Industrial end node data tamper-proofing method and system based on Internet of Things

Abstract

The invention discloses an industrial end node data tamper-proofing method and system based on the Internet of Things, and relates to the technical field of data processing. The method comprises the following steps: dividing to-be-uploaded node data of a target end node at each moment according to a preset duration to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data comprises feature information of multiple information dimensions; dividing the to-be-uploaded node data in the first data segment based on feature information of the to-be-uploaded node data in each information dimension in the first data segment to obtain at least one second data segment; determining the attack possibility of the second data segment based on historical uploading information of historical node data corresponding to each piece of to-be-uploaded node data in the second data segment; and performing tamper-proof encryption processing on the second data segment based on the attack possibility of the second data segment. According to the invention, the security of the industrial end node data can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an industrial end node data tamper-proofing method and system based on Internet of Things. BACKGROUND

[0002] Internet of Things has become a key component in current industrial scenarios. Through sensors distributed in industrial end nodes, end node data can be collected in real time and uploaded via wireless networks, achieving centralized collection and real-time transmission of data. Industrial end node data not only reflects the production status, but also closely related to device safety and production process control. Its authenticity and integrity are crucial to the safety and efficiency of industrial production.

[0003] Currently, the tamper-proofing methods for industrial end node data mainly include verifying data integrity using a hash algorithm and implementing data protection using single symmetric encryption combined with simple timestamp segmentation.

[0004] However, the design of single symmetric encryption combined with simple timestamp segmentation is too simple and lacks sufficient protection for industrial end node data, resulting in poor security of industrial end node data. SUMMARY

[0005] The present application provides an industrial end node data tamper-proofing method and system based on Internet of Things, which can improve the security of industrial end node data.

[0006] In a first aspect, the present application provides an industrial end node data tamper-proofing method based on Internet of Things, comprising: dividing the to-be-uploaded node data of the target end node at each time point into at least one first data segment according to a preset time length; the target end node is any industrial end node, and the to-be-uploaded node data includes feature information of multiple information dimensions; dividing the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension, to obtain at least one second data segment; determining the attack likelihood of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment; performing tamper-proofing encryption processing on the second data segment based on the attack likelihood of the second data segment.

[0007] Further, the present application further provides that the to-be-uploaded node data in the first data segment is divided based on the feature information of each to-be-uploaded node data in each information dimension, to obtain at least one second data segment, comprising: Determine the segmentation degree of each to-be-uploaded node data group in each information dimension based on the feature information of each to-be-uploaded node data group in the first data segment in each information dimension. For each to-be-uploaded node data group, filter out the information dimensions with a segmentation degree greater than a preset degree threshold to obtain a target information dimension set of the to-be-uploaded node data group. Compare the target information dimension set of the first to-be-uploaded node data group with the target information dimension set of the second to-be-uploaded node data group to determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, and determine the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group; the first to-be-uploaded node data group and the second to-be-uploaded node data group are any two to-be-uploaded node data groups. Filter out the first to-be-uploaded node data group and the second to-be-uploaded node data group with a similarity anomaly degree greater than a preset anomaly degree threshold to obtain a target to-be-uploaded node data group. Based on the correlation index between each target to-be-uploaded node data group, cluster each target to-be-uploaded node data group to obtain at least one second data segment.

[0008] Further, the present application also proposes that the segmentation degree of each to-be-uploaded node data group in each information dimension is determined based on the feature information of each to-be-uploaded node data group in the first data segment in each information dimension, comprising: Perform variance calculation on the feature information of each to-be-uploaded node data in the target information dimension in the to-be-uploaded node data group to obtain a difference index of the to-be-uploaded node data group in the target information dimension; the target information dimension is any one information dimension. Determine the complexity index of the to-be-uploaded node data group in the target information dimension by using the number of to-be-uploaded node data of the to-be-uploaded node data group and the memory occupation corresponding to the feature information of each to-be-uploaded node data in the target information dimension. Determine the segmentation degree of the to-be-uploaded node data group in the target information dimension by using the difference index and the complexity index.

[0009] Further, the present application also proposes that the target information dimension set includes a device identifier dimension and a time dimension. Compare the target information dimension set of the first to-be-uploaded node data group with the target information dimension set of the second to-be-uploaded node data group to determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, comprising: Perform Pearson correlation coefficient calculation on the target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group to obtain an initial correlation coefficient; In a case where the initial correlation coefficient is greater than a preset correlation coefficient threshold, compare the feature information of the first to-be-uploaded node data group in the device identifier dimension with the feature information of the second to-be-uploaded node data group in the device identifier dimension to determine a device identifier difference coefficient of the first to-be-uploaded node data group and the second to-be-uploaded node data group. Compare the feature information of the first to-be-uploaded node data group in the time dimension with the feature information of the second to-be-uploaded node data group in the time dimension to determine a time difference index of the first to-be-uploaded node data group and the second to-be-uploaded node data group. Determine the degree of similarity anomaly of the first to-be-uploaded node data group and the second to-be-uploaded node data group by using the device identifier difference coefficient and the time difference index.

[0010] Further, the present application also proposes to determine the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group, comprising: Determine a correction weight based on the degree of similarity anomaly of the first to-be-uploaded node data group and the second to-be-uploaded node data group. Correct the initial correlation coefficient based on the correction weight to obtain the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group.

[0011] Further, the present application also proposes that the historical upload information includes first historical upload information and second historical upload information, the first historical upload information is historical upload information of historical node data in an edge device, the second historical upload information is historical upload information of historical node data in an industrial data platform, and the edge device is a gateway or an edge server. Determine the attack possibility of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, comprising: Determine a data simplicity index of the second data segment based on the first historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment. Determine a historical tampering score of the second data segment based on the second historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment. Determine the attack possibility of the second data segment by using the data simplicity index and the historical tampering score.

[0012] Further, the present application also proposes to determine the data simplicity index of the second data segment based on the first historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, comprising: determine an encryption priority of each to-be-uploaded node data based on a historical encryption order of the historical node data corresponding to each to-be-uploaded node data in the second data segment; determine a structure complexity index of each to-be-uploaded node data based on a historical memory occupation amount of the historical node data corresponding to each to-be-uploaded node data in the second data segment; determine a data simplicity index of the second data segment by using the encryption priority of each to-be-uploaded node data and the structure complexity index of each to-be-uploaded node data.

[0013] Further, the application also provides that, based on the second historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, a historical tampering score of the second data segment is determined, including: determine a tampering possibility of each to-be-uploaded node data in the second data segment based on a first historical tampering frequency, a second historical tampering frequency and a target historical tampering rate of the historical node data corresponding to each to-be-uploaded node data in the second data segment; the first historical tampering frequency is a historical tampering frequency of a data type corresponding to the historical node data, the second historical tampering frequency is a historical tampering frequency of a sensor device corresponding to the historical node data, and the target historical tampering rate is a historical tampering rate of the data type corresponding to the historical node data; obtain a tampering preference coefficient of a target historical time period corresponding to the second data segment; determine the historical tampering score of the second data segment by using the tampering possibility of each to-be-uploaded node data and the tampering preference coefficient of the target historical time period.

[0014] Further, the application also provides that, based on the attack possibility of the second data segment, the second data segment is subjected to anti-tampering encryption processing, including: determine a monitoring object importance degree of the second data segment by using an average value of the device failure rate of each to-be-uploaded node data in the second data segment and the encryption priority; the device failure rate is used to represent a failure rate of a sensor device corresponding to the to-be-uploaded node data; determine an anti-tampering encryption demand index of the second data segment by using the monitoring object importance degree of the second data segment and the attack possibility of the second data segment; subject the second data segment to anti-tampering encryption processing based on the anti-tampering encryption demand index of the second data segment.

[0015] The second aspect of the embodiment of the application provides an industrial end node data anti-tampering system based on an Internet of Things, including: The first division module is configured to divide the to-be-uploaded node data of the target end node at each time point according to a preset time length to obtain at least one first data segment; the target end node is any one of the industrial end nodes, and the to-be-uploaded node data includes feature information of multiple information dimensions; The second division module is configured to divide the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension in the first data segment to obtain at least one second data segment. The possibility determination module is configured to determine the attack possibility of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment. The encryption processing module is configured to perform anti-tampering encryption processing on the second data segment based on the attack possibility of the second data segment.

[0016] The present application has the following advantages: In the industrial end node data anti-tampering method based on the Internet of Things provided by the embodiments of the present application, the to-be-uploaded node data of the target end node is divided into first data segments according to a preset time length, and then second data segments are further divided according to the feature information of each to-be-uploaded node data in multiple information dimensions, thereby realizing fine classification management of the data. Meanwhile, the attack possibility of the second data segment is evaluated in combination with the historical upload information of the historical node data, so that the security risk level of different data segments can be accurately identified. Finally, the second data segment is subjected to targeted anti-tampering encryption processing according to the attack possibility, which not only avoids waste of computing resources, but also provides stronger protection for high-risk data. In this way, this differentiated and fine processing method effectively makes up for the shortcomings of the prior art and significantly improves the security of the industrial end node data. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art and the advantages thereof, a brief introduction will be given below to the drawings needed to be used in the embodiments or the prior art descriptions. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0018] Figure 1 A flowchart of an industrial end node data anti-tampering method based on the Internet of Things provided by an embodiment of the present application; Figure 2 A flowchart of S200 provided by an embodiment of the present application; Figure 3 A flowchart of S300 provided by an embodiment of the present application; Figure 4A structural schematic diagram of an industrial end node data tamper-proofing system based on Internet of Things is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined object of the application, the following describes in detail the specific implementation, structure, features and effects of a data tamper-proofing method and system based on Internet of Things according to the present application in combination with the drawings and preferred embodiments. Different "one embodiment" or "another embodiment" in the following description do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0021] It should be noted that the acquisition, storage, use, processing, etc. of data in the technical solution of the present application comply with the relevant provisions of laws and regulations.

[0022] It should be noted that in the embodiments of the present application, some existing industry solutions such as software, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0023] In the conventional existing industrial Internet of Things end node data tamper-proofing scheme, a fixed time window is used to divide data segments and implement unified strength encryption strategy, which cannot dynamically adjust the segmentation strategy according to multi-dimensional data characteristics, resulting in the same encryption level for high-sensitive data segments and low-risk data segments. This static segmentation mechanism is difficult to cope with the characteristics of large difference in data value density and dynamic change of attack surface in industrial scenarios, resulting in insufficient protection of key data segments and resource redundancy of non-key data segments.

[0024] For example, in a distributed sensor network of a smart manufacturing factory, pressure sensors and temperature and humidity sensors generate multi-dimensional data streams containing device running status and environmental parameters at a millisecond level frequency. The existing method packs all sensor data within five minutes into a single data segment, and uploads it to the gateway after AES-128 encryption. When a batch of pressure sensor data appears a sharp rising waveform due to device abnormalities, its data value is significantly higher than that of temperature and humidity data in the same time period, but the existing method still mixes and encrypts them for transmission. Attackers can implement man-in-the-middle attacks on high-value pressure data, while low-value temperature and humidity data consumes the same computing power for encryption verification.

[0025] In the face of the above problems, the present application first considers how to realize the dynamic division and differentiated encryption of data segments. The traditional fixed time window division cannot distinguish the data value density, and the present application attempts to start from multi-dimensional feature analysis, and establishes a dynamic segmentation mechanism by analyzing the data characteristics of different information dimensions. For example, cross analysis of device identifier dimension and time dimension can identify data groups with similar abnormal characteristics. Further combining historical tampered records and device running status, a multi-dimensional risk assessment model is established. On this basis, the information dimension set with high segmentation reference value is screened out, and a second data segment with risk level differentiation is formed through clustering algorithm. Finally, for each second data segment, a hierarchical encryption requirement index is generated to realize the precise matching of encryption strength and data value.

[0026] To this end, the present application provides an industrial end node data tamper-proofing method based on Internet of Things. The specific scenario of the present application is that in an industrial scenario, the transmission path of industrial end node data is "industrial end node-gateway / edge server-industrial data platform", wherein the industrial end node usually refers to a terminal device capable of directly collecting data. Since the industrial end node data can directly reflect the device working state and real production information, when uploading data to the gateway / edge server at the industrial end node, the industrial end node data needs to be encrypted first, and the encrypted industrial end node data needs to have sufficient tamper-proofing capability. Therefore, an industrial end node data tamper-proofing method and system based on Internet of Things are provided.

[0027] As shown in Figure 1 The industrial end node data tamper-proofing method based on Internet of Things can be applied to electronic devices, including the following S100 to S400: S100, dividing the target end node data to be uploaded at each time according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the data to be uploaded includes feature information of multiple information dimensions.

[0028] In this step, the industrial end node refers to a device or node at the end of the network architecture in the industrial network system. These nodes are usually directly connected to various physical entities in the industrial production process (such as sensors, actuators, production equipment, etc.), responsible for collecting data in the industrial field (such as temperature, pressure, speed, etc. Physical quantity data), which is the key link of industrial data generation and initial interaction. For example, in an automobile manufacturing plant, a sensor node installed on the production line for detecting the size of a part is an industrial end node.

[0029] The preset time length refers to a pre-set fixed time window length, which can be implemented by using a sliding window algorithm or a fixed interval division method, and is used to cut continuous data streams into manageable data units for subsequent phased processing.

[0030] The information dimension refers to a data type classification direction, which can be implemented by using device identification, timestamp, sensor type, data format, etc. as independent information dimensions to improve the rationality of data grouping through multi-dimensional feature analysis.

[0031] The node data to be uploaded is the data prepared to be uploaded by the target end node, which contains feature information of multiple information dimensions. These data reflect the state and parameters of various physical entities in the industrial production process, and are the basis for subsequent analysis and processing of industrial production conditions. For example, the temperature data collected by a sensor may contain device identification, timestamp, sensor type, data format, etc. in addition to the temperature value itself.

[0032] Specifically, first, the preset time length, i.e. the pre-set fixed time window length, is determined, which can be implemented by using a sliding window algorithm or a fixed interval division method. For the node data to be uploaded generated by the target end node at each time, the continuous node data stream to be uploaded is cut into manageable data units according to the preset time length, and these data units are the first data segments.

[0033] Among them, the data generated in the industrial production process is continuous, in order to facilitate subsequent phased processing of these massive data, the preset time length is used to divide the continuous data stream. The fixed time window length set by the preset time length can separate the data of different time periods, the sliding window algorithm realizes dynamic division by sliding the window on the data stream, and the fixed interval division method directly cuts the data stream at fixed time intervals, so as to obtain the first data segments which are convenient for subsequent analysis and processing.

[0034] S200, based on the feature information of each node data to be uploaded in the first data segment in each information dimension, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment.

[0035] In this step, the second data segment is a data unit obtained by dividing the node data to be uploaded in the first data segment based on the feature information of each node data to be uploaded in the first data segment in each information dimension. It is more detailed and targeted than the first data segment, providing a more accurate data basis for subsequent determination of attack possibility and other operations.

[0036] Specifically, for each to-be-uploaded node data in the first data segment, the characteristics of the node data in each information dimension, such as device identifier, timestamp, sensor type, and data format, are analyzed in detail. According to these multi-dimensional characteristics, a suitable classification algorithm or rule is used to further subdivide the data in the first data segment, thereby obtaining at least one second data segment. For example, data collected by sensors of the same type can be divided into the same second data segment according to the sensor type.

[0037] Among them, the division of the first data segment is relatively broad, and the characteristic information of different information dimensions can accurately reflect the internal attributes and correlations of the data. Through multi-dimensional characteristic analysis, the data can be grouped more scientifically and reasonably, the data in the second data segment has stronger similarity and pertinence, and more accurate data basis is provided for subsequent accurate assessment of attack possibility, thereby improving the accuracy of data processing and analysis.

[0038] S300, determining the attack possibility of the second data segment based on historical upload information of historical node data corresponding to each to-be-uploaded node data in the second data segment.

[0039] In this step, the historical node data is data collected and uploaded by the industrial end node in a certain time period in the past. These data record the historical state and parameters in the industrial production process, and by analyzing the historical node data, the normal operation mode and law of the industrial production can be understood. For example, the temperature data collected by a sensor every day in the past month is historical node data.

[0040] The historical upload information refers to the past transmission record of the industrial end node, which can be realized by using edge device logs and cloud storage records as data sources, and by comparing the historical transmission mode to identify abnormal risks.

[0041] The attack possibility is based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, and by analyzing the differences between the historical transmission mode and the current data transmission situation and other factors, the attack possibility of the second data segment in the transmission or storage process is evaluated. For example, if the upload frequency of the current second data segment suddenly increases greatly compared with the historical upload mode, and the amount of uploaded data also abnormally increases, it can be considered that the second data segment has a high attack possibility.

[0042] Specifically, the historical node data collected and uploaded by the target end node in a specific time period in the past, and the historical upload information in the edge device log and cloud storage record recording the transmission process thereof are collected. The node data to be uploaded in the second data segment is compared and analyzed with the corresponding historical node data and historical upload information to observe the same points and difference points of the current data in uploading frequency, data volume, data format, etc. According to the same points and difference points, an evaluation model or rule preset is used to determine the possibility of attack on the second data segment in the transmission or storage process.

[0043] The historical node data and the historical upload information reflect the normal mode and rule of industrial production data transmission. By comparing the second data segment with the historical node data, the evaluation model can quantify the possibility of attack, providing a decision basis for subsequent anti-tampering encryption processing.

[0044] S400, based on the possibility of attack on the second data segment, anti-tampering encryption processing is performed on the second data segment.

[0045] In this step, the anti-tampering encryption processing refers to a data integrity protection mechanism, which can specifically adopt a hierarchical encryption strategy, and dynamically select a hash chain or an asymmetric encryption algorithm for different risk level data segments to achieve a balance between security and computing resources.

[0046] Specifically, according to the evaluation result of the possibility of attack on the second data segment, it is divided into different risk levels. For the data segment with high possibility of attack, a high-security but high-computing-resource-consuming encryption method such as asymmetric encryption algorithm is used to encrypt the data; for the data segment with low possibility of attack, a relatively simple and low-computing-resource-consuming encryption method such as hash chain is used to ensure the basic security of the data. Through this hierarchical encryption strategy, a balance between security and computing resources is achieved.

[0047] The second data segment of different risk levels faces different security threats, and using a unified encryption method will cause resource waste or insufficient security protection. The hierarchical encryption strategy dynamically selects an encryption algorithm according to the risk level of the data, uses a strong encryption algorithm for high-risk data to ensure its security, and uses a simple encryption algorithm for low-risk data to save computing resources, thereby improving the overall operation efficiency and resource utilization of the system while ensuring data security.

[0048] The application establishes an adaptive encryption mechanism based on the possibility of data segment being attacked by combining multi-dimensional feature analysis and historical behavior modeling through a dynamic phased data processing architecture. After cutting the data stream into the first data segment according to the time window, the second data segment is further divided according to the multi-dimensional feature similarity, and the risk of each second data segment being attacked is evaluated based on the historical transmission mode, and finally the differentiated encryption strength allocation is realized. This hierarchical and multi-dimensional data processing method effectively solves the problem that the traditional single encryption mode cannot adapt to the complexity of industrial data and the dynamic risk changes.

[0049] As an example, in a sensor network of a certain intelligent manufacturing factory, pressure sensors and temperature and humidity sensors generate data at a frequency of once per second. First, the data generated by these sensors within one hour is divided into 12 first data segments according to a preset time length of 5 minutes.

[0050] Next, multi-dimensional feature analysis is performed on the data in each first data segment. For example, the fluctuation amplitude of pressure data and the change trend of temperature and humidity data are analyzed. Based on these feature information, each first data segment is further divided into several second data segments. Specifically, abnormal fluctuation of pressure data may be divided into a second data segment, while stable temperature and humidity data are divided into another second data segment.

[0051] Then, the historical upload information corresponding to each data point in these second data segments is queried. For example, it is checked whether the historical data with similar time period and similar data characteristics in the past week has been tampered with. Based on this historical information, a possibility of attack score is calculated for each second data segment.

[0052] Finally, according to the possibility of attack score of each second data segment, an encryption algorithm with corresponding strength is selected for anti-tamper processing. For example, a more complex encryption algorithm may be used for high-risk pressure data segments, while a relatively simple encryption method is used for low-risk temperature and humidity data segments.

[0053] Through this embodiment, the node data to be uploaded of the target end node is divided into first data segments according to a preset time length, and the second data segments are further divided according to the feature information of each node data to be uploaded in multiple information dimensions, realizing fine classification management of the data. At the same time, the possibility of attack of the second data segment is evaluated in combination with the historical upload information of the historical node data, which can accurately identify the security risk level of different data segments. Finally, the second data segment is subjected to targeted anti-tamper encryption processing according to the possibility of attack, which not only avoids waste of computing resources, but also provides stronger protection for high-risk data. In this way, this differentiated and fine-grained processing method effectively makes up for the shortcomings of the prior art and significantly improves the security of industrial end node data.

[0054] In some schemes of the above-mentioned embodiments of the present application, the first data segment is divided based on a preset time length to preliminarily organize the node data to be uploaded, however, in this process, simply relying on the time dimension for data segmentation is easy to ignore the correlation between multi-dimensional features, resulting in potential abnormal correlation in the segmented data, which may reduce the pertinence of subsequent encryption processing.

[0055] To this end, as shown in Figure 2 the present application further proposes that S200 includes the following S210 to S250: S210, based on the feature information of each node data group to be uploaded in the first data segment in each information dimension, respectively determining the segmentation optimization degree of each node data group to be uploaded in each information dimension; each node data to be uploaded in the same time in the first data segment is included in the node data group to be uploaded, and the segmentation optimization degree is used to represent the reference size of the information dimension for dividing the node data group to be uploaded; S220, for each node data group to be uploaded, the information dimension with a segmentation optimization degree greater than a preset optimization threshold is screened out, and a target information dimension set of the node data group to be uploaded is constructed; S230, comparing the target information dimension set of the first node data group to be uploaded with the target information dimension set of the second node data group to be uploaded, determining the similarity anomaly degree of the first node data group to be uploaded and the second node data group to be uploaded, and determining the correlation index of the first node data group to be uploaded and the second node data group to be uploaded; the first node data group to be uploaded and the second node data group to be uploaded are any two different node data groups to be uploaded; S240, screening out the first node data group to be uploaded and the second node data group to be uploaded with a similarity anomaly degree greater than a preset anomaly degree threshold, to obtain a target node data group to be uploaded; S250, based on the correlation index between each target node data group to be uploaded, clustering each target node data group to be uploaded to obtain at least one second data segment.

[0056] In this embodiment, for any industrial end node, a plurality of sensor devices are usually integrated under one industrial end node, resulting in that more industrial end node data will be collected at each moment, and then causing great pressure on data encryption anti-tampering and data transmission. Therefore, even if lightweight encryption is used, it will still affect the timeliness and anti-tampering effect of the data, so the industrial end node data is first segmented, and then corresponding encryption and transmission are performed according to different data segments.

[0057] Since the industrial end node data is accompanied by the acquisition of multiple information dimension characteristic information when collected, the target information dimension set of the industrial end node data is constructed by combining the multi-dimensional characteristic information of each industrial end node data, and then the target information dimension set of different industrial end node data is segmented for processing, that is, the data with similar characteristics at the same time are transmitted together, which not only ensures the correlation between the data, but also improves the efficiency of data tamper-proofing and transmission efficiency.

[0058] The segmentation degree is calculated by the difference index and complexity index of the to-be-uploaded node data in the to-be-uploaded node data group. The difference index reflects the internal fluctuation of the to-be-uploaded node data group between the characteristic information, and the complexity index measures the processing difficulty by the number of to-be-uploaded node data and the memory occupation of characteristic information. The target information dimension set filters the dimensions with segmentation degree exceeding the threshold, for example, which usually includes device identification dimension and time dimension. The similarity abnormality degree and the correlation index are jointly calculated by the same points and different points between the target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group. After screening the to-be-uploaded node data group with too high similarity abnormality degree, clustering is performed based on the correlation index to form the second data segment.

[0059] Specifically, for the to-be-uploaded node data group in the first data segment, the segmentation degree is first calculated in multiple information dimensions such as device identification, time, and sensor type. For example, in the device identification dimension, if the device identification characteristic variance in the to-be-uploaded node data group is 0.8, the data quantity is 5, and the memory occupation of a single characteristic information is 2KB, then the complexity index is 5x2=10, and the segmentation degree is 0.8÷10=0.08. The target information dimension set is constructed by screening the information dimensions with segmentation degree exceeding 0.05. Subsequently, the target information dimension sets of any two to-be-uploaded node data groups are compared, and the similarity abnormality degree is 0.9. After screening the to-be-uploaded node data group with similarity abnormality degree exceeding 0.85, the remaining to-be-uploaded node data groups are hierarchically clustered according to the correlation index to form the second data segment. This process eliminates potential abnormal associations through multi-dimensional feature correlation analysis, making the data segment division more suitable for subsequent dynamic encryption needs.

[0060] As an example, based on the characteristic information of each to-be-uploaded node data in each information dimension in the first data segment, the to-be-uploaded node data in the first data segment is divided to obtain at least one second data segment. Specifically, first, based on the characteristic information of each to-be-uploaded node data group in each information dimension in the first data segment, the segmentation degree of each to-be-uploaded node data group in each information dimension is determined. The to-be-uploaded node data group includes each to-be-uploaded node data at the same time in the first data segment, and the segmentation degree is used to represent the reference size of the information dimension for dividing the to-be-uploaded node data group.

[0061] Further, for each to-be-uploaded node data set, information dimensions with a segmentation goodness greater than a preset goodness threshold are screened out, and a target information dimension set of the to-be-uploaded node data set is constructed. For example, the preset goodness threshold can be set to 0.05, and when the segmentation goodness of a certain information dimension is greater than 0.05, the information dimension is included in the target information dimension set.

[0062] Subsequently, the target information dimension set of the first to-be-uploaded node data set is compared with the target information dimension set of the second to-be-uploaded node data set, the similarity anomaly degree of the first to-be-uploaded node data set and the second to-be-uploaded node data set is determined, and the correlation index of the first to-be-uploaded node data set and the second to-be-uploaded node data set is determined. The first to-be-uploaded node data set and the second to-be-uploaded node data set are any two to-be-uploaded node data sets.

[0063] Therefore, the first to-be-uploaded node data set and the second to-be-uploaded node data set with a similarity anomaly degree greater than a preset anomaly degree threshold are screened out, and a target to-be-uploaded node data set is obtained. As a preferred embodiment, the preset anomaly degree threshold can be set to 0.9, and when the similarity anomaly degree of two to-be-uploaded node data sets is greater than 0.9, the two to-be-uploaded node data sets are screened out.

[0064] Finally, based on the correlation index between each target to-be-uploaded node data set, the target to-be-uploaded node data set is clustered, and at least one second data segment is obtained. For example, the K-means clustering algorithm can be used, and the correlation index is used as the clustering feature to cluster the target to-be-uploaded node data set into multiple second data segments.

[0065] Through the embodiment, fine division of industrial end node data is realized. By analyzing the characteristics of to-be-uploaded node data in each information dimension and combining the similarity anomaly degree and the correlation index for screening and clustering, more reasonable data segment division is obtained. This division method considers the multidimensional characteristics and correlation of data, can better identify and separate abnormal data, and improves the pertinence and effectiveness of subsequent tamper-proof encryption processing. At the same time, by screening out data sets with high similarity anomaly degree, the processing of redundant data is reduced, and the processing efficiency of the system is improved. In addition, the clustering based on the correlation index can combine data sets with similar characteristics, which is convenient for subsequent unified processing and analysis.

[0066] In some schemes of the application, when the first data segment is divided based on the feature information of the information dimension, information dimensions with reference value need to be screened out as the division basis. However, the reference value of different information dimensions for data division is difficult to quantify, resulting in a lack of objective standard for determining the segmentation goodness and affecting the accuracy of data segment division.

[0067] To this end, the application further proposes that S210 comprises: performing variance calculation on the feature information of each to-be-uploaded node data in the to-be-uploaded node data set in the target information dimension to obtain a difference index of the to-be-uploaded node data set in the target information dimension; the target information dimension is any information dimension; determining a complexity index of the to-be-uploaded node data set in the target information dimension by using the number of to-be-uploaded node data in the to-be-uploaded node data set and the memory occupation amount corresponding to the feature information of each to-be-uploaded node data in the target information dimension; determining a segmentation optimality of the to-be-uploaded node data set in the target information dimension by using the difference index and the complexity index.

[0068] In this embodiment, the difference index is obtained by calculating the variance of the feature values of each to-be-uploaded node data in the to-be-uploaded node data set in the target information dimension. The greater the variance, the higher the data volatility, and the stronger the discrimination of the target information dimension for data segmentation. The complexity index is determined by comprehensively determining the number of to-be-uploaded node data in the to-be-uploaded node data set and the memory occupation amount of the feature information of each to-be-uploaded node data in the target information dimension. The higher the memory occupation amount, the higher the processing complexity. The segmentation optimality can be generated by weighted calculation of the difference index and the complexity index.

[0069] Specifically, in the process of the to-be-uploaded node data set, first, a target information dimension is selected, for example, a temperature dimension. For the feature information under the temperature dimension, the variance of the feature values of each to-be-uploaded node data in the to-be-uploaded node data set is calculated. Then, the number of to-be-uploaded node data contained in the to-be-uploaded node data set and the memory occupation amount of each to-be-uploaded node data feature value are counted, so as to determine the complexity index of the to-be-uploaded node data set in the temperature dimension. Finally, based on the difference index and the complexity index, the segmentation optimality of the temperature dimension is determined. When the segmentation optimality exceeds a preset threshold, it is determined that the temperature dimension has segmentation reference value. By quantitatively evaluating the data volatility and processing complexity of each information dimension, it is ensured that the selected information dimension can effectively distinguish data features and avoid introducing too high calculation burden.

[0070] The complexity index of the to-be-uploaded node data set in the target information dimension can be determined by the following formula 1: Formula 1 In formula 1, is used to represent the complexity index of the to-be-uploaded node data set in the i-th information dimension, n is used to represent the number of to-be-uploaded node data in the to-be-uploaded node data set, is used to represent the memory occupation amount corresponding to the feature information of the u-th to-be-uploaded node data in the i-th information dimension.

[0071] The greater the memory occupancy corresponding to the feature information of each to-be-uploaded node data in the i-th information dimension in the to-be-uploaded node data group, the higher the complexity of the to-be-uploaded node data group in the i-th information dimension, that is, the greater the complexity index of the to-be-uploaded node data group in the i-th information dimension.

[0072] The segmentation goodness of the to-be-uploaded node data group in the target information dimension can be determined by the following formula 2: Formula 2 In formula 1, is used to represent the segmentation goodness of the to-be-uploaded node data group in the i-th information dimension, is used to represent the difference index of the to-be-uploaded node data group in the i-th information dimension, is used to represent the complexity index of the to-be-uploaded node data group in the i-th information dimension, and norm is used to represent standardization processing.

[0073] The greater the difference index of the to-be-uploaded node data group in the i-th information dimension, the stronger the discrimination of the i-th information dimension to data segmentation, so the segmentation goodness should be greater. The greater the complexity index of the to-be-uploaded node data group in the i-th information dimension, the greater the processing complexity of the i-th information dimension, so the segmentation goodness should be smaller. In this way, it can be ensured that the selected information dimension can effectively distinguish the data characteristics and avoid introducing too high calculation burden.

[0074] Through the embodiment, the segmentation goodness of the to-be-uploaded node data group in different information dimensions can be effectively evaluated. By calculating the difference index, the discrete degree of data in a specific dimension can be quantified, which helps to identify the change characteristics of data. Combined with the complexity index, the data quantity and storage overhead can be considered comprehensively, and the data characteristics can be more comprehensively evaluated. The final segmentation goodness provides an important basis for subsequent data division and tamper-proof processing, and is conducive to improving the rationality of data segmentation and the pertinence of tamper-proof.

[0075] In some schemes of the present application, a method for comparing the similarity of data groups based on a target information dimension set is proposed to realize data segment division. However, in the comparison process, only simple matching of the target information dimension set is relied on, which leads to the risk of misjudgment of similarity and affects the accuracy of subsequent attack possibility evaluation.

[0076] To this end, the present application further proposes that the target information dimension set includes a device identifier dimension and a time dimension; S230 includes: Pearson correlation coefficient calculation is performed on the target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group to obtain an initial correlation coefficient; If the initial correlation coefficient is greater than the preset correlation coefficient threshold, the feature information of the first data group to be uploaded in the device identification dimension is compared with the feature information of the second data group to be uploaded in the device identification dimension to determine the device identification difference coefficient between the first data group to be uploaded and the second data group to be uploaded. The time dimension feature information of the first data group to be uploaded is compared with the time dimension feature information of the second data group to be uploaded to determine the time difference index between the first data group to be uploaded and the second data group to be uploaded. The similarity and anomaly degree between the first data group to be uploaded and the second data group to be uploaded are determined by using the device identification difference coefficient and the time difference index.

[0077] In this embodiment, the Pearson correlation coefficient is calculated using a numerical vector of the target information dimension set as input, and a preset correlation coefficient threshold of 0.7 is set to filter low-association data pairs. The device identifier difference coefficient is determined by calculating the Hamming distance between two sets of device identifier codes. When the two sets of device identifier codes match perfectly, the device identifier difference coefficient is 0; when there are differing bits, the coefficient increases proportionally to the number of differing bits; when they are completely different, the device identifier difference coefficient is 1. The time difference index is determined by normalizing the absolute difference between two sets of timestamps.

[0078] Specifically, after calculating the initial correlation coefficient, only the first and second data groups of nodes to be uploaded whose initial correlation coefficients exceed the preset correlation coefficient threshold are verified using device identification and time dimensions. This yields the degree of similarity anomaly between the first and second data groups of nodes to be uploaded, which can be determined using the following formula 3: Formula 3 In formula 3, Used to characterize the degree of similarity anomalies of the r-th data group of the node to be uploaded in the j-th first data segment. The device identifier difference coefficient used to characterize the r-th data group to be uploaded by the node. The r-th node is used to characterize the time difference index of the data group to be uploaded, and norm is used to characterize the normalization process.

[0079] In this context, the same sensor device will not repeatedly obtain node data at the same time. That is, when the device identifiers of the node data groups to be uploaded are the same, the timestamps in their target information dimension sets will definitely be different, and vice versa.

[0080] As an example, firstly, the Pearson correlation coefficient is calculated between the target information dimension set of the first data group to be uploaded and the target information dimension set of the second data group to be uploaded, to obtain the initial correlation coefficient.

[0081] Secondly, if the initial correlation coefficient is greater than a preset correlation coefficient threshold, the feature information of the first data group to be uploaded in the device identification dimension is compared with the feature information of the second data group to be uploaded in the device identification dimension to determine the device identification difference coefficient between the two data groups. Further, the feature information of the first data group to be uploaded in the time dimension is compared with the feature information of the second data group to be uploaded in the time dimension to determine the time difference index between the two data groups.

[0082] Finally, using the device identifier consistency coefficient and the time difference index, the degree of similarity anomaly between the first data group to be uploaded and the second data group to be uploaded is determined by the above formula 3.

[0083] For example, in practical applications, a preset correlation coefficient threshold of 0.8 can be set. When the initial correlation coefficient is greater than 0.8, further comparisons are made of feature information in the device identification dimension and the time dimension. The device identification difference coefficient can be determined by comparing whether the device IDs of two data groups to be uploaded are the same; if they are the same, it is 0, and if they are different, it is 1. The time difference index can be determined by calculating the difference between the timestamps of two data groups to be uploaded. Finally, the device identification difference coefficient and the time difference index can be combined to obtain the degree of similarity anomaly.

[0084] This embodiment effectively identifies and filters data groups with similar anomaly characteristics. By conducting in-depth comparisons of device identification and time dimensions, the degree of similarity between data groups can be determined more accurately. This method not only considers the overall correlation of the data but also pays special attention to device identification and time information, thereby improving the accuracy and reliability of anomaly detection. Furthermore, this method effectively reduces the false alarm rate, avoiding misclassifying normal but similar data as anomalies, while improving the ability to identify truly anomalous data.

[0085] In some of the solutions described above in this invention, when determining the correlation index based on the initial correlation coefficient, the impact of device identification differences and time differences on the correlation of the data groups of the nodes to be uploaded is not considered. This results in the correlation index failing to accurately reflect the true degree of correlation between the data groups of the nodes to be uploaded, thereby affecting the accuracy of subsequent clustering and segmentation.

[0086] In this regard, the present invention further proposes that S230 also includes: The correction weight is determined based on the degree of similarity anomalies between the first data group to be uploaded and the second data group to be uploaded. Based on the corrected weights, the initial correlation coefficients are corrected to obtain the correlation index between the first data group to be uploaded and the second data group to be uploaded.

[0087] In this embodiment, the correction weight is dynamically adjusted based on the degree of similarity anomaly. When the degree of similarity anomaly is high, the correction weight is reduced accordingly to weaken the proportion of the initial correlation coefficient in the correlation index. The initial correlation coefficient is obtained by calculating the Pearson correlation coefficient, reflecting the degree of linear association between the data groups of nodes to be uploaded on the target information dimension set. The corrected correlation index comprehensively considers the linear association between the data groups of nodes to be uploaded and the abnormal differences in device identification and time dimensions, thereby improving the accuracy of the index.

[0088] Specifically, after calculating the initial correlation coefficient, the similarity anomaly degree is first calculated based on the device identifier consistency coefficient and the time difference index. Then, using a pre-defined weight mapping table, the similarity anomaly degree is converted into a corresponding corrected weight value. This corrected weight value is used to weight and correct the initial correlation coefficient, generating the final correlation index. For example, when the initial correlation coefficient is 0.7 and the corrected weight is 0.6, the corrected correlation index is 0.7 × 0.6 = 0.42. This correlation index retains the correlation characteristics between the original data dimensions while eliminating the interference of abnormal data groups through weight adjustment, ensuring that the subsequent clustering process can accurately classify data groups with genuine correlation, providing a reliable basis for matching targeted anti-tampering encryption strategies to different data segments.

[0089] The correlation index between the first data group to be uploaded and the second data group to be uploaded can be determined using the following formula 4: Formula 4 In formula 4, This is used to characterize the relevance of the r-th data group of the node to be uploaded in the j-th first data segment. Used to characterize the initial correlation coefficient of the r-th data group of the node to be uploaded in the j-th first data segment. Used to characterize the degree of similarity anomalies of the r-th data group of the node to be uploaded in the j-th first data segment.

[0090] As an example, the correction weight is determined based on the degree of similarity between the first and second data groups to be uploaded. Specifically, different correction weight values ​​can be set according to the magnitude of the similarity. For example, a smaller correction weight value is set when the similarity is high, and a larger correction weight value is set when the similarity is low.

[0091] Furthermore, based on the adjusted weights, the initial correlation coefficient is adjusted to obtain the correlation index between the first and second data groups of nodes to be uploaded. Specifically, the adjustment method can be to multiply the initial correlation coefficient by the adjusted weights. For example, if the initial correlation coefficient is 0.7 and the adjusted weight is 0.8, then the adjusted correlation index is 0.7 × 0.8 = 0.56.

[0092] Therefore, by introducing a corrected weight to adjust the initial correlation coefficient, a more accurate correlation index can be obtained, which can better reflect the actual correlation between different groups of data to be uploaded.

[0093] This embodiment improves the accuracy and reliability of correlation indicators. By introducing corrective weights to adjust the initial correlation coefficient, it better reflects the actual correlation between the data groups of nodes to be uploaded, avoiding misjudgments that may result from relying solely on the initial correlation coefficient. This contributes to the accuracy of subsequent data analysis and processing, thereby improving the overall system's data tamper-proof capability and reliability.

[0094] In some of the solutions described above in this invention, when determining the attack probability of the second data segment based on the historical upload information of historical node data, relying solely on a single historical data source may result in an incomplete evaluation result, failing to accurately reflect the potential risks of data at different transmission stages, thereby affecting the targeting of subsequent anti-tampering encryption processing.

[0095] In response, this invention further proposes that the historical upload information includes first historical upload information and second historical upload information. The first historical upload information is the historical upload information of historical node data on the edge device, and the second historical upload information is the historical upload information of historical node data on the industrial data platform. The edge device is a gateway or an edge server. like Figure 3 As shown, S300 includes the following S310 to S330: S310, Based on the first historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, determine the simple data index of the second data segment; S320, Based on the second historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, determine the score of the historical tampering of the second data segment; S330 uses simple data metrics and historical tampering scores to determine the likelihood of an attack on the second data segment.

[0096] In this embodiment, before implementing anti-tampering encryption, it is necessary to fully consider the possibility of data tampering attacks on the node to be uploaded, thereby providing data support for data anti-tampering encryption. For example, low-priority basic data lacking real-time verification may contain "simple data" in industrial end-point node data. Such data (e.g., ambient temperature and humidity in ordinary workshops, operating time of non-critical equipment) is often easily targeted by attackers for "low-cost tampering" due to simplified protection logic. Simultaneously, by analyzing the historical tampering probability of different data in edge devices and industrial data platforms, the attackers' preferences for different attack targets can be determined, such as targeting a certain type of equipment or a certain time period.

[0097] The determination of the data simplicity index is achieved through historical encryption order and memory usage. Specifically, the encryption priority of each node data to be uploaded is determined based on the historical encryption order of the historical node data. For example, the node data with the earlier the most recent encryption time has a higher priority. The structural complexity index of each node data to be uploaded is determined based on the historical memory usage of the historical node data. For example, the greater the memory usage, the higher the structural complexity index.

[0098] The historical tampering score is determined by the tampering frequency, tampering rate, and tampering preference coefficient. Specifically, the probability of tampering of the data of each node to be uploaded is calculated based on the historical tampering frequency and historical tampering rate. For example, a weighted summation method is used to merge historical tampered data from different dimensions. Then, the tampering preference coefficient for the corresponding historical period is obtained, for example, by statistically calculating the average number of times all data has been tampered within that historical period.

[0099] Specifically, when determining simple data metrics, encryption priority reflects the urgency of data encryption, while structural complexity reflects the processing difficulty of the data structure. Combining these two metrics quantifies the vulnerability of data during the edge device upload phase. When determining historical tampering scores, the likelihood of tampering comprehensively considers the historical risks of historical node data, and the tampering preference coefficient introduces attack patterns over time. Combining these two metrics quantifies the historical threats to the data to be uploaded during the platform storage phase. By linearly or non-linearly combining simple data metrics with historical tampering scores, such as through product or weighted summation, the attack probability is ultimately obtained. This attack probability can simultaneously cover the risk characteristics of both data transmission and storage, thereby matching differentiated encryption strategies to data segments with different risk levels. For example, multi-level encryption or dynamic key mechanisms can be used for data segments with high attack probability.

[0100] The vulnerability of the second data segment to attack can be determined using the following formula 5: Formula 5 In formula 5, Used to characterize the attack probability of the x-th second data segment. A simple indicator used to characterize the x-th second data segment. The score is used to characterize the historical tampering score of the xth second data segment, and norm is used to characterize the normalization process.

[0101] As an example, firstly, based on the first historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, a simple data index for the second data segment is determined. Specifically, an index value reflecting the complexity of the data can be calculated by analyzing information such as the upload frequency and upload time interval of historical node data on edge devices.

[0102] Secondly, based on the second historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, the historical tampering score of the second data segment is determined. For example, the number of times historical node data was detected to have been tampered with on the industrial data platform can be counted, and a historical tampering score can be calculated based on the severity of the tampering.

[0103] Finally, the vulnerability of the second data segment is determined using simple data metrics and historical tampering scores. This can be achieved by multiplying the simple data metrics and historical tampering scores, followed by standardization, to obtain a comprehensive attack probability score. A higher score indicates a greater likelihood that the data segment is vulnerable to attack.

[0104] This embodiment fully utilizes historical uploaded information to analyze data characteristics from both edge device and industrial data platform levels, comprehensively assessing the attack potential of data segments. This multi-dimensional analysis method improves the accuracy and comprehensiveness of attack potential assessment, providing a more reliable basis for subsequent anti-tampering encryption processing. Therefore, it allows for targeted strengthening of protection for high-risk data segments, improving overall data security, while avoiding over-encryption of low-risk data segments, thus balancing security and system efficiency.

[0105] In some of the solutions described above in this invention, when determining the data simplicity index based on historical uploaded information, the correlation between encryption priority and structural complexity is not comprehensively considered, resulting in insufficient accuracy in the evaluation of the data simplicity index and affecting the accuracy of subsequent attack probability calculation.

[0106] In this regard, the present invention further proposes that S310 includes: Based on the historical encryption order of the historical node data corresponding to each node data to be uploaded in the second data segment, the encryption priority of each node data to be uploaded is determined respectively. Based on the historical memory usage of the historical node data corresponding to each node data to be uploaded in the second data segment, the structural complexity index of each node data to be uploaded is determined. By utilizing the encryption priority of each node's data to be uploaded and the structural complexity index of each node's data to be uploaded, the data simplicity index of the second data segment is determined.

[0107] In this embodiment, the encryption priority is determined by parsing the historical encryption order corresponding to the data of the node to be uploaded, the structural complexity index is determined by calculating the historical memory usage, and the encryption priority and the structural complexity index are associated by a weighted fusion algorithm.

[0108] Specifically, from the historical upload information of edge devices, the encryption records of each node's data to be uploaded over the past three months are extracted, and the average of its historical encryption order is calculated to determine its encryption priority. Simultaneously, the historical memory usage of the data to be uploaded during historical transmissions is calculated to determine its structural complexity index. Finally, based on the encryption priority and structural complexity index of each node's data to be uploaded, the data simplicity index of the second data segment is determined.

[0109] The encryption priority of the node data to be uploaded can be determined using the following formula 6: Formula 6 In formula 6, Used to characterize the encryption priority of the v-th node data to be uploaded in the x-th second data segment. The average value of the historical encryption order of the historical node data corresponding to the v-th node data to be uploaded in the x-th second data segment.

[0110] The higher the average value of the historical encryption order, the later the encryption order of the historical node data corresponding to the data to be uploaded, and the lower the encryption priority of the data to be uploaded.

[0111] The simple indicators for the second data segment can be determined using the following formula 7: Formula 7 In formula 7, A simple indicator used to characterize the x-th second data segment. Used to characterize the encryption priority of the v-th node data to be uploaded in the x-th second data segment. The index is used to characterize the structural complexity of the data of the v-th node to be uploaded in the x-th second data segment, and m is used to characterize the number of data of the node to be uploaded in the x-th second data segment.

[0112] In the second data segment, the higher the encryption priority and the greater the structural complexity index of the node data to be uploaded, the smaller the data simplicity index of the second data segment.

[0113] This embodiment effectively utilizes historical uploaded information to assess the characteristics of data segments, providing crucial reference for subsequent anti-tampering encryption processing. Consequently, targeted protective measures can be implemented for data segments with different characteristics, improving the security and anti-tampering capabilities of industrial end-node data. Furthermore, by considering encryption priority and structural complexity, this solution can more comprehensively evaluate the characteristics of data segments, thereby enabling more precise anti-tampering strategy formulation.

[0114] In some of the solutions described above in this invention, a simple data index is determined based on the first historical upload information of historical node data, and a historical tampering score is determined based on the second historical upload information. However, this process does not take into account the differences in the tampering preferences of attackers at different time periods, resulting in insufficient accuracy in assessing the risk of data tampering.

[0115] In this regard, the present invention further proposes that S320 includes: Based on the first historical tampering frequency, the second historical tampering frequency, and the target historical tampering rate of the historical node data corresponding to each node data to be uploaded in the second data segment, the probability of tampering of each node data to be uploaded in the second data segment is determined respectively; the first historical tampering frequency is the historical tampering frequency of the data type corresponding to the historical node data, the second historical tampering frequency is the historical tampering frequency of the sensor device corresponding to the historical node data, and the target historical tampering rate is the historical tampering rate of the data type corresponding to the historical node data. Obtain the tampered preference coefficients for the target historical period corresponding to the second data segment; By utilizing the probability of data tampering at each node to be uploaded and the tampering preference coefficient for the target historical period, the historical tampering score of the second data segment is determined.

[0116] In this embodiment, the first historical tampering frequency is obtained by counting the number of times the data type corresponding to the historical node data is tampered with within a preset period. The second historical tampering frequency is obtained by counting the number of times the sensor device corresponding to the historical node data is tampered with within a preset period. The target historical tampering rate is obtained by calculating the ratio of the number of times the data type corresponding to the historical node data is tampered with within a preset period to the total amount of data. The tampering preference coefficient is determined by analyzing the temporal distribution characteristics of tampering events recorded by the industrial data platform within the historical period and using a sliding window algorithm to calculate the tampering event density for different historical periods. Specifically, the historical period is divided into multiple consecutive historical periods using a sliding window, and the tampering event density corresponding to each historical period (i.e., the ratio of the number of tampered data corresponding to the historical period to the total amount of data corresponding to the historical period) is calculated. Then, the tampering event density corresponding to each historical period is divided by the sum of the tampering event densities corresponding to each historical period to obtain the tampering preference coefficient corresponding to each historical period. Further, when there are multiple historical periods, the tampering preference coefficient for a certain historical period is the average value of the tampering preference coefficients for that historical period within each historical period.

[0117] Specifically, the probability of data being tampered with on the node to be uploaded can be determined using the following formula 8: Formula 8 In formula 8, Used to characterize the probability of the v-th node data to be uploaded in the x-th second data segment being tampered with. Used to characterize the frequency of tampering with the first history of the data of the v-th node to be uploaded in the x-th second data segment. This is used to characterize the frequency of tampering with the second history of the data of the vth node to be uploaded in the xth second data segment. The target historical tampering rate of the data of the vth node to be uploaded in the xth second data segment is used to characterize the normalization process.

[0118] The score for historical data tampering in the second data segment can be determined using the following formula 9: Formula 9 In formula 9, Used to characterize the score of historical data tampering in the xth second data segment. The variable m is used to characterize the probability of the v-th node data to be uploaded in the x-th second data segment being tampered with, and m is used to characterize the number of node data to be uploaded in the x-th second data segment. The coefficient of tampered preference is used to characterize the target historical time period corresponding to the x-th second data segment, and norm is used to characterize the normalization process. This is used to represent the cumulative multiplication of the probability of data being tampered with from each node to be uploaded.

[0119] This embodiment effectively solves the problem of insufficient accuracy in detecting time-based tampering in industrial data platforms. By integrating historical security data from the device and data type dimensions, and combining it with attack pattern characteristics of specific time periods, dynamic risk assessment of potential tampering is achieved. This mechanism can accurately identify data vulnerabilities during peak periods of periodic attacks, providing differentiated priority determination criteria for subsequent encryption strategies, thereby enhancing the proactive defense capabilities of industrial end-point data in complex network environments.

[0120] In some of the solutions described above in this invention, after determining the possibility of the second data segment being attacked, the anti-tampering encryption requirements of the second data segment are not accurately quantified based on the importance of the monitoring object corresponding to the industrial end node, resulting in low security of the anti-tampering encryption processing of the second data segment.

[0121] In this regard, the present invention further proposes S400 including: The importance of the monitored objects in the second data segment is determined by using the average device failure rate and encryption priority of each node data to be uploaded in the second data segment; the device failure rate is used to characterize the failure rate of the sensor devices corresponding to the node data to be uploaded. By utilizing the importance of the monitored objects in the second data segment and the likelihood of the second data segment being attacked, the anti-tampering encryption requirements for the second data segment are determined. Based on the anti-tampering encryption requirements of the second data segment, anti-tampering encryption processing is performed on the second data segment.

[0122] In this embodiment, after completing the segmentation processing of the data to be uploaded and the analysis of the possibility of attack, it is necessary to further perform anti-tampering encryption processing on the data segments at the industrial end node. Since the data of the industrial end node can reflect the equipment status and production status of the industrial end node, such as key equipment data and data with high real-time requirements, there are different anti-tampering requirements for different data segments. When performing anti-tampering encryption, it is necessary to consider the consumption of the encryption process and the final anti-tampering encryption effect.

[0123] The importance of a monitored object can be determined using the following formula 10: Formula 10 In formula 10, Used to characterize the importance of the monitored object in the x-th second data segment. Used to characterize the encryption priority of the v-th node data to be uploaded in the x-th second data segment. The average device failure rate used to characterize the data of each node to be uploaded in the xth second data segment.

[0124] The equipment failure rate is determined by calculating the ratio of the number of times the sensor device corresponding to the node data to be uploaded fails within a preset period to the total number of times the sensor device fails within the preset period.

[0125] The anti-tampering encryption requirement index can be determined using the following formula 11: Formula 11 In formula 11, An indicator used to characterize the tamper-proof encryption requirements of the x-th second data segment. Used to characterize the importance of the monitored object in the x-th second data segment. The norm is used to characterize the attack probability of the xth second data segment, and the normalization process is used to characterize the normalization process.

[0126] After determining the anti-tampering encryption requirements for the second data segment, if the anti-tampering encryption requirements... High demand at the time; tamper-proof encryption requirements The demand is moderate at this time; the demand for tamper-proof encryption is high. Demand was low at that time.

[0127] Finally, according to the first Anti-tampering encryption requirements for the second data segment , for the The second data segment undergoes tamper-proof encryption. For example, high-demand data segments are protected with dual protection: AES-128 encryption + HMAC-SHA256 verification, shortening the encryption cycle (once every 5 seconds); medium-demand data segments are protected with enhanced protection: AES-128 encryption with a 10-second encryption cycle; and low-demand data segments are protected with basic protection: HMAC-SHA1 verification with a 15-second encryption cycle.

[0128] In this embodiment, the present invention achieves dynamic adaptation of encryption strategies by quantitatively assessing the importance of the monitored objects and the likelihood of attack in the second data segment, effectively enhancing the protection level of high-value device data. It automatically increases encryption strength for critical data generated by vulnerable devices and promptly updates security keys in the event of device anomalies, blocking potential data tampering paths. Simultaneously, it configures encryption resources differently based on risk levels, avoiding the waste of computing resources caused by over-encrypting low-risk data, thus optimizing system operating efficiency while ensuring security.

[0129] Based on the IoT-based industrial end-node data anti-tampering method provided in the embodiments of the present invention, the present invention further provides a specific embodiment of an IoT-based industrial end-node data anti-tampering system.

[0130] like Figure 4As shown in the diagram, this embodiment of the invention provides a structural schematic of an IoT-based industrial end-node data anti-tampering system 400. This IoT-based industrial end-node data anti-tampering system 400 includes a first partitioning module 410, a second partitioning module 420, a probability determination module 430, and an encryption processing module 440.

[0131] The first segmentation module 410 is used to segment the data to be uploaded from the target terminal node at each time according to a preset duration to obtain at least one first data segment; the target terminal node is any industrial terminal node, and the data to be uploaded from the terminal node includes feature information of multiple information dimensions. The second partitioning module 420 is used to partition the data to be uploaded in the first data segment based on the feature information of each node data to be uploaded in each information dimension, so as to obtain at least one second data segment. The probability determination module 430 is used to determine the attack probability of the second data segment based on the historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment. The encryption processing module 440 is used to perform tamper-proof encryption processing on the second data segment based on the attack probability of the second data segment.

[0132] The IoT-based industrial end-node data anti-tampering system provided in this invention divides the data to be uploaded from the target end node into a first data segment according to a preset time duration, and then further divides it into a second data segment based on the multi-dimensional feature information of each data segment, achieving refined data classification and management. Simultaneously, by combining historical upload information of historical node data to assess the attack probability of the second data segment, the security risk level of different data segments can be accurately identified. Finally, targeted anti-tampering encryption processing is applied to the second data segment based on the attack probability, avoiding waste of computing resources and providing stronger protection for high-risk data. Thus, this differentiated and refined processing method effectively compensates for the shortcomings of existing technologies and significantly improves the security of industrial end-node data.

[0133] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0134] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for preventing data tampering at industrial end nodes based on the Internet of Things, characterized in that, The method includes: The data to be uploaded from the target terminal node at each time point is divided according to a preset duration to obtain at least one first data segment; the target terminal node is any industrial terminal node, and the data to be uploaded includes feature information of multiple information dimensions; Based on the feature information of each node data to be uploaded in each information dimension in the first data segment, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment. Based on the historical upload information of the historical node data corresponding to each of the nodes to be uploaded in the second data segment, the possibility of the second data segment being attacked is determined. Based on the vulnerability of the second data segment to attack, the second data segment is subjected to tamper-proof encryption.

2. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, The process involves dividing the data of the nodes to be uploaded in the first data segment into at least one second data segment based on the feature information of each node in each information dimension, including: Based on the feature information of each data group of nodes to be uploaded in the first data segment in each of the information dimensions, the segmentation quality of each data group of nodes to be uploaded in each of the information dimensions is determined respectively; the data group of nodes to be uploaded includes the data of each node to be uploaded at the same time in the first data segment, and the segmentation quality is used to characterize the reference size for dividing the data group of nodes to be uploaded by the information dimensions. For each of the data groups to be uploaded, the information dimensions with segmentation quality greater than a preset quality threshold are filtered out to construct a target information dimension set for the data groups to be uploaded. The target information dimension set of the first data group to be uploaded is compared with the target information dimension set of the second data group to be uploaded to determine the degree of similarity anomaly between the first data group to be uploaded and the second data group to be uploaded, and the correlation index between the first data group to be uploaded and the second data group to be uploaded is determined; the first data group to be uploaded and the second data group to be uploaded are any two different data groups to be uploaded. The first and second data groups of nodes to be uploaded that have a similarity anomaly degree greater than a preset anomaly degree threshold are filtered out to obtain the target data group of nodes to be uploaded. Based on the correlation index among the target data groups to be uploaded, the target data groups to be uploaded are clustered to obtain at least one second data segment.

3. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 2, characterized in that, Based on the feature information of each data group of nodes to be uploaded in the first data segment in each of the information dimensions, the segmentation quality of each data group of nodes to be uploaded in each of the information dimensions is determined, including: The variance of the feature information of each node data in the data group to be uploaded in the target information dimension is calculated to obtain the difference index of the data group to be uploaded in the target information dimension; the target information dimension is any one of the information dimensions. The complexity index of the data group to be uploaded in the target information dimension is determined by using the number of data nodes to be uploaded in the data group to be uploaded and the memory usage of each data node to be uploaded corresponding to the feature information of the target information dimension. Using the difference index and the complexity index, the segmentation quality of the data group of nodes to be uploaded in the target information dimension is determined.

4. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 2, characterized in that, The target information dimension set includes the device identification dimension and the time dimension; The step of comparing the target information dimension set of the first data group to be uploaded with the target information dimension set of the second data group to be uploaded, and determining the degree of similarity anomaly between the first data group to be uploaded and the second data group to be uploaded, includes: The Pearson correlation coefficient is calculated between the target information dimension set of the first data group to be uploaded and the target information dimension set of the second data group to be uploaded to obtain the initial correlation coefficient. If the initial correlation coefficient is greater than the preset correlation coefficient threshold, the feature information of the first node data group to be uploaded in the device identification dimension is compared with the feature information of the second node data group to be uploaded in the device identification dimension to determine the device identification difference coefficient between the first node data group to be uploaded and the second node data group to be uploaded. The feature information of the first data group to be uploaded in the time dimension is compared with the feature information of the second data group to be uploaded in the time dimension to determine the time difference index between the first data group to be uploaded and the second data group to be uploaded. The similarity anomaly degree between the first data group to be uploaded and the second data group to be uploaded is determined by using the device identification difference coefficient and the time difference index.

5. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 4, characterized in that, The determination of the correlation index between the first data group to be uploaded and the second data group to be uploaded includes: The correction weight is determined based on the degree of similarity and anomaly between the first data group of nodes to be uploaded and the second data group of nodes to be uploaded. Based on the corrected weights, the initial correlation coefficients are corrected to obtain the correlation index between the first data group of nodes to be uploaded and the second data group of nodes to be uploaded.

6. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, The historical upload information includes first historical upload information and second historical upload information. The first historical upload information is the historical upload information of the historical node data on the edge device, and the second historical upload information is the historical upload information of the historical node data on the industrial data platform. The edge device is a gateway or an edge server. The determination of the attack potential of the second data segment based on the historical upload information of the historical node data corresponding to each of the nodes to be uploaded in the second data segment includes: Based on the first historical upload information of the historical node data corresponding to each of the node data to be uploaded in the second data segment, the simple data index of the second data segment is determined. Based on the second historical upload information of the historical node data corresponding to each of the data to be uploaded in the second data segment, the historical tampering score of the second data segment is determined. Using the simple data metrics and the historical tampering score, the likelihood of the second data segment being attacked is determined.

7. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 6, characterized in that, The determination of simple data metrics for the second data segment based on the first historical upload information corresponding to the historical node data of each node to be uploaded in the second data segment includes: Based on the historical encryption order of the historical node data corresponding to each node data to be uploaded in the second data segment, the encryption priority of each node data to be uploaded is determined respectively. Based on the historical memory usage of the historical node data corresponding to each node data to be uploaded in the second data segment, the structural complexity index of each node data to be uploaded is determined respectively. The data simplicity index of the second data segment is determined by using the encryption priority of each node data to be uploaded and the structural complexity index of each node data to be uploaded.

8. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 6, characterized in that, The determination of the historical tampering score of the second data segment based on the second historical upload information corresponding to the historical node data of each node to be uploaded in the second data segment includes: Based on the first historical tampering frequency, the second historical tampering frequency, and the target historical tampering rate of the historical node data corresponding to each of the node data to be uploaded in the second data segment, the probability of tampering of each of the node data to be uploaded in the second data segment is determined respectively; the first historical tampering frequency is the historical tampering frequency of the data type corresponding to the historical node data, the second historical tampering frequency is the historical tampering frequency of the sensor device corresponding to the historical node data, and the target historical tampering rate is the historical tampering rate of the data type corresponding to the historical node data. Obtain the tampered preference coefficient for the target historical period corresponding to the second data segment; The historical tampering score of the second data segment is determined by using the probability of tampering of the data of each node to be uploaded and the tampering preference coefficient of the target historical period.

9. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, The step of performing tamper-proof encryption on the second data segment based on its vulnerability to attack includes: The importance of the monitoring object in the second data segment is determined by using the average device failure rate and encryption priority of each node data to be uploaded in the second data segment; the device failure rate is used to characterize the failure rate of the sensor device corresponding to the node data to be uploaded. By utilizing the importance of the monitored objects in the second data segment and the likelihood of the second data segment being attacked, the anti-tampering encryption requirement indicators for the second data segment are determined. Based on the anti-tampering encryption requirements of the second data segment, the second data segment is subjected to anti-tampering encryption processing.

10. A data anti-tampering system for industrial end nodes based on the Internet of Things, characterized in that, The system includes: The first segmentation module is used to segment the data to be uploaded from the target terminal node at each time point according to a preset duration to obtain at least one first data segment; the target terminal node is any industrial terminal node, and the data to be uploaded includes feature information of multiple information dimensions. The second partitioning module is used to partition the data to be uploaded in the first data segment based on the feature information of each node data to be uploaded in each information dimension, so as to obtain at least one second data segment. The probability determination module is used to determine the probability of the second data segment being attacked based on the historical upload information of the historical node data corresponding to each of the data to be uploaded in the second data segment. The encryption processing module is used to perform tamper-proof encryption processing on the second data segment based on the attack probability of the second data segment.

Images