Internet data analysis method and device, terminal equipment and storage medium

Abstract

The invention discloses an Internet data analysis method and apparatus, a terminal device and a storage medium. The method comprises the steps of obtaining enterprise operation data and technical security event data; adopting a time window and a shared identifier to carry out first matching on the enterprise operation data and the technology security event data to obtain candidate operation associated information, carrying out second matching on the candidate operation associated information according to a pre-established association rule base to obtain target operation associated information, and sending the target operation associated information to a server; determining a business influence factor by adopting a preset business influence evaluation model and the target operation associated information; calculating risk parameters corresponding to the technical security event data according to the service influence factors, determining early warning information of the technical security event data according to the risk parameters corresponding to the technical security event data, and performing analysis and risk assessment on the technical security event in a specific service context. And the data security analysis capability and the risk early warning timeliness and accuracy in the industrial internet environment are improved.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, and in particular relates to a method, apparatus, terminal equipment and storage medium for analyzing Internet data. Background Technology

[0002] In large, complex manufacturing enterprises, the Industrial Internet architecture has been widely adopted to improve production efficiency and management levels, deeply integrating traditional operational (OT) control systems with enterprise information management (IT) systems. To enhance the security of industrial control networks, some enterprises have deployed honeypot systems. Honeypot systems contain honeypot nodes that simulate real critical production equipment or data servers, designed to lure attackers. Honeypot systems can capture attackers' reconnaissance and probing activities within the network and record their interactions in detail, such as network scanning, connection attempts, and malicious command sending, thereby generating honeypot security event data. However, the events captured by honeypots are often early stages of the attack chain, and their individual analysis may only consider them low-risk behaviors. For example, an attacker's scanning behavior of simulated equipment may appear to have a low risk level on its own.

[0003] Attacks are often multi-stage. After completing early reconnaissance, attackers may launch more targeted attacks on the actual production system after a period of time. For example, they might make minor, imperceptible modifications to key process parameters in the SCADA system on the actual production line. Such modifications are small and may not trigger traditional alarms based on fixed thresholds, or the triggered alarm level may be low and easily ignored. The key challenge facing existing security analysis methods is the difficulty in automatically, in real-time, and effectively correlating and analyzing technical security events such as early reconnaissance behaviors captured by honeypot systems and subsequent minor parameter modifications recorded by SCADA systems with operational data such as production plans, order information, material batches, and equipment maintenance plans contained in enterprise management systems such as ERP, MES, SCM, and asset management systems. How to achieve cross-system data analysis between production control systems and enterprise management systems, and improve the accuracy of data analysis, is an urgent problem to be solved. Summary of the Invention

[0004] This application aims to provide a method, apparatus, terminal device, and storage medium for analyzing Internet data to address the shortcomings of existing technologies. The technical problem to be solved by this application is achieved through the following technical solutions.

[0005] In a first aspect, embodiments of this application provide a method for analyzing Internet data, the method comprising:

[0006] Acquire enterprise operational data and technical security incident data;

[0007] Using a time window and a shared identifier, the enterprise operation data and technical security incident data are matched for the first time to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security incident data;

[0008] Based on a pre-established association rule base, a second matching is performed on the first enterprise operation data and the first technical security event data in the candidate operation association information to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules.

[0009] Using a pre-set business impact assessment model and the target operational correlation information, business impact factors are determined. The business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage, and risk level.

[0010] Based on the business impact factors, calculate the risk parameters corresponding to the technical security incident data, wherein the risk parameters include at least a risk score or priority;

[0011] Based on the risk parameters corresponding to the technical security incident data, early warning information for the technical security incident data is determined.

[0012] Optionally, the pre-established association rule base is obtained in the following way:

[0013] The static rules are determined based on the predefined mapping relationship between device types and attack types;

[0014] Initial dynamic rules are generated based on historical security incident data, historical operational data, and the correlation between the historical security incident data and the historical operational data.

[0015] The confidence level of the initial dynamic rule is set based on the association strength and support of the association relationship;

[0016] The initial dynamic rules are sorted in descending order based on the confidence level to obtain the dynamic rules;

[0017] The static rules and the dynamic rules are used to determine the association rule base.

[0018] Optionally, the second matching of the first enterprise operation data and the first technical security event data in the candidate operation association information based on a pre-established association rule base to obtain the target operation association information includes:

[0019] If the first technical security incident data satisfies the pre-established association rule base, it is determined that the first technical security incident data and the first enterprise operation data are related, and the first operation association information is obtained;

[0020] If the first technical security incident data does not meet the pre-established association rule base, a heterogeneous graph is generated based on the first technical security incident data and the first enterprise operation data;

[0021] The association analysis method of graph neural network is used to predict the association relationship of each node in the heterogeneous graph to obtain the second operation association information;

[0022] The target operational association information is determined based on the first operational association information and the second operational association information.

[0023] Optionally, the association analysis method using graph neural networks to predict the association relationships of each node in the heterogeneous graph to obtain second operational association information includes:

[0024] The graph neural network association analysis method is used to perform multiple rounds of iterative learning on each node in the heterogeneous graph. In each round of iteration, the information of adjacent nodes is aggregated according to the edge weights. The influence weights of different neighboring nodes on the target node are dynamically adjusted using the attention mechanism. The deep association between nodes is learned to obtain the security risk score of each node in the heterogeneous graph. The node is the first technical security event data and the first enterprise operation data.

[0025] If the security risk score is greater than a preset threshold, it is determined that there is a correlation between the first technical security incident data and the first enterprise operation data, and the correlation is determined as the second operational correlation information.

[0026] Optionally, the step of calculating risk parameters corresponding to technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority, including:

[0027] Based on the mapping relationship between order value, equipment criticality, production stage, and risk level, the business impact assessment model is determined;

[0028] Match the first technical security incident data with the business impact assessment model;

[0029] If the first technical security incident data matches the business impact assessment model, determine the first matching result corresponding to the first technical security incident data;

[0030] If the first technical security incident data and the business impact assessment model do not match, a fuzzy matching algorithm is used to calculate the similarity between each record in the first enterprise operation data and the business impact assessment model, and the distance with the highest similarity is determined as the second matching result.

[0031] The business impact factors are determined based on the first matching result and the second matching result, wherein the business impact factors include at least the order value level, the criticality of the equipment, and the completion rate of the production stage;

[0032] Based on the pre-set risk scoring calculation method and the business impact factors, calculate the risk score of the target technical security event data in the target operation-related information;

[0033] The risk scores of the target technical security incident data in the target operation association information are sorted in descending order to obtain the risk parameters corresponding to the technical security incident data.

[0034] Optionally, the acquisition of enterprise operational data includes:

[0035] Initial enterprise operation data is obtained by configuring data source connection parameters and API interfaces;

[0036] The initial enterprise operation data is cleaned using preset cleaning rules to obtain cleaned enterprise operation data;

[0037] According to predefined conversion rules, the cleaned enterprise operation data is mapped to preset fields in the enterprise operation status database, and the material codes of the cleaned enterprise operation data are converted into standard codes of the physical list to obtain the enterprise operation data.

[0038] Optionally, the acquisition of technical security event data includes:

[0039] Initial technical security event data is obtained from the honeynet system by configuring data source connection parameters;

[0040] Based on a pre-set security knowledge base, malicious code and attack patterns are identified in the initial technical security event data.

[0041] If malicious code and attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated.

[0042] According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the preset security event data to generate the technical security event data containing technical attributes and business association fields.

[0043] Secondly, embodiments of this application provide an internet data analysis device, the device comprising:

[0044] The acquisition module is used to acquire enterprise operational data and technical security incident data.

[0045] The first matching module is used to perform a first matching of the enterprise operation data and the technical security event data using a time window and a shared identifier to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security event data.

[0046] The second matching module is used to perform a second matching on the first enterprise operation data and the first technical security event data in the candidate operation association information according to the pre-established association rule base to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules.

[0047] The search module is used to determine business impact factors by using a preset business impact assessment model and the target operational correlation information. The business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage and risk level.

[0048] The calculation module is used to calculate the risk parameters corresponding to the technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority.

[0049] The early warning module is used to determine the early warning information of the technical security incident data based on the risk parameters corresponding to the technical security incident data.

[0050] Optionally, the pre-established association rule base is obtained in the following way:

[0051] The static rules are determined based on the predefined mapping relationship between device types and attack types;

[0052] Initial dynamic rules are generated based on historical security incident data, historical operational data, and the correlation between the historical security incident data and the historical operational data.

[0053] The confidence level of the initial dynamic rule is set based on the association strength and support of the association relationship;

[0054] The initial dynamic rules are sorted in descending order based on the confidence level to obtain the dynamic rules;

[0055] The static rules and the dynamic rules are used to determine the association rule base.

[0056] Optionally, the second matching module is used for:

[0057] If the first technical security incident data satisfies the pre-established association rule base, it is determined that the first technical security incident data and the first enterprise operation data are related, and the first operation association information is obtained;

[0058] If the first technical security incident data does not meet the pre-established association rule base, a heterogeneous graph is generated based on the first technical security incident data and the first enterprise operation data;

[0059] The association analysis method of graph neural network is used to predict the association relationship of each node in the heterogeneous graph to obtain the second operation association information;

[0060] The target operational association information is determined based on the first operational association information and the second operational association information.

[0061] Optionally, the second matching module is used for:

[0062] The graph neural network association analysis method is used to perform multiple rounds of iterative learning on each node in the heterogeneous graph. In each round of iteration, the information of adjacent nodes is aggregated according to the edge weights. The influence weights of different neighboring nodes on the target node are dynamically adjusted using the attention mechanism. The deep association between nodes is learned to obtain the security risk score of each node in the heterogeneous graph. The node is the first technical security event data and the first enterprise operation data.

[0063] If the security risk score is greater than a preset threshold, it is determined that there is a correlation between the first technical security incident data and the first enterprise operation data, and the correlation is determined as the second operational correlation information.

[0064] Optionally, the computing module is used for:

[0065] Based on the mapping relationship between order value, equipment criticality, production stage, and risk level, the business impact assessment model is determined;

[0066] Match the first technical security incident data with the business impact assessment model;

[0067] If the first technical security incident data matches the business impact assessment model, determine the first matching result corresponding to the first technical security incident data;

[0068] If the first technical security incident data and the business impact assessment model do not match, a fuzzy matching algorithm is used to calculate the similarity between each record in the first enterprise operation data and the business impact assessment model, and the distance with the highest similarity is determined as the second matching result.

[0069] The business impact factors are determined based on the first matching result and the second matching result, wherein the business impact factors include at least the order value level, the criticality of the equipment, and the completion rate of the production stage;

[0070] Based on the pre-set risk scoring calculation method and the business impact factors, calculate the risk score of the target technical security event data in the target operation-related information;

[0071] The risk scores of the target technical security incident data in the target operation association information are sorted in descending order to obtain the risk parameters corresponding to the technical security incident data.

[0072] Optionally, the acquisition module is used to:

[0073] Initial enterprise operation data is obtained by configuring data source connection parameters and API interfaces;

[0074] The initial enterprise operation data is cleaned using preset cleaning rules to obtain cleaned enterprise operation data;

[0075] According to predefined conversion rules, the cleaned enterprise operation data is mapped to preset fields in the enterprise operation status database, and the material codes of the cleaned enterprise operation data are converted into standard codes of the physical list to obtain the enterprise operation data.

[0076] Optionally, the acquisition module is used to:

[0077] Initial technical security event data is obtained from the honeynet system by configuring data source connection parameters;

[0078] Based on a pre-set security knowledge base, malicious code and attack patterns are identified in the initial technical security event data.

[0079] If malicious code and attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated.

[0080] According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the preset security event data to generate the technical security event data containing technical attributes and business association fields.

[0081] Thirdly, embodiments of this application provide a terminal device, including: at least one processor and a memory;

[0082] The memory stores a computer program; the at least one processor executes the computer program stored in the memory to implement the Internet data analysis method provided in the first aspect.

[0083] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed, implements the Internet data analysis method provided in the first aspect.

[0084] The embodiments of this application have the following advantages:

[0085] The internet data analysis method, apparatus, terminal device, and storage medium provided in this application embodiment acquire enterprise operation data and technical security incident data; use a time window and shared identifier to perform a first match on the enterprise operation data and technical security incident data to obtain candidate operation association information, wherein the candidate operation association information includes at least first enterprise operation data and first technical security incident data; according to a pre-established association rule base, perform a second match on the first enterprise operation data and first technical security incident data in the candidate operation association information to obtain target operation association information, wherein the association rule base includes at least static rules and dynamic rules; and use a preset business impact assessment model and the target operation association information to determine business impact factors, wherein the business impact assessment model includes at least order value, equipment criticality, and production... The method establishes a mapping relationship between production stages and risk levels; calculates risk parameters corresponding to technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority; and determines early warning information for the technical security incident data based on the risk parameters corresponding to the technical security incident data. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents within specific business contexts for analysis and risk assessment. This improves the data security analysis capabilities and the timeliness and accuracy of risk warnings in the industrial internet environment, and has the ability to correlate technical security incidents with operational data. It assesses security incident risks based on business context, generates alarm information containing business context to improve the accuracy of attack intent judgment, achieves timely early warning, and supports the beneficial effect of taking measures before the attack impacts. Attached Figure Description

[0086] To more clearly illustrate the embodiments of this application or the existing technical solutions, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0087] Figure 1 This is a flowchart illustrating an internet data analysis method according to an embodiment of this application;

[0088] Figure 2 This is a flowchart illustrating another method for analyzing Internet data in one embodiment of this application;

[0089] Figure 3 This is a structural block diagram of an embodiment of an Internet data analysis device according to this application;

[0090] Figure 4 This is a schematic diagram of the structure of a terminal device according to this application. Detailed Implementation

[0091] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0092] One embodiment of this application provides a method for analyzing internet data, used for security analysis of cross-system data. The executing entity in this embodiment is an internet data analysis device, installed on a terminal device, such as a computer terminal.

[0093] Reference Figure 1 The diagram illustrates a flowchart of an embodiment of an internet data analysis method according to this application. The method may specifically include the following steps:

[0094] S101. Obtain enterprise operational data and technical security incident data;

[0095] Specifically, the terminal device acquires key operational data, cleans and transforms the key operational data to obtain enterprise operational data, and stores it in the enterprise operational status database; it acquires initial technical security event data through the honeynet system, and converts the extracted technical security event data into standardized security event data containing technical attributes and business-related fields, i.e., technical security event data.

[0096] In other words, terminal devices connect to enterprise management systems, such as ERP, MES, SCM, or asset management systems, and obtain key operational data through configured data source connection parameters and API interfaces. The acquired data is uniformly packaged into JSON format and standardized using preset cleaning rules to identify and remove invalid, erroneous, or duplicate data. The cleaned data is mapped to preset fields in the enterprise operational status database according to predefined transformation rules, material codes are converted into standard codes for the bill of materials, and finally stored in the database.

[0097] Furthermore, the terminal device connects to the honeynet system, collects technical security event data through configured data source connection parameters, and encapsulates the data into a unified XML format. For the XML data, malicious code and attack patterns are identified based on a preset security knowledge base, generating event data containing preliminary verification results. According to preset mapping rules, the event data is mapped to preset fields of standardized security event data, generating standardized security event data containing technical attributes and business-related fields.

[0098] S102. Using a time window and a shared identifier, perform the first matching of enterprise operation data and technical security incident data to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security incident data;

[0099] S103. Based on the pre-established association rule base, perform a second match on the first enterprise operation data and the first technical security event data in the candidate operation association information to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules.

[0100] Specifically, the terminal device initially matches enterprise operation data and technical security incident data, and filters out candidate operation-related information through time windows and shared identifiers. The candidate operation-related information includes at least the first enterprise operation data and the first technical security incident data.

[0101] Based on the association rule base, the first enterprise operation data and the first technical security event data in the candidate operation association information are deeply matched. The first enterprise operation data and the first technical security event data are matched to obtain the target operation association information, which includes the second enterprise operation data and the second technical security event data.

[0102] In other words, standardized security incident data (i.e., first technical security incident data) is matched with operational data (i.e., first enterprise operational data) in the enterprise operational status database. The initial matching filters candidate operational association information through time windows and shared identifiers. Further, based on the association rule base, the standardized security incident data and operational data in the candidate operational association information are deeply matched to determine the business logic association.

[0103] S104. Using a pre-set business impact assessment model and target operational information, determine business impact factors. The business impact assessment model shall include at least the mapping relationship between order value, equipment criticality, production stage and risk level.

[0104] S105. Based on the business impact factors, calculate the risk parameters corresponding to the technical security incident data, wherein the risk parameters shall include at least a risk score or priority.

[0105] Specifically, the terminal device queries the corresponding business impact factors from the preset business impact assessment model based on the matched target operational association information. The business impact assessment model includes the mapping relationship between order value, equipment criticality, production stage and risk level. Then, based on the mapping relationship between order value, equipment criticality, production stage and risk level, the risk score or priority of the first safety event is calculated.

[0106] S106. Based on the risk parameters corresponding to the technical security incident data, determine the early warning information for the technical security incident data.

[0107] Specifically, the terminal device triggers alarms based on risk scores or priorities, generating alarm information containing technical details of the security event and associated business context information to issue a risk alert. Alarms are triggered based on calculated risk scores or priorities. If the risk score or priority reaches a preset threshold, alarm information is generated, containing technical details of the security event and associated business context information, and a risk alert is issued. Through the collaborative work of these modules, the system can automatically and in real-time process massive amounts of heterogeneous data, placing technical security events within specific business contexts for analysis and risk assessment, thus improving data security analysis capabilities and the timeliness and accuracy of risk warnings in the industrial internet environment.

[0108] This application embodiment acquires and processes key operational data, stores it in a structured manner, and establishes a digital representation of the enterprise's operational status. It then acquires and standardizes technical security incident data from a honeycomb system; matches the standardized security incident data with operational data in the enterprise's operational status database; calculates the risk score or priority of security incidents using operational correlation information; and triggers alarms based on the risk score or priority. Therefore, this application embodiment associates dispersed technical security incidents with enterprise operational data, assesses risks based on business context, and issues alarms containing business information. This solves the problem of existing methods struggling to analyze technical incidents within a business context, and has the beneficial effects of enabling timely early warning and supporting preventative measures before attacks occur.

[0109] The internet data analysis method provided in this application involves: acquiring enterprise operation data and technical security incident data; performing a first match on the enterprise operation data and technical security incident data using a time window and shared identifiers to obtain candidate operation-related information, wherein the candidate operation-related information includes at least first enterprise operation data and first technical security incident data; performing a second match on the first enterprise operation data and first technical security incident data in the candidate operation-related information according to a pre-established association rule base to obtain target operation-related information, wherein the association rule base includes at least static rules and dynamic rules; and determining business impact factors using a preset business impact assessment model and the target operation-related information, wherein the business impact assessment model includes at least order value, equipment criticality, production stage, and risk level. The mapping relationship is established; based on business impact factors, risk parameters corresponding to technical security incident data are calculated, where risk parameters include at least risk scores or priorities; based on the risk parameters corresponding to technical security incident data, early warning information for technical security incident data is determined. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents in specific business contexts for analysis and risk assessment, improving data security analysis capabilities and the timeliness and accuracy of risk early warning in the industrial internet environment, and having the ability to correlate technical security incidents with operational data; based on business context, security incident risks are assessed, and alarm information containing business context is generated to improve the accuracy of attack intent judgment, achieve timely early warning, and support the beneficial effect of taking measures before the impact of attacks.

[0110] Another embodiment of this application further supplements the description of the Internet data analysis method provided in the above embodiments.

[0111] Optionally, the pre-established association rule base is obtained in the following way:

[0112] Static rules are determined based on the predefined mapping relationship between device types and attack types;

[0113] Initial dynamic rules are generated based on historical security incident data, historical operational data, and the correlation between historical security incident data and historical operational data.

[0114] Set confidence levels for the initial dynamic rules based on the association strength and support of the relationships;

[0115] The initial dynamic rules are sorted in descending order based on their confidence scores to obtain the dynamic rules.

[0116] Determine the association rule base by combining static and dynamic rules.

[0117] Specifically, this application embodiment first establishes an association rule base, which stores rules used to determine the business logic association between technical security events and operational data. The association rule base contains two types of rules: static rules and dynamic rules. Among them, predefined mapping relationships between device types and attack types are used to construct static rules; static rules are predefined, relatively fixed association patterns, such as the association between a specific type of security event (such as a scan targeting a PLC) and a specific type of device (such as a PLC device on a production line).

[0118] Dynamic rules are learned by analyzing the correlation patterns between historical security incident data and historical operational data. These rules may reflect more complex or time-varying relationships, and each dynamic rule calculates and stores a confidence score, indicating the credibility of the correlation pattern. Next, the input standardized security incident data and operational data in the enterprise operational status database are initially matched. This initial matching process uses time windows and shared identifiers (such as device IDs, IP addresses, order numbers, etc.) to quickly filter out operational data that may be related in time and identifiers, forming a small set of candidate operational correlation information. Then, deep matching is performed on this candidate set.

[0119] For each pair of standardized security event data and operational data in the candidate set, the method queries the association rule base. If the pair of data satisfies any static rule in the association rule base, or satisfies a dynamic rule with a confidence level higher than a preset threshold, it is determined that there is a business logic association between the standardized security event data and the operational data, and the relevant operational data is output as operational association information.

[0120] This phased, rule-based matching method can more accurately identify the correlation between technical security incidents and specific operational activities, overcome the underreporting or false alarm problems that may be caused by simple matching, and provide a more reliable basis for subsequent risk assessment.

[0121] This application embodiment collects historical security event data and historical operational data. Based on the correlation between the historical security event data and the historical operational data, it generates initial dynamic rules and calculates the confidence level for each dynamic rule based on the correlation strength and support of the correlation. The initial dynamic rules are then sorted in descending order based on the confidence level to obtain the dynamic rules. Finally, the rule association library is constructed based on the static rules and the dynamic rules.

[0122] This application's embodiments construct a rule association library by combining static and dynamic rules, solving the problem of how to build a rule library that can effectively capture the correlation between technical security events and complex and diverse operational data. By collecting historical security event data and historical operational data, and analyzing the correlation between them, association rules based on actual historical patterns can be discovered, generating initial dynamic rules. Simultaneously, the confidence level of each dynamic rule is calculated, quantifying the rule's reliability or strength in historical data. Association strength and support are used to evaluate the rule confidence level.

[0123] Then, the initial dynamic rules are sorted in descending order based on the calculated confidence level, so that when matching with the rule base in the future, dynamic rules that have shown higher reliability in historical data can be given priority.

[0124] Finally, the static rules and the sorted dynamic rules are combined to construct the final rule association library. This rule library contains predefined known associations as well as association patterns with different confidence levels learned from historical data.

[0125] In this way, the rule base includes both basic known associations and dynamic associations learned from historical data. The introduction of confidence levels makes the rule base more flexible and effective, allowing for a trade-off between the reliability of rules during the matching process. This more comprehensive and effective rule base supports subsequent deep matching, helping to more accurately identify the business logic relationships between technical security incidents and operational data, thereby providing more reliable input for subsequent risk assessment and alerts.

[0126] Optionally, based on a pre-established association rule base, a second matching is performed on the first enterprise operation data and the first technical security event data in the candidate operation association information to obtain the target operation association information, including:

[0127] If the data of the first technical security incident meets the pre-established association rule base, it is determined that there is an association between the data of the first technical security incident and the data of the first enterprise operation, and the first operation association information is obtained;

[0128] If the first technical security incident data does not meet the pre-established association rule base, a heterogeneous graph is generated based on the first technical security incident data and the first enterprise operation data;

[0129] The association analysis method of graph neural network is used to predict the association relationship of each node in the heterogeneous graph and obtain the second operation association information.

[0130] Based on the first operational association information and the second operational association information, the target operational association information is determined.

[0131] Specifically, after the standardized security incident data (first technical security incident data) and operational data undergo deep matching with the rule base, if no correlation relationship matching the static or dynamic rules is found, a correlation analysis process based on graph neural networks is initiated.

[0132] First, the standardized security incident data and related operational data to be analyzed are abstracted into nodes in a heterogeneous graph. For example, a scan event targeting a specific device can be a security incident node, while the device's current operating status, its production order, maintenance records, and other operational data can be represented as different operational data nodes. Edges are then established between these nodes. For instance, a "acting on" edge can be established between a security incident node and the operational data node of the device it targets; a "same order" edge can be established between operational data nodes of devices under the same production order; and a "time proximity" edge can be established between events and operational data occurring at similar times.

[0133] After constructing the heterogeneous graph, it is input into a graph neural network model. The graph neural network performs multi-layer iterative computation; in each layer, nodes receive and aggregate information from their neighbors, updating their representations accordingly. This learning process enables the graph neural network to understand the structural position of nodes within the graph and their complex relationships with other nodes. Through this learning, the graph neural network can identify hidden, non-explicit patterns of association between security event nodes and operational data nodes.

[0134] Based on the learned patterns, graph neural networks predict which operational data nodes are potentially associated with security event nodes.

[0135] Optionally, a graph neural network-based association analysis method is used to predict the association relationships between nodes in the heterogeneous graph, thereby obtaining second operational association information, including:

[0136] The graph neural network association analysis method is used to perform multiple rounds of iterative learning on each node in the heterogeneous graph. In each round of iteration, the information of neighboring nodes is aggregated according to the edge weights. The attention mechanism is used to dynamically adjust the influence weights of different neighboring nodes on the target node, learn the deep associations between nodes, and obtain the security risk score of each node in the heterogeneous graph. Among them, the nodes are the first technical security event data and the first enterprise operation data.

[0137] If the security risk score is greater than the preset threshold, it is determined that there is a correlation between the first technical security incident data and the first enterprise operation data, and the correlation is identified as the second operational correlation information.

[0138] Specifically, if the standardized security event data meets static or dynamic rules, it is determined that the standardized security event data and the operational data have a business logic relationship, and the operational relationship information is obtained.

[0139] If the standardized security event data does not meet the static or dynamic rules, a graph neural network association analysis method is used to construct a heterogeneous graph between the standardized security event data and the operational data. The nodes of the heterogeneous graph represent the standardized security event data and the operational data, and the edges represent the temporal, spatial, or business logic relationships.

[0140] This application embodiment learns the relationships between nodes using a graph neural network, predicts the potential correlation between the standardized security event data and the operational data, and fills the operational correlation information with the prediction results as supplementary correlation information, including:

[0141] Step A1: Using the graph neural network, perform multiple rounds of iterative learning on the nodes in the heterogeneous graph. In each round of iteration, aggregate the information of neighboring nodes according to the edge weights, use the attention mechanism to dynamically adjust the influence weights of different neighboring nodes on the target node, learn the deep relationships between nodes, and output the security risk score of each node.

[0142] Step A2: If the security risk score exceeds a preset threshold, it is determined that there is a potential correlation between the standardized security event data and the operational data. The operational correlation information corresponding to the operational data with the highest correlation to the standardized security event node is filled into the business correlation field of the standardized security event data. At the same time, the weight of the edge with high correlation is increased and the weight of the edge with low correlation is decreased for subsequent iterative learning.

[0143] Specifically, for standardized security incident data and operational data that failed to identify a correlation in the initial matching, a heterogeneous graph is constructed. This graph contains nodes representing standardized security incident data and operational data, as well as edges representing temporal, spatial, or business logic relationships.

[0144] A graph neural network model, such as a heterogeneous graph attention network (HAN), is used to process the heterogeneous graph. In the first iteration, the model aggregates the neighboring node information of each node based on the initial edge weights (e.g., initial values ​​set based on temporal proximity or shared identifiers). Simultaneously, the attention mechanism calculates the attention weights of each neighbor node to the target node based on node features and connectivity, and performs weighted aggregation based on these weights. After multiple iterations, the model learns the representation of nodes in the graph structure and calculates a security risk score for each node based on these representations. For example, a classifier or regressor can be trained to output a risk score based on the graph representation of the node. If the risk score of a standardized security event node exceeds a preset risk threshold, the event is considered to have a potential correlation with certain operational data.

[0145] Furthermore, the model can calculate the correlation between the standardized security event node and all operational data nodes in the graph (e.g., based on the similarity of node representations or through a specific correlation prediction layer). The operational data node with the highest correlation is selected, and its corresponding operational information (such as order number, device ID, and production stage) is extracted and populated into the business association fields of the original standardized security event data.

[0146] As a feedback mechanism, the weights of edges connected to operational data nodes identified as having potential connections are increased, while the weights of edges connected to operational data nodes with low connections are decreased. These adjusted edge weights are used in the next iteration of learning, causing the model to pay more attention to these strengthened connection paths in subsequent learning, thereby improving the accuracy and efficiency of potential connection discovery.

[0147] This automatically links technical security incidents with operational business context information, overcoming the limitations of manual analysis and improving the accuracy of risk assessment.

[0148] Optionally, the step of calculating risk parameters corresponding to technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority, including:

[0149] Based on the mapping relationship between order value, equipment criticality, production stage, and risk level, the business impact assessment model is determined;

[0150] Match the first technical security incident data with the business impact assessment model;

[0151] If the first technical security incident data matches the business impact assessment model, determine the first matching result corresponding to the first technical security incident data;

[0152] If the first technical security incident data and the business impact assessment model do not match, a fuzzy matching algorithm is used to calculate the similarity between each record in the first enterprise operation data and the business impact assessment model, and the distance with the highest similarity is determined as the second matching result.

[0153] The business impact factors are determined based on the first matching result and the second matching result, wherein the business impact factors include at least the order value level, the criticality of the equipment, and the completion rate of the production stage;

[0154] The step of calculating the risk parameters corresponding to the technical security incident data based on the business impact factors includes:

[0155] Based on the pre-set risk scoring calculation method and the business impact factors, calculate the risk score of the target technical security event data in the target operation-related information;

[0156] The risk scores of the target technical security incident data in the target operation association information are sorted in descending order to obtain the risk parameters corresponding to the technical security incident data.

[0157] Specifically, the embodiments of this application address the problem of how to associate operational information with business impact and calculate risk scores or priorities based on business impact.

[0158] The terminal device receives the operational association information output in step S3, which identifies which specific operational activities are associated with the standardized security incident. The system then accesses a pre-defined business impact assessment model. This model is a knowledge base that records the degree of business impact or risk level corresponding to different operational scenarios (described by a combination of factors such as order value, equipment criticality, and production stage). Based on key fields in the operational association information (such as order ID, equipment ID, and production stage identifier), the system queries the business impact assessment model to find the record that best matches the current operational activity and extracts the business impact factors defined in that record.

[0159] By utilizing the acquired business impact factors and combining them with the pre-defined calculation rules or mapping tables in the business impact assessment model, the system calculates the risk score or priority of standardized security events. For example, the model might specify that a combination of high-value orders, critical equipment, and critical production stages corresponds to a higher risk weight. The system substitutes the extracted factors into the calculation process to obtain the final risk score or priority value. This value reflects the potential impact of the security event within the current business context.

[0160] In this way, even if a security incident at the technical level itself has a low risk level, if it is associated with high-value or critical operational activities, its calculated risk score or priority will be significantly improved, thereby effectively distinguishing the degree of impact of security incidents on different business activities and providing a more accurate basis for subsequent risk alerts.

[0161] Step B1: Construct a business impact assessment model that includes the mapping relationship between order value, equipment criticality, production stage and risk level. The business impact assessment model includes order value tiers, equipment criticality levels and production stage completion.

[0162] Step B2: Based on the operational association information matched by the standardized security incident, query the corresponding order value level, equipment criticality level, and production stage completion rate from the business impact assessment model;

[0163] Step B3: If the operational association information is not completely matched, a fuzzy matching algorithm is used to calculate the similarity between the operational association information and each record in the business impact assessment model, and the record with the highest similarity is selected as the matching result.

[0164] Step B4: Based on the queried or matched order value tier, equipment criticality level, and production stage completion rate, calculate the risk score of the standardized safety event using a preset risk scoring formula. The risk scoring formula is: Risk Score = Order Value Weight × Order Value Score + Equipment Criticality Weight × Equipment Criticality Score + Production Stage Weight × Production Stage Score. The order value score, equipment criticality score, and production stage score are all preset values.

[0165] To address the issue of inconsistencies between operational information and model records, a fuzzy matching algorithm is introduced to calculate similarity and select the closest records, improving the robustness of the matching and ensuring that relevant business context can be found even when data is not entirely accurate. Next, a pre-defined weighted calculation formula is used to multiply the acquired order value score, equipment criticality score, and production stage score (these scores are determined based on pre-defined levels / completion rates) by their corresponding pre-defined weights and then sum them to obtain a quantified risk score. This score comprehensively reflects the potential impact of a security incident within the current business context.

[0166] Finally, security events are sorted in descending order based on the calculated risk scores to generate a priority list. This allows the system to prioritize and process security events according to their risk level, thereby guiding subsequent alarms and responses and improving the accuracy and effectiveness of risk assessment.

[0167] Optionally, obtain enterprise operational data, including:

[0168] Initial enterprise operation data is obtained by configuring data source connection parameters and API interfaces;

[0169] The initial enterprise operation data is cleaned using preset cleaning rules to obtain cleaned enterprise operation data.

[0170] According to predefined conversion rules, the cleaned enterprise operation data is mapped to preset fields in the enterprise operation status database, and the material codes of the cleaned enterprise operation data are converted into standard codes of the physical list to obtain the enterprise operation data.

[0171] Specifically, the key operational data is obtained by configuring data source connection parameters and API interfaces, and the key operational data is uniformly encapsulated in JSON format;

[0172] S12: For the key operational data in JSON format, standardize it using preset cleaning rules, identify and remove invalid, erroneous or duplicate data, and generate the cleaned key operational data;

[0173] S13: According to the predefined conversion rules, the cleaned key operational data is mapped to the preset fields of the enterprise operation status database, and the material code of the key operational data is converted into the standard code of the bill of materials to generate the converted key operational data;

[0174] S14: Based on the data type and storage requirements, store the converted key operational data into the enterprise operational status database.

[0175] To address the issue of critical operational data originating from various enterprise management systems, resulting in differences in data format, structure, and quality, this solution configures data source connection parameters and API interfaces to retrieve raw operational data from different systems and uniformly encapsulate it into JSON format. This resolves the problems of data source diversity and format inconsistency. Pre-defined cleaning rules are employed to standardize the JSON data, identifying and removing invalid, erroneous, or duplicate data, thereby improving data accuracy and reliability.

[0176] Furthermore, based on predefined transformation rules, the cleaned data is mapped to preset fields in the enterprise operational status database, and key identifiers such as material codes are standardized and transformed, resolving the inconsistency in data field definitions and codes between different systems. The cleaned and transformed data is then stored in the enterprise operational status database according to its type and storage requirements. Thus, the original heterogeneous key operational data is transformed into a standardized, high-quality form stored in a unified database, providing a reliable foundation for subsequent steps to utilize this data for security incident correlation analysis.

[0177] Optionally, technical security incident data may be acquired, including:

[0178] Initial technical security event data is obtained from the honeynet system by configuring data source connection parameters;

[0179] Based on a pre-set security knowledge base, malicious code and attack patterns are identified from initial technical security incident data.

[0180] If malicious code and attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated.

[0181] According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the preset security event data to generate technical security event data containing technical attributes and business-related fields.

[0182] S21: By configuring data source connection parameters, collect the technical security event data from the honeynet system, and encapsulate the technical security event data into XML format;

[0183] S22: For the technical security event data in XML format, malicious code and attack patterns are identified based on a preset security knowledge base. If malicious code or attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated.

[0184] S23: According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the standardized security event data to generate standardized security event data containing technical attributes and business-related fields.

[0185] This technical solution provides a detailed implementation process for step S2, aiming to address the problem of effectively acquiring, initially processing, and standardizing technical security event data from the honeynet system. First, in step S21, technical security event data is collected from the honeynet system by configuring data source connection parameters. The collected data is then uniformly encapsulated into XML format, completing data acquisition and initial formatting. This ensures the data source and basic format for subsequent processing.

[0186] Furthermore, in step S22, malicious code and attack patterns are identified using a pre-defined security knowledge base for the XML-formatted technical security incident data. This step performs preliminary verification and analysis of the collected raw incident data, identifies potential malicious behaviors, and records relevant information. This provides crucial technical details for subsequent risk assessment.

[0187] Finally, in step S23, according to preset mapping rules, the event data that has undergone preliminary verification and identification is mapped to preset fields of standardized security event data. This step transforms the raw, pre-processed event data into a standardized format containing technical attributes and business-related fields. Technical attributes describe the technical details of the event itself, while business-related fields provide the necessary data structure for subsequent matching with operational data. Through this standardization process, the technical security event data becomes structured, making it easier to process and analyze in subsequent steps, thus enabling it to be placed in a business context for correlation analysis.

[0188] Figure 2 This is a schematic diagram of the policy caching process in one embodiment of this application, as shown below. Figure 2 As shown, the method also includes:

[0189] S1: Obtain key operational data, clean and transform the key operational data, and store it in the enterprise operational status database;

[0190] S2: The honeynet system acquires technical security event data and converts the extracted technical security event data into standardized security event data containing technical attributes and business-related fields;

[0191] S3: Match the standardized security incident data with the operational data in the enterprise operational status database to obtain operational association information;

[0192] S4: Calculate the risk score or priority of the standardized security event based on the matched operational association information;

[0193] S5: Trigger an alarm based on the risk score or priority, generate alarm information containing technical details of the security event and associated business context information, and issue a risk alert.

[0194] This application proposes a data security analysis method and system for the Industrial Internet. Step S1 involves acquiring and processing key operational data, storing it in a structured format, and establishing a digital representation of the enterprise's operational status. This provides a business data foundation for subsequent correlation analysis. Step S2 involves acquiring technical security event data from a honeycomb system and standardizing it to include technical details and fields for business correlation. This unifies the format of the security event data and prepares an interface for correlation with business data. Step S3 involves matching the standardized security event data with operational data in the enterprise operational status database. This step establishes a link between technical security events and specific operational activities, identifying the business context in which the event occurred. Step S4 uses the operational correlation information obtained in S3 to calculate a risk score or priority for the security event. The calculation process considers the business activities associated with the event, ensuring that the risk assessment reflects the potential impact of the event on the business. Step S5 triggers an alarm based on the risk score or priority calculated in S4. The alarm information includes the technical details of the security event and the business context information matched in S3. This provides technical and business-level information to help recipients understand the business impact of the event and take countermeasures. Specifically, this method addresses the technical challenge of automating, real-time, and effectively correlating and analyzing low-level, dispersed technical security events captured by technical security systems with high-level, heterogeneous business operation status data contained in the enterprise management system within the industrial internet environment of large and complex manufacturing enterprises. Therefore, the method proposed in this application correlates dispersed technical security events with enterprise operational data, assesses risks based on business context, and issues alerts containing business information. This solves the problem of existing methods struggling to analyze technical events within a business context, and offers the beneficial effects of providing timely early warnings and supporting preventative measures before attacks occur.

[0195] The internet data analysis method provided in this application involves: acquiring enterprise operation data and technical security incident data; performing a first match on the enterprise operation data and technical security incident data using a time window and shared identifiers to obtain candidate operation-related information, wherein the candidate operation-related information includes at least first enterprise operation data and first technical security incident data; performing a second match on the first enterprise operation data and first technical security incident data in the candidate operation-related information according to a pre-established association rule base to obtain target operation-related information, wherein the association rule base includes at least static rules and dynamic rules; and determining business impact factors using a preset business impact assessment model and the target operation-related information, wherein the business impact assessment model includes at least order value, equipment criticality, production stage, and risk level. The mapping relationship is established; based on business impact factors, risk parameters corresponding to technical security incident data are calculated, where risk parameters include at least risk scores or priorities; based on the risk parameters corresponding to technical security incident data, early warning information for technical security incident data is determined. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents in specific business contexts for analysis and risk assessment, improving data security analysis capabilities and the timeliness and accuracy of risk early warning in the industrial internet environment, and having the ability to correlate technical security incidents with operational data; based on business context, security incident risks are assessed, and alarm information containing business context is generated to improve the accuracy of attack intent judgment, achieve timely early warning, and support the beneficial effect of taking measures before the impact of attacks.

[0196] Another embodiment of this application provides an Internet data analysis apparatus for performing the Internet data analysis method provided in the above embodiments.

[0197] Reference Figure 3 The diagram illustrates a structural block diagram of an embodiment of an Internet data analysis device according to this application. The device may specifically include the following modules: wherein:

[0198] Module 301 is used to acquire enterprise operational data and technical security incident data;

[0199] The first matching module 302 is used to perform a first matching of enterprise operation data and technical security incident data using a time window and a shared identifier to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security incident data.

[0200] The second matching module 303 is used to perform a second matching on the first enterprise operation data and the first technical security event data in the candidate operation association information according to the pre-established association rule base, so as to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules.

[0201] The search module 304 is used to determine business impact factors by using a preset business impact assessment model and target operational correlation information. The business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage and risk level.

[0202] The calculation module 305 is used to calculate the risk parameters corresponding to the technical security incident data based on the business impact factors. The risk parameters include at least a risk score or priority.

[0203] The early warning module 306 is used to determine the early warning information of the technical security incident data based on the risk parameters corresponding to the technical security incident data.

[0204] The internet data analysis device provided in this application embodiment acquires enterprise operation data and technical security incident data; uses a time window and shared identifier to perform a first match on the enterprise operation data and technical security incident data to obtain candidate operation association information, wherein the candidate operation association information includes at least first enterprise operation data and first technical security incident data; according to a pre-established association rule base, performs a second match on the first enterprise operation data and first technical security incident data in the candidate operation association information to obtain target operation association information, wherein the association rule base includes at least static rules and dynamic rules; and uses a preset business impact assessment model and target operation association information to determine business impact factors, wherein the business impact assessment model includes at least order value, equipment criticality, production stage, and risk level. The mapping relationship is established; based on business impact factors, risk parameters corresponding to technical security incident data are calculated, where risk parameters include at least risk scores or priorities; based on the risk parameters corresponding to technical security incident data, early warning information for technical security incident data is determined. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents in specific business contexts for analysis and risk assessment, improving data security analysis capabilities and the timeliness and accuracy of risk early warning in the industrial internet environment, and having the ability to correlate technical security incidents with operational data; based on business context, security incident risks are assessed, and alarm information containing business context is generated to improve the accuracy of attack intent judgment, achieve timely early warning, and support the beneficial effect of taking measures before the impact of attacks.

[0205] Another embodiment of this application further supplements the description of the Internet data analysis device provided in the above embodiments.

[0206] Optionally, the pre-established association rule base is obtained in the following way:

[0207] Static rules are determined based on the predefined mapping relationship between device types and attack types;

[0208] Initial dynamic rules are generated based on historical security incident data, historical operational data, and the correlation between historical security incident data and historical operational data.

[0209] Set confidence levels for the initial dynamic rules based on the association strength and support of the relationships;

[0210] The initial dynamic rules are sorted in descending order based on their confidence scores to obtain the dynamic rules.

[0211] Determine the association rule base by combining static and dynamic rules.

[0212] Optionally, the second matching module is used for:

[0213] If the data of the first technical security incident meets the pre-established association rule base, it is determined that there is an association between the data of the first technical security incident and the data of the first enterprise operation, and the first operation association information is obtained;

[0214] If the first technical security incident data does not meet the pre-established association rule base, a heterogeneous graph is generated based on the first technical security incident data and the first enterprise operation data;

[0215] The association analysis method of graph neural network is used to predict the association relationship of each node in the heterogeneous graph and obtain the second operation association information.

[0216] Based on the first operational association information and the second operational association information, the target operational association information is determined.

[0217] Optionally, the second matching module is used for:

[0218] The graph neural network association analysis method is used to perform multiple rounds of iterative learning on each node in the heterogeneous graph. In each round of iteration, the information of neighboring nodes is aggregated according to the edge weights. The attention mechanism is used to dynamically adjust the influence weights of different neighboring nodes on the target node, learn the deep associations between nodes, and obtain the security risk score of each node in the heterogeneous graph. Among them, the nodes are the first technical security event data and the first enterprise operation data.

[0219] If the security risk score is greater than the preset threshold, it is determined that there is a correlation between the first technical security incident data and the first enterprise operation data, and the correlation is identified as the second operational correlation information.

[0220] Optionally, the calculation module is used for:

[0221] Based on the mapping relationship between order value, equipment criticality, production stage, and risk level, a business impact assessment model is determined;

[0222] Match the first technology security incident data with the business impact assessment model;

[0223] If the data of the first technical security incident matches the business impact assessment model, determine the first matching result corresponding to the data of the first technical security incident;

[0224] If the first technical security incident data and the business impact assessment model do not match, a fuzzy matching algorithm is used to calculate the similarity of each record in the first enterprise operation data and the business impact assessment model, and the distance with the highest similarity is determined as the second matching result.

[0225] The business impact factors are determined based on the first and second matching results. These factors include at least the order value level, equipment criticality, and production phase completion.

[0226] Based on the pre-set risk scoring calculation method and business impact factors, calculate the risk score of the target technical security event data in the target operational related information;

[0227] The risk scores of target technical security incident data in the target operation-related information are sorted in descending order to obtain the risk parameters corresponding to the technical security incident data.

[0228] Optionally, the acquisition module is used for:

[0229] Initial enterprise operation data is obtained by configuring data source connection parameters and API interfaces;

[0230] The initial enterprise operation data is cleaned using preset cleaning rules to obtain cleaned enterprise operation data.

[0231] According to predefined conversion rules, the cleaned enterprise operation data is mapped to preset fields in the enterprise operation status database, and the material codes of the cleaned enterprise operation data are converted into standard codes of the physical list to obtain the enterprise operation data.

[0232] Optionally, the acquisition module is used for:

[0233] Initial technical security event data is obtained from the honeynet system by configuring data source connection parameters;

[0234] Based on a pre-set security knowledge base, malicious code and attack patterns are identified from initial technical security incident data.

[0235] If malicious code and attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated.

[0236] According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the preset security event data to generate technical security event data containing technical attributes and business-related fields.

[0237] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0238] The internet data analysis device provided in this application embodiment acquires enterprise operation data and technical security incident data; uses a time window and shared identifier to perform a first match on the enterprise operation data and technical security incident data to obtain candidate operation association information, wherein the candidate operation association information includes at least first enterprise operation data and first technical security incident data; according to a pre-established association rule base, performs a second match on the first enterprise operation data and first technical security incident data in the candidate operation association information to obtain target operation association information, wherein the association rule base includes at least static rules and dynamic rules; and uses a preset business impact assessment model and target operation association information to determine business impact factors, wherein the business impact assessment model includes at least order value, equipment criticality, production stage, and risk level. The mapping relationship is established; based on business impact factors, risk parameters corresponding to technical security incident data are calculated, where risk parameters include at least risk scores or priorities; based on the risk parameters corresponding to technical security incident data, early warning information for technical security incident data is determined. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents in specific business contexts for analysis and risk assessment, improving data security analysis capabilities and the timeliness and accuracy of risk early warning in the industrial internet environment, and having the ability to correlate technical security incidents with operational data; based on business context, security incident risks are assessed, and alarm information containing business context is generated to improve the accuracy of attack intent judgment, achieve timely early warning, and support the beneficial effect of taking measures before the impact of attacks.

[0239] In another embodiment of this application, a terminal device is provided for executing the Internet data analysis method provided in the above embodiments.

[0240] Figure 4 This is a structural schematic diagram of a terminal device according to this application, such as... Figure 4 As shown, the terminal device includes: at least one processor 401 and a memory 402;

[0241] The memory stores a computer program; at least one processor executes the computer program stored in the memory to implement the Internet data analysis method provided in the above embodiments.

[0242] The terminal device provided in this embodiment acquires enterprise operation data and technical security incident data; it performs a first match on the enterprise operation data and technical security incident data using a time window and a shared identifier to obtain candidate operation association information, wherein the candidate operation association information includes at least first enterprise operation data and first technical security incident data; according to a pre-established association rule base, it performs a second match on the first enterprise operation data and first technical security incident data in the candidate operation association information to obtain target operation association information, wherein the association rule base includes at least static rules and dynamic rules; and it uses a preset business impact assessment model and target operation association information to determine business impact factors, wherein the business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage, and risk level. Based on business impact factors, risk parameters corresponding to technical security incident data are calculated, where the risk parameters include at least a risk score or priority. Based on the risk parameters corresponding to the technical security incident data, early warning information for the technical security incident data is determined. The industrial internet data security analysis method provided in this application embodiment can automatically and in real-time process massive heterogeneous data, placing technical security incidents within specific business contexts for analysis and risk assessment. This improves the data security analysis capabilities and the timeliness and accuracy of risk warnings in the industrial internet environment, and has the ability to correlate technical security incidents with operational data. Based on the business context, security incident risks are assessed, and alarm information containing the business context is generated to improve the accuracy of attack intent judgment, achieve timely early warning, and support the beneficial effect of taking measures before the attack impacts.

[0243] Another embodiment of this application provides a computer-readable storage medium storing a computer program that, when executed, implements the Internet data analysis method provided in any of the above embodiments.

[0244] According to the computer-readable storage medium of this embodiment, enterprise operation data and technical security incident data are acquired; a time window and shared identifier are used to perform a first match on the enterprise operation data and technical security incident data to obtain candidate operation association information, wherein the candidate operation association information includes at least first enterprise operation data and first technical security incident data; according to a pre-established association rule base, the first enterprise operation data and first technical security incident data in the candidate operation association information are matched a second time to obtain target operation association information, wherein the association rule base includes at least static rules and dynamic rules; a preset business impact assessment model and target operation association information are used to determine business impact factors, wherein the business impact assessment model includes at least order value, equipment criticality, production stage and risk level. The data security analysis method for the industrial internet provided in this application can automatically and in real-time process massive heterogeneous data, placing technical security events in a specific business context for analysis and risk assessment. This improves the data security analysis capabilities and the timeliness and accuracy of risk warnings in the industrial internet environment, and has the ability to correlate technical security events with operational data. It assesses security event risks based on business context, generates alarm information containing business context to improve the accuracy of attack intent judgment, achieves timely warnings, and supports the beneficial effect of taking measures before the attack impacts.

[0245] It should be noted that the above detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0246] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0247] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0248] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0249] For ease of description, spatial relative terms such as "above," "on top of," "on the upper surface of," "above," etc., are used herein to describe the spatial positional relationship of a device or feature as shown in the figures to other devices or features. It should be understood that spatial relative terms are intended to encompass different orientations in use or operation beyond the orientation of the device as described in the figures. For example, if the device in the figures were inverted, a device described as "above" or "on top of" other devices or structures would subsequently be positioned as "below" or "under" other devices or structures. Thus, the exemplary term "above" can include both "above" and "below." The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatial relative descriptions used herein will be interpreted accordingly.

[0250] In the detailed description above, reference has been made to the accompanying drawings, which form part of this document. In the drawings, similar symbols typically identify similar parts unless the context otherwise indicates otherwise. The illustrated embodiments described in the detailed specification, drawings, and claims are not intended to be limiting. Other embodiments may be used and other changes may be made without departing from the spirit or scope of the subject matter presented herein.

[0251] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for analyzing internet data, characterized in that, The method includes: Acquire enterprise operational data and technical security incident data; Using a time window and a shared identifier, the enterprise operation data and technical security incident data are matched for the first time to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security incident data; Based on a pre-established association rule base, a second matching is performed on the first enterprise operation data and the first technical security event data in the candidate operation association information to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules. Using a pre-set business impact assessment model and the target operational correlation information, business impact factors are determined. The business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage, and risk level. Based on the business impact factors, calculate the risk parameters corresponding to the technical security incident data, wherein the risk parameters include at least a risk score or priority; Based on the risk parameters corresponding to the technical security incident data, early warning information for the technical security incident data is determined.

2. The method for analyzing Internet data according to claim 1, characterized in that, The pre-established association rule base is obtained in the following way: The static rules are determined based on the predefined mapping relationship between device types and attack types; Initial dynamic rules are generated based on historical security incident data, historical operational data, and the correlation between the historical security incident data and the historical operational data. The confidence level of the initial dynamic rule is set based on the association strength and support of the association relationship; The initial dynamic rules are sorted in descending order based on the confidence level to obtain the dynamic rules; The static rules and the dynamic rules are used to determine the association rule base.

3. The method for analyzing Internet data according to claim 1, characterized in that, The second matching of the first enterprise operation data and the first technical security event data in the candidate operation association information, based on a pre-established association rule base, yields the target operation association information, including: If the first technical security incident data satisfies the pre-established association rule base, it is determined that the first technical security incident data and the first enterprise operation data are related, and the first operation association information is obtained; If the first technical security incident data does not meet the pre-established association rule base, a heterogeneous graph is generated based on the first technical security incident data and the first enterprise operation data; The association analysis method of graph neural network is used to predict the association relationship of each node in the heterogeneous graph to obtain the second operation association information; The target operational association information is determined based on the first operational association information and the second operational association information.

4. The method for analyzing Internet data according to claim 3, characterized in that, The association analysis method using graph neural networks predicts the association relationships of each node in the heterogeneous graph to obtain second operational association information, including: The graph neural network association analysis method is used to perform multiple rounds of iterative learning on each node in the heterogeneous graph. In each round of iteration, the information of adjacent nodes is aggregated according to the edge weights. The influence weights of different neighboring nodes on the target node are dynamically adjusted using the attention mechanism. The deep association between nodes is learned to obtain the security risk score of each node in the heterogeneous graph. The node is the first technical security event data and the first enterprise operation data. If the security risk score is greater than a preset threshold, it is determined that there is a correlation between the first technical security incident data and the first enterprise operation data, and the correlation is determined as the second operational correlation information.

5. The method for analyzing Internet data according to claim 3, characterized in that, The step involves calculating risk parameters corresponding to technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority, including: Based on the mapping relationship between order value, equipment criticality, production stage, and risk level, the business impact assessment model is determined; Match the first technical security incident data with the business impact assessment model; If the first technical security incident data matches the business impact assessment model, determine the first matching result corresponding to the first technical security incident data; If the first technical security incident data and the business impact assessment model do not match, a fuzzy matching algorithm is used to calculate the similarity between each record in the first enterprise operation data and the business impact assessment model, and the distance with the highest similarity is determined as the second matching result. The business impact factors are determined based on the first matching result and the second matching result, wherein the business impact factors include at least the order value level, the criticality of the equipment, and the completion rate of the production stage; The step of calculating the risk parameters corresponding to the technical security incident data based on the business impact factors includes: Based on the pre-set risk scoring calculation method and the business impact factors, calculate the risk score of the target technical security event data in the target operation-related information; The risk scores of the target technical security incident data in the target operation association information are sorted in descending order to obtain the risk parameters corresponding to the technical security incident data.

6. The method for analyzing Internet data according to claim 1, characterized in that, The acquisition of enterprise operation data includes: Initial enterprise operation data is obtained by configuring data source connection parameters and API interfaces; The initial enterprise operation data is cleaned using preset cleaning rules to obtain cleaned enterprise operation data; According to predefined conversion rules, the cleaned enterprise operation data is mapped to preset fields in the enterprise operation status database, and the material codes of the cleaned enterprise operation data are converted into standard codes of the physical list to obtain the enterprise operation data.

7. The method for analyzing Internet data according to claim 1, characterized in that, The acquisition of technical security incident data includes: Initial technical security event data is obtained from the honeynet system by configuring data source connection parameters; Based on a pre-set security knowledge base, malicious code and attack patterns are identified in the initial technical security event data. If malicious code and attack patterns are identified, the malicious code type and attack pattern are recorded, and event data containing preliminary verification results is generated. According to the preset mapping rules, the event data containing the preliminary verification results is mapped to the preset fields of the preset security event data to generate the technical security event data containing technical attributes and business association fields.

8. An internet data analysis device, characterized in that, The device includes: The acquisition module is used to acquire enterprise operational data and technical security incident data. The first matching module is used to perform a first matching of the enterprise operation data and the technical security event data using a time window and a shared identifier to obtain candidate operation association information, wherein the candidate operation association information includes at least the first enterprise operation data and the first technical security event data. The second matching module is used to perform a second matching on the first enterprise operation data and the first technical security event data in the candidate operation association information according to the pre-established association rule base to obtain the target operation association information. The association rule base includes at least static rules and dynamic rules. The search module is used to determine business impact factors by using a preset business impact assessment model and the target operational correlation information. The business impact assessment model includes at least the mapping relationship between order value, equipment criticality, production stage and risk level. The calculation module is used to calculate the risk parameters corresponding to the technical security incident data based on the business impact factors, wherein the risk parameters include at least a risk score or priority. The early warning module is used to determine the early warning information of the technical security incident data based on the risk parameters corresponding to the technical security incident data.

9. A terminal device, characterized in that, include: At least one processor and memory; The memory stores computer programs; The at least one processor executes the computer program stored in the memory to implement the method for analyzing Internet data according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, implements the method for analyzing Internet data according to any one of claims 1-7.

Images