Industrial end node data tamper-proofing method and system based on internet of things

Abstract

The application discloses an industrial end node data tamper-proofing method and system based on an Internet of Things, and relates to the technical field of data processing. The method comprises the following steps: dividing target end node data to be uploaded at each moment according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data comprises feature information of multiple information dimensions; dividing the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension to obtain at least one second data segment; determining the attack possibility of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment; and performing tamper-proofing encryption processing on the second data segment based on the attack possibility of the second data segment. The application can improve the security of industrial end node data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an industrial end node data tamper-proofing method and system based on Internet of Things. BACKGROUND

[0002] Internet of Things has become a key component in current industrial scenarios. Through sensors distributed in industrial end nodes, end node data can be collected in real time and uploaded via wireless networks, realizing centralized collection and real-time transmission of data. Industrial end node data not only reflects the production status, but also closely related to device safety and production process control. Its authenticity and integrity are crucial to the safety and efficiency of industrial production.

[0003] Currently, the tamper-proofing method of industrial end node data mainly includes verifying data integrity using a hash algorithm and implementing data protection using single symmetric encryption combined with simple timestamp segmentation.

[0004] However, the design of single symmetric encryption combined with simple timestamp segmentation is too simple, and the protection of industrial end node data is insufficient, resulting in poor security of industrial end node data. SUMMARY

[0005] The present application provides an industrial end node data tamper-proofing method and system based on Internet of Things, which can improve the security of industrial end node data.

[0006] In a first aspect, the present application provides an industrial end node data tamper-proofing method based on Internet of Things, comprising:

[0007] Divide the target end node's to-be-uploaded node data at each time according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data includes feature information of multiple information dimensions;

[0008] Based on the feature information of each to-be-uploaded node data in the first data segment in each information dimension, divide the to-be-uploaded node data in the first data segment to obtain at least one second data segment;

[0009] Based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, determine the attack possibility of the second data segment;

[0010] Based on the attack possibility of the second data segment, perform tamper-proofing encryption processing on the second data segment.

[0011] Further, the application also proposes that based on the feature information of each to-be-uploaded node data in the first data segment in each information dimension, the to-be-uploaded node data in the first data segment is divided to obtain at least one second data segment, including:

[0012] Based on the feature information of each to-be-uploaded node data group in the first data segment in each information dimension, the segmentation goodness of each to-be-uploaded node data group in each information dimension is determined respectively; the to-be-uploaded node data group includes each to-be-uploaded node data at the same time in the first data segment, and the segmentation goodness is used to represent the reference size of the information dimension for dividing the to-be-uploaded node data group;

[0013] For each to-be-uploaded node data group, the information dimension with the segmentation goodness greater than a preset goodness threshold is screened out to construct a target information dimension set of the to-be-uploaded node data group;

[0014] The target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group are compared to determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, and determine the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group; the first to-be-uploaded node data group and the second to-be-uploaded node data group are any two different to-be-uploaded node data groups;

[0015] The first to-be-uploaded node data group and the second to-be-uploaded node data group with the similarity anomaly degree greater than a preset anomaly degree threshold are screened out to obtain a target to-be-uploaded node data group;

[0016] Based on the correlation index between each target to-be-uploaded node data group, the target to-be-uploaded node data group is clustered to obtain at least one second data segment.

[0017] Further, the application also proposes that based on the feature information of each to-be-uploaded node data group in the first data segment in each information dimension, the segmentation goodness of each to-be-uploaded node data group in each information dimension is determined respectively, including:

[0018] The feature information of each to-be-uploaded node data in the to-be-uploaded node data group in the target information dimension is calculated to obtain the difference index of the to-be-uploaded node data group in the target information dimension; the target information dimension is any one information dimension;

[0019] The number of to-be-uploaded node data of the to-be-uploaded node data group and the memory occupation amount corresponding to the feature information of each to-be-uploaded node data in the target information dimension are used to determine the complexity index of the to-be-uploaded node data group in the target information dimension;

[0020] The difference index and the complexity index are used to determine the segmentation goodness of the to-be-uploaded node data group in the target information dimension.

[0021] Further, the application also proposes that the target information dimension set includes a device identifier dimension and a time dimension.

[0022] Comparing the target information dimension set of the first to-be-uploaded node data group with the target information dimension set of the second to-be-uploaded node data group to determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, including:

[0023] Performing Pearson correlation coefficient calculation on the target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group to obtain an initial correlation coefficient.

[0024] In a case where the initial correlation coefficient is greater than a preset correlation coefficient threshold, comparing the feature information of the device identifier dimension of the first to-be-uploaded node data group with the feature information of the device identifier dimension of the second to-be-uploaded node data group to determine a device identifier difference coefficient of the first to-be-uploaded node data group and the second to-be-uploaded node data group.

[0025] Comparing the feature information of the time dimension of the first to-be-uploaded node data group with the feature information of the time dimension of the second to-be-uploaded node data group to determine a time difference index of the first to-be-uploaded node data group and the second to-be-uploaded node data group.

[0026] Using the device identifier difference coefficient and the time difference index to determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group.

[0027] Further, the application also proposes to determine the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group, including:

[0028] Based on the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, determining a correction weight.

[0029] Based on the correction weight, correcting the initial correlation coefficient to obtain the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group.

[0030] Further, the application also proposes that the historical upload information includes first historical upload information and second historical upload information, the first historical upload information is historical upload information of historical node data at an edge device, the second historical upload information is historical upload information of the historical node data at an industrial data platform, and the edge device is a gateway or an edge server.

[0031] Based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, determining the attack possibility of the second data segment, including:

[0032] determine the data simple index of the second data segment based on the first historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0033] determine the historical tampered score of the second data segment based on the second historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0034] determine the attack possibility of the second data segment by using the data simple index and the historical tampered score.

[0035] Further, the application also proposes that the data simple index of the second data segment is determined based on the first historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, and the method comprises the following steps:

[0036] determine the encryption priority of each to-be-uploaded node data based on the historical encryption sequence of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0037] determine the structure complexity index of each to-be-uploaded node data based on the historical memory occupation of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0038] determine the data simple index of the second data segment by using the encryption priority of each to-be-uploaded node data and the structure complexity index of each to-be-uploaded node data.

[0039] Further, the application also proposes that the historical tampered score of the second data segment is determined based on the second historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, and the method comprises the following steps:

[0040] determine the tampered possibility of each to-be-uploaded node data in the second data segment based on the first historical tampered frequency, the second historical tampered frequency and the target historical tampered rate of the historical node data corresponding to each to-be-uploaded node data in the second data segment; the first historical tampered frequency is the historical tampered frequency of the data type corresponding to the historical node data, the second historical tampered frequency is the historical tampered frequency of the sensor device corresponding to the historical node data, and the target historical tampered rate is the historical tampered rate of the data type corresponding to the historical node data;

[0041] obtain the tampered preference coefficient of the target historical time period corresponding to the second data segment;

[0042] determine the historical tampered score of the second data segment by using the tampered possibility of each to-be-uploaded node data and the tampered preference coefficient of the target historical time period.

[0043] Further, the application also proposes that, based on the attack possibility of the second data segment, the second data segment is subjected to anti-tampering encryption processing, including:

[0044] The monitoring object importance of the second data segment is determined by using the average value of the device failure rate of each to-be-uploaded node data in the second data segment and the encryption priority; the device failure rate is used to represent the failure rate of the sensor device corresponding to the to-be-uploaded node data;

[0045] The anti-tampering encryption demand index of the second data segment is determined by using the monitoring object importance of the second data segment and the attack possibility of the second data segment;

[0046] Based on the anti-tampering encryption demand index of the second data segment, the second data segment is subjected to anti-tampering encryption processing.

[0047] The second aspect of the embodiment of the application provides an industrial end node data anti-tampering system based on an Internet of Things, including:

[0048] The first division module is used for dividing the to-be-uploaded node data of the target end node at each time according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data includes feature information of multiple information dimensions;

[0049] The second division module is used for dividing the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension in the first data segment to obtain at least one second data segment;

[0050] The possibility determination module is used for determining the attack possibility of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0051] The encryption processing module is used for subjecting the second data segment to anti-tampering encryption processing based on the attack possibility of the second data segment.

[0052] The application has the following beneficial effects:

[0053] The method for preventing tampering of industrial end node data based on the Internet of Things provided by the embodiment of the present application, by dividing the to-be-uploaded node data of the target end node into a first data segment according to a preset time length, and further dividing a second data segment according to the feature information of each to-be-uploaded node data in multiple information dimensions, realizes fine classification management of the data. At the same time, the attack possibility of the second data segment is evaluated in combination with the historical uploading information of the historical node data, so that the security risk level of different data segments can be accurately identified. Finally, the second data segment is subjected to targeted anti-tampering encryption processing according to the attack possibility, which not only avoids waste of computing resources, but also provides stronger protection for high-risk data. In this way, this differentiated and fine processing method effectively makes up for the shortcomings of the prior art and significantly improves the security of the industrial end node data. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0055] Figure 1 A flowchart of a method for preventing tampering of industrial end node data based on the Internet of Things provided by an embodiment of the present application;

[0056] Figure 2 A flowchart of S200 provided by an embodiment of the present application;

[0057] Figure 3 A flowchart of S300 provided by an embodiment of the present application;

[0058] Figure 4 A structural diagram of a system for preventing tampering of industrial end node data based on the Internet of Things provided by an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the following describes the method and system for preventing tampering of industrial end node data based on the Internet of Things according to the present application, its specific implementation, structure, features and effects in detail, as follows. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0061] It should be noted that the acquisition, storage, use, processing, etc. of data in the technical solutions of the present application comply with the relevant provisions of laws and regulations.

[0062] It should be noted that in the embodiments of the present application, some existing industry solutions may be mentioned, such as software, components, models, etc. They should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0063] In the traditional existing industrial Internet of Things end node data tamper-proofing scheme, a fixed time window is used to divide data segments and implement unified strength encryption strategy, which cannot dynamically adjust the segmentation strategy according to multi-dimensional data characteristics, resulting in the same encryption level for high-sensitive data segments and low-risk data segments. This static segmentation mechanism is difficult to cope with the characteristics of large data value density difference and dynamic attack surface in industrial scenarios, resulting in insufficient protection of key data segments and redundant resources of non-key data segments.

[0064] For example, in the distributed sensor network of the intelligent manufacturing factory, the pressure sensor and the temperature and humidity sensor generate multi-dimensional data stream containing device running state and environmental parameters at a millisecond level frequency. The existing method packs all sensor data within five minutes into a single data segment, and uploads it to the gateway after AES-128 encryption. When a batch of pressure sensor data appears a sharp rising waveform due to device abnormalities, its data value is significantly higher than that of temperature and humidity data in the same time period, but the existing method still mixes and encrypts it for transmission. Attackers can implement man-in-the-middle attacks on high-value pressure data, while low-value temperature and humidity data consumes the same computing power for encryption verification.

[0065] When facing the above problems, the present application first considers how to realize dynamic division and differential encryption of data segments. The traditional fixed time window division cannot distinguish the data value density, and the present application attempts to start from multi-dimensional feature analysis, and establishes a dynamic segmentation mechanism by analyzing the data characteristics of different information dimensions. For example, cross analysis of device identifier dimension and time dimension can identify data groups with similar abnormal characteristics. Further combined with historical tampered records and device running state, a multi-dimensional risk assessment model is established. On this basis, a set of information dimensions with high segmentation reference value is selected, and a second data segment with risk level difference is formed through clustering algorithm. Finally, for each second data segment, a hierarchical encryption requirement index is generated to realize the precise matching of encryption strength and data value.

[0066] To this end, the application provides an industrial end node data tamper-proofing method based on Internet of Things. The specific scenario of the application is as follows: in an industrial scenario, the transmission path of industrial end node data is "industrial end node-gateway / edge server-industrial data platform", wherein the industrial end node usually refers to a terminal device capable of directly collecting data. Since the industrial end node data can directly reflect the device working state and real production information, when the data is uploaded to the gateway / edge server from the industrial end node, the industrial end node data needs to be encrypted first, and the encrypted industrial end node data needs to have sufficient tamper-proofing capability. Therefore, the application provides an industrial end node data tamper-proofing method and system based on Internet of Things.

[0067] As shown in Figure 1 The industrial end node data tamper-proofing method based on Internet of Things can be applied to an electronic device, which includes the following S100 to S400:

[0068] S100, dividing the to-be-uploaded node data of a target end node at each time point according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data includes feature information of multiple information dimensions.

[0069] In this step, the industrial end node refers to a device or node at the end position of the network architecture in the industrial network system. These nodes are usually directly connected with various physical entities (such as sensors, actuators, production devices, etc.) in the industrial production process, responsible for collecting data (such as temperature, pressure, speed, etc.) of the industrial field, and are the key link of industrial data generation and initial interaction. For example, in an automobile manufacturing factory, the sensor node installed on the production line for detecting the size of parts is an industrial end node.

[0070] The preset time length refers to a pre-set fixed time window length, which can be realized by using a sliding window algorithm or a fixed interval division method, for cutting continuous data stream into manageable data units for subsequent phased processing.

[0071] The information dimension refers to the data type classification direction, which can be realized by using device identification, timestamp, sensor type, data format, etc. as independent information dimensions to improve the rationality of data grouping through multi-dimensional feature analysis.

[0072] The to-be-uploaded node data is data prepared to be uploaded by the target end node, and contains feature information of multiple information dimensions. These data reflect the states and parameters of various physical entities in the industrial production process, and are the basis for subsequent analysis and processing of the industrial production situation. For example, temperature data collected by a sensor may contain device identification, timestamp, sensor type, data format, and other information dimension features in addition to the temperature value itself.

[0073] Specifically, first, a preset time length, i.e., a pre-set fixed time window length, is determined, which can be achieved by using a sliding window algorithm or a fixed interval division method. For the to-be-uploaded node data generated by the target end node at each time, the continuous to-be-uploaded node data stream is cut into manageable data units according to the preset time length, and these data units are the first data segments.

[0074] Among them, the data generated in the industrial production process is continuous. In order to facilitate subsequent processing of these massive data in stages, the continuous data stream is divided by using a preset time length. The fixed time window length set by the preset time length can separate the data of different time periods. The sliding window algorithm realizes dynamic division by sliding the window on the data stream, and the fixed interval division method directly cuts the data stream at a fixed time interval, thereby obtaining the first data segments that are convenient for subsequent analysis and processing.

[0075] S200, based on the feature information of each to-be-uploaded node data in each information dimension in the first data segment, the to-be-uploaded node data in the first data segment is divided to obtain at least one second data segment.

[0076] In this step, the second data segment is a data unit obtained by dividing the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension. It is more detailed and targeted than the first data segment, and provides a more accurate data basis for subsequent operations such as determining the attack possibility.

[0077] Specifically, for each to-be-uploaded node data in the first data segment, the features in each information dimension such as device identification, timestamp, sensor type, and data format are analyzed in detail. According to these multi-dimensional features, a suitable classification algorithm or rule is used to further subdivide the data in the first data segment, thereby obtaining at least one second data segment. For example, data collected by sensors of the same type can be divided into the same second data segment.

[0078] The first data segment is relatively broad, and the characteristic information of different information dimensions can accurately reflect the internal attributes and correlations of the data. Through multi-dimensional feature analysis, the data can be grouped more scientifically and reasonably, making the data in the second data segment have stronger similarity and pertinence, providing more accurate data basis for subsequent accurate assessment of attack possibility, and improving the accuracy of data processing and analysis.

[0079] S300, based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, determining the attack possibility of the second data segment.

[0080] In this step, the historical node data is the data collected and uploaded by the industrial end node in a certain time period in the past. These data record the historical state and parameters in the industrial production process, and by analyzing the historical node data, the normal operation mode and law of industrial production can be understood. For example, the temperature data collected by a sensor every day in the past month is historical node data.

[0081] The historical upload information refers to the past transmission record of the industrial end node, which can be realized by using edge device logs and cloud storage records as data sources, and by comparing the historical transmission mode to identify abnormal risks.

[0082] The attack possibility is based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, and by analyzing the differences between the historical transmission mode and the current data transmission situation, the attack possibility of the second data segment in the transmission or storage process is evaluated. For example, if the upload frequency of the second data segment suddenly increases significantly compared with the historical upload mode, and the amount of uploaded data also abnormally increases, it can be considered that the second data segment has a high attack possibility.

[0083] Specifically, the historical node data collected and uploaded by the target end node in a certain time period in the past, and the historical upload information recorded in the edge device logs and cloud storage records of the transmission process are collected. The to-be-uploaded node data in the second data segment is compared and analyzed with the corresponding historical node data and historical upload information, and the same points and differences between the current data and the historical situation in terms of upload frequency, data volume, data format, etc. are observed. According to these same points and differences, a pre-set evaluation model or rule is used to determine the attack possibility of the second data segment in the transmission or storage process.

[0084] Among them, the historical node data and the historical upload information reflect the normal mode and law of industrial production data transmission. By comparing the current second data segment with the historical node data, the evaluation model can quantify the attack possibility, providing decision basis for subsequent anti-tampering encryption processing.

[0085] S400, based on the possibility of being attacked of the second data segment, anti-tamper encryption processing is performed on the second data segment.

[0086] In this step, the anti-tamper encryption processing refers to a data integrity protection mechanism, which can specifically adopt a hierarchical encryption strategy, and dynamically select a hash chain or an asymmetric encryption algorithm for data segments of different risk levels to achieve a balance between security and computing resources.

[0087] Specifically, according to the evaluation result of the possibility of being attacked of the second data segment, it is divided into different risk levels. For the data segment with high possibility of being attacked, a high-security but high-computing-resource-consuming encryption method such as asymmetric encryption algorithm is adopted to encrypt the data; for the data segment with low possibility of being attacked, a relatively simple and low-computing-resource-consuming encryption method such as hash chain is adopted to ensure the basic security of the data. Through this hierarchical encryption strategy, a balance between security and computing resources is achieved.

[0088] Among them, the second data segments of different risk levels face different security threats, and the use of a unified encryption method will cause resource waste or insufficient security protection. The hierarchical encryption strategy dynamically selects the encryption algorithm according to the risk level of the data, and the high-risk data adopts a strong encryption algorithm to ensure its security, and the low-risk data adopts a simple encryption algorithm to save computing resources, which improves the overall operation efficiency and resource utilization of the system while ensuring the security of the data.

[0089] The application establishes an adaptive encryption mechanism based on the possibility of being attacked of the data segment through a dynamic phased data processing architecture combined with multi-dimensional feature analysis and historical behavior modeling. After cutting the data stream into first data segments according to the time window, the second data segments are further divided according to the multi-dimensional feature similarity, and the risk of being attacked of each second data segment is evaluated based on the historical transmission mode, and finally the differentiated encryption strength allocation is realized. This hierarchical and multi-dimensional data processing method effectively solves the problem that the traditional single encryption mode cannot adapt to the complexity of industrial data and the dynamic risk changes.

[0090] As an example, in the sensor network of a certain intelligent manufacturing factory, pressure sensors and temperature and humidity sensors generate data at a frequency of once per second. First, the data generated by these sensors within one hour is divided according to a preset time length of 5 minutes to obtain 12 first data segments.

[0091] Then, multi-dimensional feature analysis is performed on the data in each first data segment. For example, the fluctuation amplitude of pressure data and the change trend of temperature and humidity data are analyzed. Based on these feature information, each first data segment is further divided into several second data segments. Specifically, abnormal fluctuation of pressure data may be divided into a second data segment, while stable temperature and humidity data may be divided into another second data segment.

[0092] Then, the historical upload information corresponding to each data point in these second data segments is queried. For example, whether the historical data of similar time period and similar data characteristics in the past week has been tampered with is checked. Based on these historical information, a possibility of attack score is calculated for each second data segment.

[0093] Finally, according to the possibility of attack score of each second data segment, an encryption algorithm of corresponding strength is selected for anti-tampering processing. For example, a more complex encryption algorithm can be used for a high-risk pressure data segment, and a relatively simple encryption method is used for a low-risk temperature and humidity data segment.

[0094] Through the embodiment, the node data to be uploaded of the target end node is divided into first data segments according to a preset time length, and the second data segments are further divided according to the characteristic information of each node data to be uploaded in multiple information dimensions, thereby realizing fine classification management of the data. At the same time, the possibility of attack of the second data segment is evaluated in combination with the historical upload information of the historical node data, so that the security risk level of different data segments can be accurately identified. Finally, the second data segment is subjected to targeted anti-tampering encryption processing according to the possibility of attack, which not only avoids waste of computing resources, but also provides stronger protection for high-risk data. In this way, the differentiated and fine processing method effectively makes up for the shortcomings of the prior art and significantly improves the security of the industrial end node data.

[0095] In some schemes of the present application, the first data segments are divided based on a preset time length to preliminarily organize the node data to be uploaded. However, in this process, simply relying on the time dimension for data segmentation can easily ignore the correlation between multi-dimensional characteristics, resulting in potential abnormal association within the segmented data, which can reduce the pertinence of subsequent encryption processing.

[0096] To this end, as shown in the figure, Figure 2 the present application further proposes S200 including the following S210 to S250:

[0097] S210, based on the characteristic information of each node data group to be uploaded in each information dimension in the first data segment, the segmentation optimization degree of each node data group to be uploaded in each information dimension is determined; the node data group to be uploaded includes each node data to be uploaded at the same time in the first data segment, and the segmentation optimization degree is used to represent the reference size of the information dimension for dividing the node data group to be uploaded;

[0098] S220, for each node data group to be uploaded, the information dimension with a segmentation optimization degree greater than a preset optimization threshold is screened out, and a target information dimension set of the node data group to be uploaded is constructed;

[0099] S230, compare the target information dimension set of the first to-be-uploaded node data group with the target information dimension set of the second to-be-uploaded node data group, determine the similarity anomaly degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, and determine the correlation index of the first to-be-uploaded node data group and the second to-be-uploaded node data group; the first to-be-uploaded node data group and the second to-be-uploaded node data group are any two different to-be-uploaded node data groups;

[0100] S240, screen out the first to-be-uploaded node data group and the second to-be-uploaded node data group with the similarity anomaly degree greater than the preset anomaly degree threshold, and obtain the target to-be-uploaded node data group;

[0101] S250, cluster each target to-be-uploaded node data group based on the correlation index between the target to-be-uploaded node data groups, and obtain at least one second data segment.

[0102] In this embodiment, for any industrial end node, multiple sensor devices are usually integrated under one industrial end node, resulting in the collection of a large amount of industrial end node data at each moment, and thus causing great pressure on data encryption anti-tampering and data transmission. Therefore, even if lightweight encryption is used, it will still affect the timeliness and anti-tampering effect of the data, so the industrial end node data is first segmented, and then encrypted and transmitted according to different data segments.

[0103] Since the industrial end node data is collected with the acquisition of multiple information dimension feature information, the target information dimension set of the industrial end node data is constructed by combining the multi-dimensional feature information of each industrial end node data, and then the target information dimension set of different industrial end node data is segmented, that is, the data with similar characteristics at the same moment is transmitted together, which not only ensures the association between the data, but also improves the efficiency of data anti-tampering and transmission efficiency.

[0104] The segmentation degree is calculated by the difference index and the complexity index of the to-be-uploaded node data in the to-be-uploaded node data group. The difference index reflects the internal fluctuation of the to-be-uploaded node data group by the variance between the feature information, and the complexity index measures the processing difficulty by the number of to-be-uploaded node data and the memory occupation of feature information. The target information dimension set screens the dimensions with segmentation degree exceeding the threshold, for example, which usually includes device identifier dimension and time dimension. The similarity anomaly degree and the correlation index are jointly calculated by the same points and different points between the target information dimension set of the first to-be-uploaded node data group and the target information dimension set of the second to-be-uploaded node data group. After screening out the to-be-uploaded node data group with too high similarity anomaly degree, clustering is performed based on the correlation index to form a second data segment.

[0105] Specifically, for the node data groups to be uploaded in the first data segment, the segmentation goodness is first calculated in the device identifier, time, sensor type and other information dimensions. For example, in the device identifier dimension, if the device identifier feature variance in the node data groups to be uploaded is 0.8, the data quantity is 5, and the memory occupancy of a single feature information is 2 KB, then the complexity index is 5x2=10, and the segmentation goodness is 0.8÷10=0.08. The information dimensions with the segmentation goodness exceeding 0.05 are screened to construct a target information dimension set. Then, the target information dimension sets of any two node data groups to be uploaded are compared, and the similarity anomaly degree is obtained as 0.9. The node data groups to be uploaded with the similarity anomaly degree exceeding 0.85 are screened out, and the remaining node data groups to be uploaded are hierarchically clustered according to the correlation index to form a second data segment. Through multi-dimensional feature correlation analysis, the process eliminates potential abnormal correlations, so that the data segment division is more suitable for subsequent dynamic encryption requirements.

[0106] As an example, based on the feature information of each node data to be uploaded in the first data segment in each information dimension, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment. Specifically, first, based on the feature information of each node data group to be uploaded in the first data segment in each information dimension, the segmentation goodness of each node data group to be uploaded in each information dimension is determined. The node data group to be uploaded includes each node data to be uploaded at the same time in the first data segment, and the segmentation goodness is used to represent the reference size of the information dimension for dividing the node data group to be uploaded.

[0107] Further, for each node data group to be uploaded, the information dimension with the segmentation goodness greater than a preset goodness threshold is screened out to construct a target information dimension set of the node data group to be uploaded. For example, the preset goodness threshold can be set to 0.05, and when the segmentation goodness of a certain information dimension is greater than 0.05, the information dimension is included in the target information dimension set.

[0108] Then, the target information dimension set of the first node data group to be uploaded is compared with the target information dimension set of the second node data group to be uploaded to determine the similarity anomaly degree of the first node data group to be uploaded and the second node data group to be uploaded, and to determine the correlation index of the first node data group to be uploaded and the second node data group to be uploaded. The first node data group to be uploaded and the second node data group to be uploaded are any two different node data groups to be uploaded.

[0109] Thus, the first to-be-uploaded node data set and the second to-be-uploaded node data set with a similarity abnormality degree greater than a preset abnormality degree threshold are screened out to obtain a target to-be-uploaded node data set. As an optional implementation, the preset abnormality degree threshold can be set to 0.9, and when the similarity abnormality degrees of two to-be-uploaded node data sets are greater than 0.9, the two to-be-uploaded node data sets are screened out.

[0110] Finally, based on the correlation indexes between the target to-be-uploaded node data sets, the target to-be-uploaded node data sets are clustered to obtain at least one second data segment. For example, the K-means clustering algorithm can be used to cluster the target to-be-uploaded node data sets into multiple second data segments by taking the correlation indexes as clustering features.

[0111] Through the embodiment, fine division of industrial end node data is achieved. By analyzing the features of to-be-uploaded node data in each information dimension and screening and clustering in combination with the similarity abnormality degree and the correlation index, more reasonable data segment division is obtained. This division method considers the multidimensional features and correlation of data, can better identify and separate abnormal data, and improves the pertinence and effectiveness of subsequent tamper-proof encryption processing. At the same time, by screening out data sets with high similarity abnormality degree, the processing of redundant data is reduced, and the processing efficiency of the system is improved. In addition, the clustering based on the correlation index can combine data sets with similar features together, which is convenient for subsequent unified processing and analysis.

[0112] In some schemes of the present application, when the first data segment is divided based on the feature information of the information dimension, information dimensions with reference value need to be screened out as division basis. However, the reference value of different information dimensions for data division is difficult to quantify, resulting in a lack of objective standard for determining the division optimality and affecting the accuracy of data segment division.

[0113] To this end, the present application further provides that S210 comprises:

[0114] The variance of the feature information of each to-be-uploaded node data in the target information dimension in the to-be-uploaded node data set is calculated to obtain a difference index of the to-be-uploaded node data set in the target information dimension; and the target information dimension is any one information dimension;

[0115] The number of to-be-uploaded node data of the to-be-uploaded node data set and the memory occupation amount corresponding to the feature information of each to-be-uploaded node data in the target information dimension are used to determine a complexity index of the to-be-uploaded node data set in the target information dimension;

[0116] The difference index and the complexity index are used to determine the division optimality of the to-be-uploaded node data set in the target information dimension.

[0117] In the embodiment, the difference index is obtained by calculating the variance of the characteristic values of each to-be-uploaded node data in the same to-be-uploaded node data group in the target information dimension. The greater the variance, the higher the data volatility, and the stronger the discrimination of the data segmentation in the target information dimension. The complexity index is determined by the number of to-be-uploaded node data in the to-be-uploaded node data group and the memory occupation of the characteristic information of each to-be-uploaded node data in the target information dimension. The higher the memory occupation, the higher the processing complexity. The segmentation goodness can be generated by weighted calculation of the difference index and the complexity index.

[0118] Specifically, in the processing of the to-be-uploaded node data group, first, a target information dimension is selected, for example, a temperature dimension. For the characteristic information in the temperature dimension, the variance of the characteristic values of each to-be-uploaded node data in the to-be-uploaded node data group is calculated. Then, the number of to-be-uploaded node data contained in the to-be-uploaded node data group and the memory occupation of each to-be-uploaded node data characteristic value are counted, so as to determine the complexity index of the to-be-uploaded node data group in the temperature dimension. Finally, based on the difference index and the complexity index, the segmentation goodness of the temperature dimension is determined. When the segmentation goodness exceeds a preset threshold, it is determined that the temperature dimension has segmentation reference value. By quantitatively evaluating the data volatility and processing complexity of each information dimension, it is ensured that the selected information dimension can effectively distinguish the data characteristics and avoid introducing too high calculation burden.

[0119] The complexity index of the to-be-uploaded node data group in the target information dimension can be determined by the following formula 1:

[0120] Formula 1

[0121] In formula 1, is used to represent the complexity index of the to-be-uploaded node data group in the i-th information dimension, and n is used to represent the number of to-be-uploaded node data in the to-be-uploaded node data group, is used to represent the memory occupation corresponding to the characteristic information of the u-th to-be-uploaded node data in the i-th information dimension.

[0122] Wherein, the greater the memory occupation corresponding to the characteristic information of each to-be-uploaded node data in the i-th information dimension in the to-be-uploaded node data group, the higher the complexity of the to-be-uploaded node data group in the i-th information dimension, that is, the greater the complexity index of the to-be-uploaded node data group in the i-th information dimension.

[0123] The segmentation goodness of the to-be-uploaded node data group in the target information dimension can be determined by the following formula 2:

[0124] Formula 2

[0125] In formula 1, a segment optimization degree of the node data set to be uploaded in the i-th information dimension, a difference index of the node data set to be uploaded in the i-th information dimension, a complexity index of the node data set to be uploaded in the i-th information dimension, and norm is used to represent a normalization process.

[0126] Wherein, the greater the difference index of the node data set to be uploaded in the i-th information dimension, the stronger the discrimination of the i-th information dimension to data segmentation, so the segment optimization degree should be greater; the greater the complexity index of the node data set to be uploaded in the i-th information dimension, the greater the processing complexity of the i-th information dimension, so the segment optimization degree should be smaller. In this way, it can be ensured that the selected information dimension can effectively distinguish the data characteristics and avoid introducing too high calculation burden.

[0127] Through the embodiment, the segment optimization degree of the node data set to be uploaded in different information dimensions can be effectively evaluated. By calculating the difference index, the discrete degree of data in a specific dimension can be quantified, which helps to identify the variation characteristics of data. Combined with the complexity index, the data volume and storage overhead can be considered comprehensively, and the data characteristics can be more comprehensively evaluated. The final segment optimization degree provides an important basis for subsequent data division and tamper-proofing processing, which is conducive to improving the rationality of data segmentation and the pertinence of tamper-proofing.

[0128] In some schemes of the present application, a method for comparing the similarity of data sets based on a target information dimension set is proposed to realize data segment division. However, in the comparison process, only simple matching of the target information dimension set is relied on, which leads to the risk of misjudgment of similarity and affects the accuracy of subsequent attack possibility evaluation.

[0129] To this end, the present application further proposes that the target information dimension set includes a device identifier dimension and a time dimension; S230 includes:

[0130] Pearson correlation coefficient calculation is performed on the target information dimension set of the first node data set to be uploaded and the target information dimension set of the second node data set to be uploaded to obtain an initial correlation coefficient;

[0131] In the case where the initial correlation coefficient is greater than a preset correlation coefficient threshold, the feature information of the first node data set to be uploaded in the device identifier dimension is compared with the feature information of the second node data set to be uploaded in the device identifier dimension to determine a device identifier difference coefficient of the first node data set to be uploaded and the second node data set to be uploaded;

[0132] compare feature information of the first to-be-uploaded node data set in the time dimension with feature information of the second to-be-uploaded node data set in the time dimension, to determine a time difference index of the first to-be-uploaded node data set and the second to-be-uploaded node data set;

[0133] Determine the degree of similarity anomaly of the first to-be-uploaded node data set and the second to-be-uploaded node data set by using the device identifier difference coefficient and the time difference index.

[0134] In this embodiment, the Pearson correlation coefficient calculation uses the numerical vector of the target information dimension set as input, and the preset correlation coefficient threshold is set to 0.7 to filter low correlation data set pairs. The device identifier difference coefficient is determined by calculating the Hamming distance of two sets of device identifier codes. When the two sets of device identifier codes are completely matched, the device identifier difference coefficient is 0, and when there is a difference bit, the coefficient is increased in proportion to the number of difference bits. When they are completely different, the device identifier difference coefficient is 1. The time difference index is determined by normalizing the absolute difference between the two sets of time stamps.

[0135] Specifically, after the initial correlation coefficient is calculated, only the first to-be-uploaded node data set and the second to-be-uploaded node data set whose initial correlation coefficient exceeds the preset correlation coefficient threshold are verified in the device identifier and time dimension, so as to obtain the degree of similarity anomaly of the first to-be-uploaded node data set and the second to-be-uploaded node data set. The degree of similarity anomaly can be determined by the following formula 3:

[0136] Formula 3

[0137] In formula 3, is used to represent the degree of similarity anomaly of the rth pair of to-be-uploaded node data sets in the jth first data segment, is used to represent the device identifier difference coefficient of the rth pair of to-be-uploaded node data sets, is used to represent the time difference index of the rth pair of to-be-uploaded node data sets, and norm is used to represent standardization processing.

[0138] Wherein, the same sensor device will not repeatedly obtain node data at the same time, that is, when the device identifier of the to-be-uploaded node data set is consistent, the time stamp in the target information dimension set thereof must be inconsistent, and vice versa.

[0139] As an example, first, the target information dimension set of the first to-be-uploaded node data set is subjected to Pearson correlation coefficient calculation with the target information dimension set of the second to-be-uploaded node data set, to obtain an initial correlation coefficient.

[0140] Secondly, in the case that the initial correlation coefficient is greater than the preset correlation coefficient threshold, the feature information of the first to-be-uploaded node data group in the device identifier dimension is compared with the feature information of the second to-be-uploaded node data group in the device identifier dimension, and a device identifier difference coefficient of the first to-be-uploaded node data group and the second to-be-uploaded node data group is determined. Further, the feature information of the first to-be-uploaded node data group in the time dimension is compared with the feature information of the second to-be-uploaded node data group in the time dimension, and a time difference index of the first to-be-uploaded node data group and the second to-be-uploaded node data group is determined.

[0141] Finally, the device identifier consistency coefficient and the time difference index are used to determine the similar abnormality degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group through the above formula 3.

[0142] For example, in actual application, the preset correlation coefficient threshold can be set to 0.8. When the initial correlation coefficient is greater than 0.8, the feature information in the device identifier dimension and the time dimension is further compared. The device identifier difference coefficient can be determined by comparing whether the device IDs of the two to-be-uploaded node data groups are the same, and if the same, it is 0, and if different, it is 1. The time difference index can be determined by calculating the difference between the time stamps of the two to-be-uploaded node data groups. Finally, the device identifier difference coefficient and the time difference index can be integrated to obtain the similar abnormality degree.

[0143] Through the embodiment, data groups with similar abnormal characteristics can be effectively identified and screened. By deeply comparing the device identifier and the time dimension, the similar abnormality degree between data groups can be more accurately judged. This method not only considers the overall correlation of the data, but also pays special attention to the device identifier and the time information, thereby improving the accuracy and reliability of the abnormality detection. In addition, this method can effectively reduce the false positive rate, avoid misjudging normal but similar data as abnormal, and improve the identification ability of real abnormal data.

[0144] In some schemes of the application, when determining the correlation index based on the initial correlation coefficient, the influence of device identifier difference and time difference on the correlation of to-be-uploaded node data groups is not considered, resulting in that the correlation index cannot accurately reflect the real correlation degree between to-be-uploaded node data groups, and further affecting the accuracy of subsequent clustering segmentation.

[0145] In this regard, the application further proposes that S230 further includes:

[0146] Based on the similar abnormality degree of the first to-be-uploaded node data group and the second to-be-uploaded node data group, a correction weight is determined.

[0147] The initial correlation coefficient is corrected based on the correction weight to obtain the correlation indicators of the first to-be-uploaded node data set and the second to-be-uploaded node data set.

[0148] In this embodiment, the correction weight is dynamically adjusted according to the similar abnormality degree. When the similar abnormality degree is high, the correction weight is correspondingly reduced to weaken the proportion of the initial correlation coefficient in the correlation indicator. The initial correlation coefficient is obtained by calculating the Pearson correlation coefficient and reflects the linear correlation degree of the to-be-uploaded node data set in the target information dimension set. The corrected correlation indicator comprehensively considers the linear correlation between the to-be-uploaded node data sets and the abnormality difference of the device identifier and the time dimension, and improves the accuracy of the indicator.

[0149] Specifically, after the initial correlation coefficient is calculated, the similar abnormality degree is first calculated according to the device identifier consistency coefficient and the time difference index. Then, the similar abnormality degree is converted into a corresponding correction weight value through a preset weight mapping table. The correction weight value is used to weight and correct the initial correlation coefficient to generate the final correlation indicator. For example, when the initial correlation coefficient is 0.7 and the correction weight is 0.6, the corrected correlation indicator is 0.7*0.6=0.42. The correlation indicator not only retains the association characteristics between the original data dimensions, but also eliminates the interference of abnormal data sets through weight adjustment, ensuring that the subsequent clustering process can accurately divide the data sets with true correlation and providing a reliable basis for matching targeted anti-tampering encryption strategies for different data segments.

[0150] The correlation indicator of the first to-be-uploaded node data set and the second to-be-uploaded node data set can be determined by the following formula 4:

[0151] Formula 4

[0152] In formula 4, is used to represent the correlation indicator of the rth pair of to-be-uploaded node data sets in the jth first data segment, is used to represent the initial correlation coefficient of the rth pair of to-be-uploaded node data sets in the jth first data segment, is used to represent the similar abnormality degree of the rth pair of to-be-uploaded node data sets in the jth first data segment.

[0153] As an example, the correction weight is determined based on the similar abnormality degree of the first to-be-uploaded node data set and the second to-be-uploaded node data set. Specifically, different correction weight values can be set according to the size of the similar abnormality degree. For example, when the similar abnormality degree is high, a smaller correction weight value is set; when the similar abnormality degree is low, a larger correction weight value is set.

[0154] Further, based on the correction weight, the initial correlation coefficient is corrected to obtain the correlation indicators of the first to-be-uploaded node data set and the second to-be-uploaded node data set. The specific correction method can be to multiply the initial correlation coefficient by the correction weight. For example, if the initial correlation coefficient is 0.7 and the correction weight is 0.8, the corrected correlation indicator is 0.7*0.8=0.56.

[0155] In this way, by introducing the correction weight to adjust the initial correlation coefficient, a more accurate correlation indicator can be obtained, thereby better reflecting the actual correlation degree between different to-be-uploaded node data sets.

[0156] Through the embodiment, the accuracy and reliability of the correlation indicator can be improved. By introducing the correction weight to adjust the initial correlation coefficient, the actual correlation degree between the to-be-uploaded node data sets can be better reflected, and misjudgment caused by relying only on the initial correlation coefficient can be avoided. This helps to improve the accuracy of subsequent data analysis and processing, and further improves the data tamper-proofing capability and reliability of the entire system.

[0157] In some schemes of the present application, when determining the attack possibility of the second data segment based on the historical upload information of the historical node data, relying only on a single historical data source may lead to an incomplete evaluation result, which cannot accurately reflect the potential risks of the data in different transmission stages, thereby affecting the pertinence of subsequent tamper-proofing encryption processing.

[0158] To this end, the present application further provides that the historical upload information includes first historical upload information and second historical upload information, the first historical upload information is historical upload information of the historical node data at the edge device, the second historical upload information is historical upload information of the historical node data at the industrial data platform, and the edge device is a gateway or an edge server.

[0159] As shown in FIG. 7, S300 includes the following S310 to S330: Figure 3

[0160] S310, determining a data simplicity indicator of the second data segment based on the first historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0161] S320, determining a historical tampering score of the second data segment based on the second historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0162] S330, determining the attack possibility of the second data segment by using the data simplicity indicator and the historical tampering score.

[0163] ​In this embodiment, before tamper-proof encryption is performed, the possibility of tampering attack received by the to-be-uploaded node data also needs to be fully considered, thereby providing data support for data tamper-proof encryption. For example, low-priority basic data lacking real-time verification contains "simple data" in industrial end node data. Such data (such as ordinary workshop environment temperature and humidity, non-critical equipment running time) are usually easy to become the "low-cost tampering" target of attackers because of the simplified protection logic. At the same time, by analyzing the historical tampering probability of different data in the edge device and the industrial data platform, the preferences of attackers for different attack targets are determined, such as a certain type of device or a certain time period.

[0164] The determination of the data simplicity index is realized by the historical encryption order and the memory occupation amount, specifically: the encryption priority of each to-be-uploaded node data is determined according to the historical encryption order of the historical node data, for example, the node data whose last encryption time is earlier has a higher priority; the structure complexity index of each to-be-uploaded node data is determined according to the historical memory occupation amount of the historical node data, for example, the greater the memory occupation amount, the higher the structure complexity index.

[0165] The determination of the historical tampering score is realized by the tampering frequency, the tampering rate and the tampering preference coefficient, specifically: the tampering possibility of each to-be-uploaded node data is calculated based on the historical tampering frequency and the historical tampering rate, for example, the historical tampering data in different dimensions are fused in a weighted summation manner; then the tampering preference coefficient corresponding to the historical period is obtained, for example, the average value of the tampering times of all data in the historical period is counted.

[0166] Specifically, in the determination of the data simplicity index, the encryption priority reflects the urgency of data encryption, and the structure complexity index reflects the processing difficulty of the data structure, and the combination of the two can quantify the vulnerability of the data in the uploading stage of the edge device. In the determination of the historical tampering score, the tampering possibility comprehensively considers the historical risk of the historical node data, and the tampering preference coefficient introduces the attack law in the time dimension, and the combination of the two can quantify the historical threat of the to-be-uploaded node data in the platform storage stage. By linear or nonlinear combination, such as product or weighted summation, of the data simplicity index and the historical tampering score, the attack possibility is finally obtained, which can cover the risk characteristics of the data transmission and storage links at the same time, thereby matching different encryption strategies for data segments of different risk levels, for example, using multi-level encryption or dynamic key mechanism for data segments with high attack possibility.

[0167] The attack possibility of the second data segment can be determined by the following formula 5:

[0168] Formula 5

[0169] In formula 5, a data simplicity indicator for characterizing the xth second data segment, a data simplicity indicator for characterizing the xth second data segment, a history tampering score for characterizing the xth second data segment, and norm for characterizing normalization processing.

[0170] As an example, first, based on the first history upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, a data simplicity indicator of the second data segment is determined. Specifically, an index value reflecting the complexity of the data can be calculated by analyzing the upload frequency, upload time interval, and other information of the historical node data at the edge device.

[0171] Secondly, based on the second history upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment, a history tampering score of the second data segment is determined. For example, the number of times the historical node data is detected to be tampered with on the industrial data platform can be counted, and combined with the severity of the tampering, a history tampering score is calculated.

[0172] Finally, the data simplicity indicator and the history tampering score are used to determine the attack possibility of the second data segment. The data simplicity indicator and the history tampering score can be multiplied and then normalized to obtain a comprehensive attack possibility score. The higher the score, the greater the possibility of attack on the data segment.

[0173] Through the embodiment, the historical upload information is fully utilized, the characteristics of the data are analyzed from two aspects of the edge device and the industrial data platform, and the attack possibility of the data segment is comprehensively evaluated. The multi-dimensional analysis method improves the accuracy and comprehensiveness of the attack possibility evaluation, and provides a more reliable basis for subsequent anti-tampering encryption processing. Thus, the protection of high-risk data segments can be targetedly strengthened, the overall data security is improved, and over-encryption of low-risk data segments is avoided, balancing security and system efficiency.

[0174] In some schemes of the present application, when determining the data simplicity indicator based on the historical upload information, the correlation between the encryption priority and the structural complexity is not comprehensively considered, resulting in insufficient accuracy of the data simplicity indicator evaluation and affecting the calculation accuracy of the subsequent attack possibility.

[0175] To this end, the present application further proposes that S310 comprises:

[0176] Based on the history encryption sequence of the historical node data corresponding to each to-be-uploaded node data in the second data segment, the encryption priority of each to-be-uploaded node data is determined respectively;

[0177] The structure complexity indicators of the to-be-uploaded node data are respectively determined based on the historical memory occupancy of the historical node data corresponding to each to-be-uploaded node data in the second data segment.

[0178] The data simplicity indicators of the second data segment are determined by using the encryption priorities of the to-be-uploaded node data and the structure complexity indicators of the to-be-uploaded node data.

[0179] In this embodiment, the encryption priority is determined by analyzing the historical encryption order corresponding to the to-be-uploaded node data, the structure complexity indicator is determined by calculating the size of the historical memory occupancy, and the encryption priority and the structure complexity indicator are associated by a weighted fusion algorithm.

[0180] Specifically, in the historical upload information of the edge device, the encryption record of each to-be-uploaded node data in the past three months is extracted, the average value of the historical encryption order is counted, and thus the encryption priority is determined. At the same time, the size of the historical memory occupancy of the to-be-uploaded node data in the historical transmission is calculated, and thus the structure complexity indicator is determined. Finally, based on the encryption priority and the structure complexity indicator of each to-be-uploaded node data, the data simplicity indicators of the second data segment are determined.

[0181] The encryption priority of the to-be-uploaded node data can be determined by the following formula 6:

[0182] Formula 6

[0183] In formula 6, is used to represent the encryption priority of the vth to-be-uploaded node data in the xth second data segment, is used to represent the average value of the historical encryption order of the historical node data corresponding to the vth to-be-uploaded node data in the xth second data segment.

[0184] The larger the average value of the historical encryption order is, the later the encryption bit sequence of the historical node data corresponding to the to-be-uploaded node data is, and the smaller the encryption priority of the to-be-uploaded node data is.

[0185] The data simplicity indicators of the second data segment can be determined by the following formula 7:

[0186] Formula 7

[0187] In formula 7, is used to represent the data simplicity indicators of the xth second data segment, is used to represent the encryption priority of the vth to-be-uploaded node data in the xth second data segment, A structure complexity index is used to represent the vth to-be-uploaded node data in the xth second data segment, and m is used to represent the number of to-be-uploaded node data in the xth second data segment.

[0188] The encryption priority of the to-be-uploaded node data in the second data segment is higher, the structure complexity index is larger, and the data simplicity index of the second data segment is smaller.

[0189] Through the embodiment, the historical upload information can be effectively used to evaluate the characteristics of the data segment, thereby providing an important reference for subsequent tamper-proof encryption processing. Thus, corresponding protection measures can be taken for data segments with different characteristics, thereby improving the security and tamper-proof ability of industrial end node data. In addition, by considering the encryption priority and structure complexity, the characteristics of the data segment can be more comprehensively evaluated, thereby realizing more accurate tamper-proof strategy formulation.

[0190] In some schemes of the application, the first historical upload information based on historical node data is used to determine the data simplicity index, and the second historical upload information is used to determine the historical tampered score. However, the tampering preference difference of attackers in different time periods is not considered in this process, resulting in insufficient accuracy of the evaluation of data tampering risk.

[0191] To this end, the application further provides that S320 comprises:

[0192] Based on the first historical tampered frequency, the second historical tampered frequency, and the target historical tampered rate of the historical node data corresponding to each to-be-uploaded node data in the second data segment, the tampered possibility of each to-be-uploaded node data in the second data segment is determined. The first historical tampered frequency is the historical tampered frequency of the data type corresponding to the historical node data, the second historical tampered frequency is the historical tampered frequency of the sensor device corresponding to the historical node data, and the target historical tampered rate is the historical tampered rate of the data type corresponding to the historical node data.

[0193] The tampered preference coefficient of the target historical time period corresponding to the second data segment is obtained.

[0194] The historical tampered score of the second data segment is determined by using the tampered possibility of each to-be-uploaded node data and the tampered preference coefficient of the target historical time period.

[0195] In the embodiment, the first history tampering frequency is obtained by counting the number of tampering times of the data type corresponding to the historical node data in a preset period, the second history tampering frequency is obtained by counting the number of tampering times of the sensor device corresponding to the historical node data in a preset period, and the target history tampering rate is obtained by calculating the ratio of the number of tampering times of the data type corresponding to the historical node data to the total data amount in a preset period. The tampered preference coefficient is determined by analyzing the tampering event time distribution characteristics recorded by the industrial data platform in the historical period, and a sliding window algorithm is used to calculate the tampering event density of different historical periods. Specifically, the historical period is divided into a plurality of continuous historical periods by using a sliding window, and the tampering event density of each historical period (i.e., the ratio of the number of tampering data to the total data amount corresponding to the historical period) is calculated. Then, the tampering event density corresponding to each historical period is divided by the sum of the tampering event density corresponding to each historical period, and the tampered preference coefficient corresponding to each historical period is obtained. Further, in the case of multiple historical periods, the tampered preference coefficient of a certain historical period is the average value of the tampered preference coefficients of the historical period in each historical period.

[0196] Specifically, the tampered possibility of the to-be-uploaded node data can be determined by the following formula 8:

[0197] Formula 8

[0198] In formula 8, is used to represent the tampered possibility of the vth to-be-uploaded node data in the xth second data segment, is used to represent the first history tampering frequency of the vth to-be-uploaded node data in the xth second data segment, is used to represent the second history tampering frequency of the vth to-be-uploaded node data in the xth second data segment, is used to represent the target history tampering rate of the vth to-be-uploaded node data in the xth second data segment, and norm is used to represent the standardization processing.

[0199] The history tampering score of the second data segment can be determined by the following formula 9:

[0200] Formula 9

[0201] In formula 9, is used to represent the history tampering score of the xth second data segment, is used to represent the tampered possibility of the vth to-be-uploaded node data in the xth second data segment, and m is used to represent the number of to-be-uploaded node data in the xth second data segment, a coefficient of tampered preference for characterizing a target historical period corresponding to the xth second data segment, norm is used to characterize standardization processing, a coefficient of tampered preference for characterizing a target historical period corresponding to the xth second data segment, norm is used to characterize standardization processing,

[0202] Through the embodiment, the problem of insufficient detection accuracy of periodical tampering behavior in an industrial data platform is effectively solved. By fusing historical security data in the device dimension and the data type dimension, and combining attack mode characteristics of a specific period, dynamic risk assessment of potential tampering behavior is realized. The mechanism can accurately identify data vulnerability during a period of periodic attack peaks, and provide differentiated priority judgment basis for subsequent encryption strategies, thereby improving the active defense capability of industrial end data in a complex network environment.

[0203] In some schemes of the above-mentioned embodiments of the application, after determining the attack possibility of the second data segment, the anti-tampering encryption requirement index of the second data segment is not accurately quantified based on the importance of the monitoring object corresponding to the industrial end node, thereby resulting in low security of the anti-tampering encryption processing of the second data segment.

[0204] To this end, the application further provides that S400 comprises:

[0205] The monitoring object importance of the second data segment is determined by using the average value of the device failure rate of each to-be-uploaded node data in the second data segment and the encryption priority; the device failure rate is used to represent the failure rate of the sensor device corresponding to the to-be-uploaded node data;

[0206] The anti-tampering encryption requirement index of the second data segment is determined by using the monitoring object importance of the second data segment and the attack possibility of the second data segment;

[0207] The second data segment is subjected to anti-tampering encryption processing based on the anti-tampering encryption requirement index of the second data segment.

[0208] In the embodiment, after the segmentation processing of the to-be-uploaded node data and the analysis of the attack possibility are completed, the data segment needs to be further subjected to anti-tampering encryption processing at the industrial end node. Since the data of the industrial end node can reflect the device state and production state of the industrial end node, such as critical device data and high real-time requirement data, different anti-tampering requirements exist for different data segments, and the consumption of the encryption process and the effect of the final anti-tampering encryption need to be considered when performing anti-tampering encryption.

[0209] The monitoring object importance can be determined by the following formula 10:

[0210] Formula 10

[0211] In formula 10, a monitoring object importance degree of the xth second data segment, an encryption priority of the vth to-be-uploaded node data in the xth second data segment, an average value of a device failure rate of each to-be-uploaded node data in the xth second data segment.

[0212] The device failure rate is determined by calculating a ratio of a number of times of failure of a sensor device corresponding to the to-be-uploaded node data in a preset period to a total number of times of failure of the sensor device in the preset period.

[0213] The tamper-proof encryption demand index can be determined by the following formula 11:

[0214] Formula 11

[0215] In formula 11, a tamper-proof encryption demand index of the xth second data segment, a monitoring object importance degree of the xth second data segment, a possibility of attack of the xth second data segment, and norm represents a standardization processing.

[0216] After the tamper-proof encryption demand index of the second data segment is determined, if the tamper-proof encryption demand index is high, the tamper-proof encryption demand index is medium, and the tamper-proof encryption demand index is low.

[0217] Finally, according to the tamper-proof encryption demand index of the xth second data segment, the xth second data segment is subjected to tamper-proof encryption processing. For example, for a high-demand data segment, double protection is performed, that is, AES-128 encryption + HMAC-SHA256 verification, and an encryption period is shortened (once every 5 seconds); for a medium-demand data segment, strengthened protection is performed, that is, AES-128 encryption, and an encryption period is 10 seconds; and for a low-demand data segment, basic protection is performed, that is, HMAC-SHA1 verification, and an encryption period is 15 seconds.

[0218] ​​​​Through the embodiment, the application quantitatively evaluates the monitoring object importance and attack possibility of the second data segment, realizes dynamic adaptation of the encryption strategy, and effectively enhances the protection level of high-value device data. The encryption strength is automatically improved for the key data generated by the vulnerable device, the security key is updated in time when the device is abnormal, and the potential data tampering path is blocked. Meanwhile, encryption resources are configured according to the risk level difference, the waste of computing resources caused by over-encryption of low-risk data is avoided, and the system running efficiency is optimized on the basis of ensuring security.

[0219] Accordingly, the application further provides a specific embodiment of an industrial end node data tamper-proofing system based on Internet of Things.

[0220] As shown in Figure 4 The application provides a structure diagram of an industrial end node data tamper-proofing system based on Internet of Things. The industrial end node data tamper-proofing system 400 based on Internet of Things includes a first division module 410, a second division module 420, a possibility determination module 430, and an encryption processing module 440.

[0221] The first division module 410 is configured to divide the to-be-uploaded node data of the target end node at each time according to a preset time length to obtain at least one first data segment; the target end node is any industrial end node, and the to-be-uploaded node data includes feature information of multiple information dimensions;

[0222] The second division module 420 is configured to divide the to-be-uploaded node data in the first data segment based on the feature information of each to-be-uploaded node data in each information dimension in the first data segment to obtain at least one second data segment;

[0223] The possibility determination module 430 is configured to determine the attack possibility of the second data segment based on the historical upload information of the historical node data corresponding to each to-be-uploaded node data in the second data segment;

[0224] The encryption processing module 440 is configured to perform tamper-proofing encryption processing on the second data segment based on the attack possibility of the second data segment.

[0225] In the industrial end node data tamper-proofing system based on the Internet of Things provided by the embodiment of the present application, the node data to be uploaded of the target end node is divided into a first data segment according to a preset time length, and then a second data segment is further divided according to the feature information of each node data to be uploaded in multiple information dimensions, thereby realizing fine classification management of the data. Meanwhile, the attack possibility of the second data segment is evaluated in combination with the historical upload information of the historical node data, so that the security risk level of different data segments can be accurately identified. Finally, the second data segment is subjected to targeted tamper-proofing encryption processing according to the attack possibility, which not only avoids waste of computing resources, but also provides stronger protection for high-risk data. In this way, the differentiated and fine processing manner effectively makes up for the shortcomings of the prior art, and significantly improves the security of the industrial end node data.

[0226] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or can be advantageous.

[0227] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments.

Claims

1. A method for preventing data tampering at industrial end nodes based on the Internet of Things, characterized in that, The method includes: The data to be uploaded from the target terminal node at each time point is divided according to a preset duration to obtain at least one first data segment; the target terminal node is any industrial terminal node, and the data to be uploaded includes feature information from multiple information dimensions; Based on the feature information of each node data to be uploaded in the first data segment in each information dimension, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment. Based on the historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, the possibility of the second data segment being attacked is determined. Based on the vulnerability of the second data segment to attack, the second data segment is subjected to tamper-proof encryption. Based on the feature information of each node data to be uploaded in the first data segment in each information dimension, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment, including: determining the segmentation quality of each node data group to be uploaded in each information dimension based on the feature information of each node data group to be uploaded in the first data segment; the node data group to be uploaded includes the node data to be uploaded at the same time in the first data segment, and the segmentation quality is used to characterize the reference size of the information dimension for dividing the node data group to be uploaded; for each node data group to be uploaded, the information dimensions with segmentation quality greater than a preset quality threshold are filtered out to construct the target information dimension set of the node data group to be uploaded; the first node data group to be uploaded is divided into two segments. The target information dimension set of the first data group to be uploaded is compared with the target information dimension set of the second data group to be uploaded to determine the degree of similarity anomaly between the first and second data groups to be uploaded, and the correlation index between the first and second data groups to be uploaded is determined. The first and second data groups to be uploaded are any two different data groups to be uploaded. The first and second data groups to be uploaded with a similarity anomaly greater than a preset anomaly threshold are filtered out to obtain the target data groups to be uploaded. Based on the correlation index between the target data groups to be uploaded, the target data groups to be uploaded are clustered to obtain at least one second data segment.

2. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, Based on the feature information of each data group of nodes to be uploaded in the first data segment in each information dimension, the segmentation quality of each data group of nodes to be uploaded in each information dimension is determined, including: The variance of the feature information of each node data to be uploaded in the target information dimension is calculated to obtain the difference index of the node data group to be uploaded in the target information dimension; the target information dimension can be any information dimension. By using the number of data nodes to be uploaded in the data group to be uploaded, and the memory usage corresponding to the feature information of each data node to be uploaded in the target information dimension, the complexity index of the data group to be uploaded in the target information dimension is determined. By using the difference index and the complexity index, the segmentation quality of the data group to be uploaded in the dimension of target information is determined.

3. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, The target information dimension set includes the device identification dimension and the time dimension; The target information dimension set of the first data group to be uploaded is compared with the target information dimension set of the second data group to be uploaded to determine the degree of similarity anomalies between the two data groups, including: The Pearson correlation coefficient is calculated between the target information dimension set of the first data group to be uploaded and the target information dimension set of the second data group to be uploaded to obtain the initial correlation coefficient. If the initial correlation coefficient is greater than the preset correlation coefficient threshold, the feature information of the first data group to be uploaded in the device identification dimension is compared with the feature information of the second data group to be uploaded in the device identification dimension to determine the device identification difference coefficient between the first data group to be uploaded and the second data group to be uploaded. The time dimension feature information of the first data group to be uploaded is compared with the time dimension feature information of the second data group to be uploaded to determine the time difference index between the first data group to be uploaded and the second data group to be uploaded. The similarity and anomaly degree between the first data group to be uploaded and the second data group to be uploaded are determined by using the device identification difference coefficient and the time difference index.

4. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 3, characterized in that, Determine the correlation metrics between the first data group to be uploaded and the second data group to be uploaded, including: The correction weight is determined based on the degree of similarity anomalies between the first data group to be uploaded and the second data group to be uploaded. Based on the corrected weights, the initial correlation coefficients are corrected to obtain the correlation index between the first data group to be uploaded and the second data group to be uploaded.

5. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, The historical upload information includes first historical upload information and second historical upload information. The first historical upload information is the historical upload information of historical node data on edge devices, and the second historical upload information is the historical upload information of historical node data on the industrial data platform. The edge devices are gateways or edge servers. Based on the historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, the attack probability of the second data segment is determined, including: Based on the first historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, determine the simple data indicators of the second data segment. Based on the second historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, the score of the historical tampering of the second data segment is determined. By using simple data metrics and historical tampering scores, the likelihood of the second data segment being attacked can be determined.

6. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 5, characterized in that, Based on the first historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment, simple data metrics for the second data segment are determined, including: Based on the historical encryption order of the historical node data corresponding to each node data to be uploaded in the second data segment, the encryption priority of each node data to be uploaded is determined respectively. Based on the historical memory usage of the historical node data corresponding to each node data to be uploaded in the second data segment, the structural complexity index of each node data to be uploaded is determined. By utilizing the encryption priority of each node's data to be uploaded and the structural complexity index of each node's data to be uploaded, the data simplicity index of the second data segment is determined.

7. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 5, characterized in that, Based on the second historical upload information corresponding to the historical node data of each node to be uploaded in the second data segment, the historical tampering score of the second data segment is determined, including: Based on the first historical tampering frequency, the second historical tampering frequency, and the target historical tampering rate of the historical node data corresponding to each node data to be uploaded in the second data segment, the probability of tampering of each node data to be uploaded in the second data segment is determined respectively; the first historical tampering frequency is the historical tampering frequency of the data type corresponding to the historical node data, the second historical tampering frequency is the historical tampering frequency of the sensor device corresponding to the historical node data, and the target historical tampering rate is the historical tampering rate of the data type corresponding to the historical node data. Obtain the tampered preference coefficients for the target historical period corresponding to the second data segment; By utilizing the probability of data tampering at each node to be uploaded and the tampering preference coefficient for the target historical period, the historical tampering score of the second data segment is determined.

8. The method for preventing data tampering in industrial end nodes based on the Internet of Things according to claim 1, characterized in that, Based on the vulnerability of the second data segment to attack, tamper-proof encryption is applied to the second data segment, including: The importance of the monitored objects in the second data segment is determined by using the average device failure rate and encryption priority of each node data to be uploaded in the second data segment; the device failure rate is used to characterize the failure rate of the sensor devices corresponding to the node data to be uploaded. By utilizing the importance of the monitored objects in the second data segment and the likelihood of the second data segment being attacked, the anti-tampering encryption requirements for the second data segment are determined. Based on the anti-tampering encryption requirements of the second data segment, anti-tampering encryption processing is performed on the second data segment.

9. A data anti-tampering system for industrial end nodes based on the Internet of Things, characterized in that, The system includes: The first segmentation module is used to divide the data to be uploaded from the target terminal node at each time point according to a preset duration to obtain at least one first data segment; the target terminal node is any industrial terminal node, and the data to be uploaded includes feature information of multiple information dimensions; The second partitioning module is used to partition the data of the nodes to be uploaded in the first data segment based on the feature information of each node data in each information dimension, so as to obtain at least one second data segment. The probability determination module is used to determine the probability of the second data segment being attacked based on the historical upload information of the historical node data corresponding to each node data to be uploaded in the second data segment. The encryption processing module is used to perform tamper-proof encryption processing on the second data segment based on the attack probability of the second data segment; Based on the feature information of each node data to be uploaded in the first data segment in each information dimension, the node data to be uploaded in the first data segment is divided to obtain at least one second data segment, including: determining the segmentation quality of each node data group to be uploaded in each information dimension based on the feature information of each node data group to be uploaded in the first data segment; the node data group to be uploaded includes the node data to be uploaded at the same time in the first data segment, and the segmentation quality is used to characterize the reference size of the information dimension for dividing the node data group to be uploaded; for each node data group to be uploaded, the information dimensions with segmentation quality greater than a preset quality threshold are filtered out to construct the target information dimension set of the node data group to be uploaded; the first node data group to be uploaded is divided into two segments. The target information dimension set of the first data group to be uploaded is compared with the target information dimension set of the second data group to be uploaded to determine the degree of similarity anomaly between the first and second data groups to be uploaded, and the correlation index between the first and second data groups to be uploaded is determined. The first and second data groups to be uploaded are any two different data groups to be uploaded. The first and second data groups to be uploaded with a similarity anomaly greater than a preset anomaly threshold are filtered out to obtain the target data groups to be uploaded. Based on the correlation index between the target data groups to be uploaded, the target data groups to be uploaded are clustered to obtain at least one second data segment.

Images