formula, is the potential abnormal factor of the current time, is the network traffic value of the current time, is the minimum value of the network traffic values of all times in the current time period, is the number of stable time pairs, is the number of time pairs, is a standard normalization function, is a natural exponential function, is an absolute value symbol.

[0046] Wherein, The smaller the value is, the closer the network traffic value of the current time is to the minimum value of the network traffic values of all times in the time period to which the current time belongs, and the more it conforms to the numerical characteristics of the traffic data when the server is down, and the smaller the corresponding potential abnormal factor is. The smaller, the greater the fluctuation of the traffic data existing in the time period to which the current time belongs, and the greater the probability that the network traffic value of the current time is low is normal data rather than abnormal data caused by server downtime, and the smaller the corresponding potential abnormal factor.

[0047] S03: Determine the algorithm bandwidth requirement degree of the current time for adaptive correction of the fixed bandwidth in the mean shift clustering algorithm.

[0048] It should be noted that since network traffic data decreases as network bandwidth decreases, if the network bandwidth is artificially reduced, the corresponding network traffic will also decrease. Therefore, the time corresponding to the network traffic value with a smaller value caused by the reduction of bandwidth may be similar to the time corresponding to the network traffic value with a smaller value caused by server downtime, and the potential abnormal factors corresponding to the two times may be close. Therefore, in this step, the network bandwidth value of each time and the network traffic historical data are also analyzed to optimize the potential abnormal factor of each time to obtain the bandwidth requirement degree of each time (the bandwidth here is not the same as the network bandwidth, and the bandwidth here is the bandwidth in the algorithm); The greater the network bandwidth value of each time, the smaller the possibility that the network traffic value of the time is low due to bandwidth adjustment, the greater the possibility that it is affected by server downtime, and the smaller the bandwidth of the time should be set to make the algorithm more accurately detect the network traffic value corresponding to the time as abnormal data, so the corresponding algorithm bandwidth requirement degree is smaller. The smaller the network traffic value of each time compared to the mean value of the network traffic values of a number of times in the network traffic historical data with the same network bandwidth as the network traffic value, the smaller the possibility that it is affected by network bandwidth adjustment, the greater the possibility that it is affected by server downtime, the greater the credibility, and the smaller the corresponding algorithm bandwidth requirement degree.

[0049] According to the potential abnormal factor, the network traffic value and the network bandwidth value of the current time, the mean value of the network traffic values of all historical times in the network traffic historical data with the same network bandwidth value as the network bandwidth value of the current time, and the mean value of the network bandwidth values of all times in the current period, determine the algorithm bandwidth requirement degree of the current time for adaptive correction of the fixed bandwidth in the mean shift clustering algorithm.

[0050] Specifically, the algorithm bandwidth requirement degree satisfies:

[0051] ;

[0052] In the formula, is the algorithm bandwidth requirement degree of the current time for adaptive correction of the fixed bandwidth in the mean shift clustering algorithm, is the potential abnormal factor of the current time, and These represent the current network traffic and network bandwidth values, respectively. This is the average of network traffic values ​​at all historical moments in the network traffic history that have the same network bandwidth value as the current moment. This represents the average network bandwidth value across all points in the current time period. For hyperparameters, This is a preset adjustment factor used to adjust the bandwidth requirement value of the algorithm. It is a natural exponential function. Standard normalization function.

[0053] Implementers can set hyperparameters and adjustment factors according to the specific implementation situation. For example, a hyperparameter of 0.001 exists to prevent... This can lead to a situation where the exponential term in the formula is 0; the adjustment factor is 0.5, used to adjust the value of the algorithm bandwidth requirement at each time step to the range. .

[0054] in, The larger the value, the greater the likelihood that the current network traffic value is abnormal. Therefore, in order to more accurately detect it as abnormal data, the corresponding algorithm bandwidth requirement should be smaller, and a smaller bandwidth should be set for it in the future. The larger the value, the lower the network traffic value at the current moment compared to the average network traffic value at a time when the bandwidth was consistent with the historical network traffic data. The smaller the value, the less likely it is to be affected by bandwidth adjustments and the greater the likelihood that it is due to server downtime. The higher the reliability of the value, the lower the corresponding algorithm bandwidth requirement. The larger the value, the greater the bandwidth at the current moment. This indicates that when the network traffic value is low at the current moment, it is less likely to be affected by bandwidth adjustments and more likely to be due to server downtime. Therefore, the bandwidth should be set smaller at the current moment to make the algorithm's detection more accurate, and the corresponding algorithm bandwidth requirement is smaller.

[0055] S04: Determine the adaptive bandwidth at the current moment.

[0056] It's important to note that the lower the algorithm's bandwidth requirement at any given time, the greater the likelihood that the network traffic value at that time represents potentially outlier data. Therefore, to ensure the mean-shift clustering algorithm more accurately detects this data as an anomaly, a smaller bandwidth needs to be allocated to it. Conversely, the higher the algorithm's bandwidth requirement at any given time, the lower the likelihood that the network traffic value at that time represents potentially outlier data. Therefore, to prevent the algorithm from easily detecting this data as an anomaly, a larger bandwidth needs to be allocated to it.

[0057] According to the algorithm bandwidth requirement degree, the fixed bandwidth in the mean shift clustering algorithm is corrected to obtain the adaptive bandwidth at the current moment.

[0058] Specifically, the adaptive bandwidth satisfies:

[0059] ;

[0060] In the formula, is the adaptive bandwidth at the current moment, is the fixed bandwidth in the mean shift clustering algorithm, is the algorithm bandwidth requirement degree for adaptively correcting the fixed bandwidth in the mean shift clustering algorithm at the current moment, is a rounding function.

[0061] The implementer can fix the bandwidth according to the specific implementation, for example, the fixed bandwidth is 1.5 times of the standard deviation of the network traffic values of all moments (including the first 50 moments) up to the current moment.

[0062] S05: Clustering is performed using the mean shift clustering algorithm to realize network risk assessment of the industrial internet.

[0063] Based on the adaptive bandwidth, the neighborhood in the mean shift clustering algorithm at the current moment is obtained, and the network traffic values of the current moment and all moments in the neighborhood at the current moment are clustered using the mean shift clustering algorithm to obtain abnormal traffic data, thereby realizing network risk assessment of the industrial internet.

[0064] The implementer can set the number of iterations of the mean shift clustering algorithm according to the specific implementation, for example, 6 times.

[0065] Specifically, the neighborhood is obtained in the following manner:

[0066] According to the adaptive bandwidth, a corresponding number of moments are selected on both sides of the current moment, and a data set composed of all the selected moments on both sides is recorded as the neighborhood of the current moment in the mean shift clustering algorithm.

[0067] Specifically, the abnormal traffic data is obtained by:

[0068] For the clustering result obtained by using the mean shift clustering algorithm and containing the current moment, in response to the number of data points in the clustering result being less than a preset abnormal threshold, it is determined that the network traffic values of the moments corresponding to all data points in the clustering result are abnormal traffic data.

[0069] The implementer can set the abnormal threshold according to the specific implementation, for example, 6.

[0070] Specifically, the network risk assessment for implementing the industrial internet comprises:

[0071] In response to the network traffic values of the continuous multiple time points including the current time being all abnormal traffic data, it is determined that the industrial internet has a server downtime risk, and the network risk assessment method for the industrial internet is completed.

[0072] The number of continuous multiple time points can be set by the implementer according to the specific implementation, for example, 10.

[0073] As shown in Figure 2 The network risk assessment method for the industrial internet provided in Embodiment 2 of the present application further comprises a step S06, which is specifically as follows:

[0074] S06: Based on the result of the network risk assessment, the server state caused by the abnormal access source is identified, and the SSLVPN policy engine is called to isolate or reduce the weight of the abnormal access source.

[0075] After the potential server downtime risk is assessed, the result of the risk assessment directly drives the SSLVPN policy engine to automatically respond:

[0076] (1) When it is determined that the server is down, the SSLVPN policy engine immediately identifies the access source IP addresses that continuously send abnormal traffic within the time window, and then the engine automatically adds these IP addresses to the dynamic black list of the SSLVPN, forcibly terminates all established SSL sessions, and rejects all new connection requests, thereby preventing the possible attack source from continuing to consume server resources, and creating a safe environment for server recovery or manual intervention.

[0077] (2) When the server state is normal and the downtime alarm is not triggered, the policy engine checks whether there is an IP that has triggered a high-risk alarm in the history record in the currently active access source IP, and if there is, the IP that has triggered a high-risk alarm is executed to reduce the weight monitoring, and the specific measures include but are not limited to: limiting the maximum number of concurrent connections, reducing the priority of data transmission in traffic scheduling, and shortening the interval of session heartbeat detection to perform more intensive health state monitoring.

[0078] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. within the principles of the present application shall be included in the protection scope of the present application.

Claims

1.A network risk assessment method for an industrial internet, characterized by, The method comprises the following steps: real-time acquisition of network traffic value and network bandwidth value of the industrial internet; a time period to which the current time belongs is recorded as a current time period, any adjacent two times in the current time period are recorded as a time pair, a stable time pair in the time pair is determined according to the difference of the network traffic values of the times in the time pair, a potential abnormal factor of the current time is determined according to the network traffic value of the current time, the minimum value of the network traffic values of all times in the current time period, and the stable time pair and the number of time pairs; an algorithm bandwidth demand degree of the current time for adaptive correction of the fixed bandwidth in the mean shift clustering algorithm is determined according to the potential abnormal factor, the network traffic value and the network bandwidth value of the current time, the average value of the network traffic values of all historical times with the same network bandwidth value as the current time in the network traffic history data, and the average value of the network bandwidth values of all times in the current time period; a rounding result of the product of the algorithm bandwidth demand degree and the fixed bandwidth in the mean shift clustering algorithm is taken as the adaptive bandwidth of the current time; a neighborhood of the current time in the mean shift clustering algorithm is acquired based on the adaptive bandwidth, the network traffic values of the current time and all times in the neighborhood of the current time are clustered by using the mean shift clustering algorithm, and abnormal traffic data is obtained, so as to realize network risk assessment of the industrial internet. 2.The network risk assessment method for the industrial internet of claim 1, wherein, The network traffic value is acquired by a flow monitoring tool in a network monitoring system. 3.The network risk assessment method for industrial internet of claim 1, wherein, The network bandwidth value is acquired by a bandwidth monitoring tool in the network monitoring system. 4.The network risk assessment method for the industrial internet of claim 1, wherein, The stable time pair is acquired in the following manner: for any time pair, a product of the average value of the network traffic values of the times in the time pair and a preset adjustment coefficient is taken as a fluctuation threshold of the time pair; in response to the difference of the network traffic values of the times in the time pair being less than the fluctuation threshold of the time pair, the time pair is recorded as a stable time pair. 5.The network risk assessment method for industrial internet of claim 1, wherein, The potential abnormal factor satisfies: ； wherein is a potential anomaly factor for the current time instant, is a network traffic value for the current time instant, is a minimum value among network traffic values for all time instants within the current time period, is a number of pairs of stationary time instants, is a number of pairs of time instants, is a standard normalization function, is a natural exponential function, is an absolute value sign. 6.The network risk assessment method for the industrial internet of claim 1, wherein, The algorithm bandwidth demand degree satisfies: ； In the formula, is the algorithm bandwidth requirement degree for adaptively correcting the fixed bandwidth in the mean shift clustering algorithm at the current time, is the potential abnormal factor at the current time, are the network traffic value and the network bandwidth value at the current time respectively, are the network traffic value and the network bandwidth value at the current time respectively, is the mean of the network traffic values of all historical time points in the network traffic historical data that have the same network bandwidth value as the network bandwidth value at the current time, is the mean of the network bandwidth values of all time points in the current period, is a hyperparameter, is a preset adjustment factor for adjusting the value of the algorithm bandwidth requirement degree, is a natural exponential function, is a standard normalization function. 7.The network risk assessment method for industrial internet of claim 1, wherein, The neighborhood is acquired in the following manner: according to the adaptive bandwidth, a corresponding number of times are selected on both sides of the current time, and a data set composed of all the times selected on both sides is recorded as the neighborhood of the current time in the mean shift clustering algorithm. 8.The network risk assessment method for the industrial internet of claim 1, wherein, The abnormal traffic data is obtained in the following manner: for a clustering result containing the current time obtained by using the mean shift clustering algorithm, in response to the number of data points in the clustering result being less than a preset abnormal threshold, the network traffic values of the times corresponding to all the data points in the clustering result are determined as abnormal traffic data. 9.The network risk assessment method for industrial internet of claim 8, wherein, The network risk assessment of the industrial internet is realized in the following manner: in response to the network traffic values of a plurality of continuous times containing the current time all being abnormal traffic data, it is determined that the industrial internet has a server downtime risk, and the network risk assessment method for the industrial internet is completed.

Images