Industrial network security traceability analysis method based on security agent

By filtering and screening real-time access data from industrial networks, abnormal access characteristic values ​​are generated and imported into a simulated security agent. Combined with a large security agent model for judgment, the problem of inaccurate security detection in existing technologies is solved, and efficient, accurate traceability and proactive defense of industrial networks are achieved.

CN121125342AInactive Publication Date: 2025-12-12BEIJING HUADIAN TIANREN ELECTRIC POWER CONTROL TECH
1 Cites 0 Cited by

Patent Information

Application Number
CN202511624518.7
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-11-07
Publication Date
2025-12-12
Estimated Expiration
Not applicable · inactive patent

AI Technical Summary

Technical Problem

Existing technologies that analyze access anomalies solely by the number of times an IP address is accessed result in inaccurate security detection of network access and an inability to effectively identify complex attack behaviors.

Method used

Real-time access data from the industrial network is collected to generate real-time access logs. The real-time access logs are filtered and screened, and the correlation with each storage access log is calculated. The request rate and the number of concurrent connections are obtained, and abnormal access feature values ​​are generated. Abnormal access data packets are imported into a simulated security agent. An isolation characterization value is generated through the security agent's large model to determine whether the isolation is successful. Based on the behavior and correlation, the access risk level and handling method are determined.

Benefits of technology

It enables accurate source tracing in the early stages of anomalies, and quickly cuts off attack paths through the proactive defense and highly realistic interaction of simulated security agents, thereby improving the accuracy and defense efficiency of industrial network security source tracing analysis and solving the problems of fragmented log data and delayed analysis in traditional systems.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention relates to the technical field of network security, in particular to an industrial network security traceability analysis method based on a security agent. According to the method, real-time access logs are filtered and screened, and the association degree with each storage access log is calculated; calculating an abnormal access characteristic value based on the request rate and the concurrent connection number, transferring a data packet corresponding to the real-time access log of which the abnormal access characteristic value is smaller than a preset characteristic value into the simulated security agent, and recording the access data of the simulated security agent; judging whether isolation succeeds or not based on the isolation characterization value, including analyzing a task execution action corresponding to the real-time access log if it is judged that isolation succeeds; if it is judged that isolation is not successful, a plurality of storage access logs are determined based on the correlation degree, or it is judged that the real-time access data are first abnormal data to generate corresponding storage access logs. According to the invention, the behavior action of the visitor is analyzed for security tracing, so that the accuracy of industrial network security tracing analysis is improved.
Need to check novelty before this filing date? Find Prior Art