Industrial internet attack and defense situation and risk early warning perception method

Abstract

The application discloses an industrial internet attack-defense situation and risk early warning sensing method, and particularly relates to the field of internet risk early warning sensing, and comprises the following steps: collecting multi-source heterogeneous data, constructing a basic data set covering the attack, business and device ternary space, containing attack features, business influence and device control vectors, solving the data heterogeneity and dispersion problem; constructing a triple function based on the data set, quantifying the attack comprehensive threat degree, the attack influence degree on the business and the device malicious control risk, respectively, and retaining the characteristics of each dimension; then constructing a dynamic network topology model, defining nodes, edges and edge weights, depicting the attack propagation path and influence strength, and realizing dynamic updating of the node state; finally, fusing the quantitative indicators and topology information to construct a risk prediction model, calculating the global risk value, realizing hierarchical early warning through three dimensions, and matching the corresponding response mechanism, thereby improving the timeliness and effectiveness of the industrial internet security protection.

Description

Technical Field

[0001] This invention relates to the field of Internet risk warning and perception technology, and more specifically, to the method of industrial Internet attack and defense situation and risk warning and perception. Background Technology

[0002] With the in-depth development of the Industrial Internet, it has become a key support for the digital transformation of the manufacturing industry as the core carrier connecting industrial equipment, business systems and cyberspace. The Industrial Internet covers multiple industrial control devices, as well as business systems such as production scheduling and order management. Its heterogeneity, real-time nature and deep coupling between physical and digital spaces make the security threats it faces increasingly complex.

[0003] To address these threats, existing technologies have gradually evolved from traditional single-point defense to situational awareness, attempting to achieve security early warning through data collection and risk assessment. For example, some solutions identify attack characteristics by collecting network traffic data or monitor abnormal states based on device logs; other technologies analyze attack propagation paths by constructing static network topology and trigger early warnings by combining simple threshold judgments.

[0004] However, it still has some drawbacks in practical use, such as:

[0005] The data collection dimension is singular, focusing on a single dimension of network attacks or device status, failing to achieve coordinated perception of the three-dimensional space of attacks, business, and devices, and making it difficult to reflect the impact of security risks on the entire industrial production process;

[0006] The risk quantification model is too simplistic, the attack threat assessment does not take into account the periodic characteristics of APT attacks, the business impact analysis ignores the long-term correlation of production delays, and the equipment risk assessment lacks consideration of multi-device collaborative anomalies, resulting in a large deviation between the assessment results and the actual risks.

[0007] The network topology and risk warning mechanism are static, and the topology model cannot dynamically update the node status and attack propagation strength. Warnings mostly rely on a single risk value threshold, making it difficult to accurately distinguish risk levels and match response strategies, and failing to meet the industrial internet's requirements for real-time and accurate security warnings. Summary of the Invention

[0008] To overcome the aforementioned deficiencies in the prior art, this invention provides a method for industrial internet attack and defense posture and risk early warning perception, which solves the problems mentioned in the background art through the following solutions.

[0009] To achieve the above objectives, the present invention provides the following technical solution: a method for industrial internet attack and defense posture and risk early warning perception, comprising:

[0010] S1: By collecting multi-source heterogeneous data, a basic dataset covering the three-dimensional space of attack, service, and device is constructed. The basic dataset includes attack feature vectors, service impact vectors, and device control vectors.

[0011] S2: Construct a triple function based on the aforementioned basic dataset. The triple function includes an attack threat function for quantifying the overall threat level of an attack, a business impact function for quantifying the impact of an attack on industrial operations, and a device control function for assessing the risk of malicious control of equipment.

[0012] S3: Construct a dynamic network topology model based on the quantitative index of the triple function to generate an offensive and defensive topology. The dynamic network topology model includes a set of nodes, a set of edges, and edge weights, and can realize dynamic updates of node states.

[0013] S4: Integrate the quantitative indicators of the triple function with the topological information of the offensive and defensive situation to construct a risk prediction model, calculate the global risk value, trigger hierarchical early warning through the three-dimensional spatial vector early warning mechanism, and match the corresponding response mechanism.

[0014] Preferably, the basic dataset includes: attack feature vectors, business impact vectors, and device control vectors, the specific analysis of which is as follows:

[0015] By extracting attack characteristics and counting the number of attack events per unit time, the number of attacks counted per unit time is obtained and recorded as follows. ;

[0016] System vulnerabilities are discovered through vulnerability scanning, and these vulnerabilities are quantified and scored. The highest-risk vulnerability in the system is then recorded as the highest-scoring vulnerability. ;

[0017] Network traffic analysis was used to identify abnormal traffic, and the traffic entropy value within the sliding window was calculated and denoted as [value to be filled in]. ;

[0018] Based on these three sets of data, an attack feature vector reflecting attack intensity, vulnerability risk, and abnormal traffic patterns is obtained. ;

[0019] The production delay rate is calculated by extracting the planned start-to-end time and the actual start-to-end time of the production task, and this value is recorded as follows. ;

[0020] The total number of orders that timed out and failed to process is recorded as the order loss amount, and this value is recorded as follows. ;

[0021] By collecting real-time response latency data from the Industrial Internet and comparing it with historical baseline values, the rate of change in response latency is calculated and recorded as follows: ;

[0022] Based on these three sets of data, a business impact vector is obtained to quantify the indirect impact of attacks on industrial business processes. ;

[0023] By comparing all input commands with a preset normal command library, the percentage of abnormal commands is calculated to obtain the command abnormality rate, and this value is recorded as . ;

[0024] By obtaining the hash value of the device firmware and comparing it with the baseline hash value stored in the blockchain, the firmware hash difference is obtained and recorded as _____. ;

[0025] By fusing data from multiple sensors on the same monitored device, the Euclidean distance between the real-time state vector and the normal state center vector is calculated as the state offset Euclidean distance, and this value is denoted as: ;

[0026] Based on these three sets of data, an equipment control vector is obtained to describe the abnormal state of industrial equipment and reflect the risk of malicious control or physical failure of the equipment. .

[0027] Preferably, the attack threat function includes: first capturing the superposition effect of conventional attacks through linear combination, then simulating the periodicity of APT attacks through chaotic terms, and finally mapping the result to [0, 1] to ensure that the threat values ​​under different scenarios are comparable. The specific mathematical function is as follows:

[0028] ,

[0029] in, for The steepness coefficient of the function controls the output. The degree of sensitivity; for , , The weights; The amplitude of the chaotic term; As a periodic parameter, and The time scale is matched, which is represented as the flow entropy fluctuation in a 5-second cycle, where e is the natural constant.

[0030] Preferably, the business impact function includes: capturing the long-term correlation of production delays through fractional derivatives (this differs from integer derivatives which only focus on instantaneous changes); measuring the degree to which the overall business indicators deviate from the normal benchmark through Gaussian terms; and finally introducing dynamic weights to achieve differentiated assessment of short-term fluctuations and long-term interruptions, so that the results are controlled within the interval [0, 1]. Its specific mathematical function is as follows:

[0031]

[0032] in, The order of the fractional derivative is used to preserve the memory of business impact; This represents the normal baseline for business metrics, i.e., the allowable production delays, order losses, and service quality fluctuations; It is expressed as the standard deviation of the Gaussian term, which controls the rate at which business indicators deviate from the benchmark. Dynamic weights;

[0033] Fractional derivative: ;in These are dummy variables in the integration process, used only for integration calculations, have no independent physical dimensions, and cover all historical time points from the initial moment to the current moment. This is a gamma function.

[0034] Preferably, the device control function includes: first, designing an anomaly penalty term for a single device, analyzing the nonlinear impact of the anomaly command rate, then calculating the partition function, normalizing the probability distribution of the device state, and finally integrating the single-device penalty and synergistic effect to construct a complete device control function, wherein a result of 1 indicates that the device is completely normal, and a result of 0 indicates that the device is under deep control; its specific mathematical function is as follows:

[0035]

[0036] in, This represents the exponential penalty term. Represented as the Boltzmann distribution term, energy function: Partition function: Used to normalize the probabilities of all possible states; Indicates the threshold for abnormal instructions. This indicates the nonlinear strength of the control exponential penalty term, which determines... Exceed The amplification rate of post-risk penalty, where J represents the dimensional synergy strength, h represents the single-dimensional anomaly driving strength, and T is the temperature parameter. Let spin variables describe the binary states in each dimension: This indicates that the dimension is normal. This indicates an anomaly.

[0037] Preferably, the construction of the dynamic network topology model includes: constructing a dynamic graph model by defining a set of nodes, a set of edges, and edge weights;

[0038] The node set includes all key entities in the Industrial Internet, and this entity set is denoted as: , where n represents the number of nodes; the edge set represents the communication links between nodes, which changes dynamically with time t. The set of all links between nodes is defined as the edge set, denoted as: Edge weight, indicating the attack originates from a node. propagation to nodes The intensity of the influence is denoted as: .

[0039] Preferably, the edge weight includes: edge weight is a core indicator in dynamic graph models that characterizes the intensity of an attack propagating from one node to another. It integrates four elements: attack source strength, target vulnerability, service suppression, and distance decay. Its specific mathematical function is as follows:

[0040]

[0041] in, Represents a node and Logical distance, The attenuation coefficient is... ; Represents a node Proximity centrality n is the number of nodes. Represents a node To the node In the Industrial Internet, the shortest path distance refers to the number of network hops, i.e., the distance from node to node. To the node The number of intermediate nodes that need to be traversed.

[0042] Preferably, the dynamic update of the node state includes: collecting the historical states of neighboring nodes, weighting the neighbor states with edge weights, transforming them using a feature mapping matrix, applying an activation function to each neighbor's influence after mapping and summing the results to obtain the total neighbor influence, and finally inputting the node's own historical state and the total neighbor influence into an LSTM network to output the new state at time t. The specific mathematical function is as follows:

[0043]

[0044] in, Represents a node The state vector at time t contains information such as the degree to which the node is affected by the attack, the business status, and the device status; Represents a node The set of neighboring nodes, through edges Connected nodes, The feature mapping matrix represents the transformation of the neighbor node states into a feature space that matches the current node. side The weight indicates the attack originates from neighboring nodes. propagation to nodes The influence strength; tanh activation function, which compresses the mapped neighbor influence values ​​to [-1, 1]; LSTM represents Long Short-Term Memory network.

[0045] Preferably, the construction of the risk prediction model includes: first, calculating the direct coupling risk between the attack and the device to obtain the basic risk item; then, obtaining the topology risk item based on the vulnerability risk of the network structure; and finally, combining the service acceleration item obtained from the trend indicator of risk deterioration to obtain a global risk function that comprehensively reflects the current global risk. The specific mathematical function is as follows:

[0046]

[0047] in, Represented as topological risk weights; Let be the spectral radius of the graph Laplacian matrix; , For degree matrix, It is an adjacency matrix.

[0048] Preferably, the three-dimensional spatial vector early warning mechanism includes: defining a three-dimensional early warning vector based on the current global risk value, risk change rate, and expected future risk to achieve hierarchical early warning, as detailed below:

[0049] Define a three-dimensional vector The three components respectively characterize different dimensions of risk:

[0050] The current global risk value, i.e. ; Risk change rate, i.e. first derivative ;

[0051] : Expectations of future risk contagion; then , , ;

[0052] Set the warning threshold boundaries for each of the three dimensions: , , ;

[0053] Based on the position of vector Z in three-dimensional space, three warning zones are defined:

[0054] Red Alert: and and This indicates that the current risk has exceeded the standard, is rapidly deteriorating, and has spread to core nodes, and a Level 1 response mechanism is triggered.

[0055] Yellow alert: but and This indicates that the risk has not exceeded the standard but the spread is accelerating; or but and This indicates that the risk has exceeded the standard but will not spread for the time being, and a Level II response mechanism has been implemented.

[0056] Green Alert: and and This indicates that the risk is within a safe range, with no significant deterioration or spread, and matches a three-level response mechanism;

[0057] The response mechanism includes:

[0058] Level 1 response mechanism: Immediately disconnect the attacked link in the network connection and isolate the abnormal device. When the number of risky devices is uncontrollable, the physical circuit breaker mechanism can be triggered directly to physically isolate all devices.

[0059] Level 2 response mechanism: Focus on monitoring risky devices, update vulnerability patches, strengthen protection of core nodes, increase the frequency of real-time monitoring, and assign technical personnel to monitor;

[0060] Level 3 response mechanism: No special processing is performed, but the three-dimensional vector is updated once per hour.

[0061] The technical effects and advantages of this invention are as follows:

[0062] 1. At the data perception level, a three-dimensional basic dataset covering attacks, business, and equipment is constructed by collecting multi-source heterogeneous data. This breaks through the limitations of a single dimension, realizes cross-dimensional and cross-protocol data fusion, comprehensively captures attack characteristics, business impact, and equipment status correlation, accurately reflects the impact of security risks on the entire industrial production process, and solves the problems of data dispersion and heterogeneity.

[0063] 2. In terms of risk quantification, a three-function approach is innovatively constructed to achieve refined assessment: the attack threat function integrates the superposition effect of conventional attacks with the periodic characteristics of APT attacks, the business impact function captures the long-term correlation of production delays through fractional derivatives, and the equipment control function integrates the single-device anomaly and the synergistic effect of multiple devices. This approach retains the physical characteristics of each dimension while improving the accuracy of risk quantification and avoiding the assessment bias caused by the simplification of traditional models.

[0064] 3. At the situation modeling and early warning level, a dynamic network topology model is constructed. By dynamically updating the node set, edge set, and edge weights, and combining with an LSTM network, the real-time evolution of node states is realized, accurately depicting the attack propagation path and impact intensity. The risk prediction model integrates quantitative indicators and topology information, and realizes hierarchical early warning based on three dimensions: current risk intensity, risk change rate, and future risk diffusion coefficient. It also matches a differentiated response mechanism, breaking through the limitations of static topology and single threshold early warning, significantly improving the real-time performance and accuracy of risk early warning, and providing more effective decision support for industrial internet security protection. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the overall structure of the present invention.

[0066] Figure 2 This is a schematic diagram of the data acquisition process of the present invention.

[0067] Figure 3 This is a schematic diagram of the attack and defense situation topology generation structure of the present invention.

[0068] Figure 4 This is a schematic diagram of the risk prediction model and trigger response mechanism of the present invention. Detailed Implementation

[0069] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0070] refer to Figures 1-4 The industrial internet attack and defense posture and risk early warning perception methods shown include:

[0071] S1: By collecting multi-source heterogeneous data, a basic dataset covering the three-dimensional space of attack, service, and device is constructed. The basic dataset includes attack feature vectors, service impact vectors, and device control vectors.

[0072] S2: Construct a triple function based on the aforementioned basic dataset. The triple function includes an attack threat function for quantifying the overall threat level of an attack, a business impact function for quantifying the impact of an attack on industrial operations, and a device control function for assessing the risk of malicious control of equipment.

[0073] S3: Construct a dynamic network topology model based on the quantitative index of the triple function to generate an offensive and defensive topology. The dynamic network topology model includes a set of nodes, a set of edges, and edge weights, and can realize dynamic updates of node states.

[0074] S4: Integrate the quantitative indicators of the triple function with the topological information of the offensive and defensive situation to construct a risk prediction model, calculate the global risk value, trigger hierarchical early warning through the three-dimensional spatial vector early warning mechanism, and match the corresponding response mechanism.

[0075] The specific steps are as follows:

[0076] S1: Multi-source heterogeneous data acquisition: Through cross-dimensional and cross-protocol data acquisition, a basic dataset covering a three-dimensional space from attack to business and finally to device is constructed, providing raw input for subsequent situational modeling and risk assessment. This step solves the problems of heterogeneity (such as network traffic, production logs, device status, etc.) and dispersion of industrial internet data, ensuring the comprehensiveness and real-time nature of the data;

[0077] Its construction method is as follows: three types of core data vectors are defined, and each component of the vector is obtained through multi-source acquisition methods, as follows:

[0078] S101: Constructing Attack Feature Vectors

[0079] Deploy network probes to monitor network traffic in real time, extract attack characteristics, and combine this with the attack fingerprint database of the threat intelligence platform to count the number of matching attack events per unit time. This yields the number of attack attempts detected per unit time; a higher value indicates more frequent attacks. This count of attacks per unit time is recorded as [value missing]. ;

[0080] It should be further noted that the extracted attack characteristics include, but are not limited to, abnormal packets and malicious IPs; the number of attack attempts counted includes, but is not limited to, SQL injection, port scanning, and DDoS attacks.

[0081] Every hour, the industrial control network is scanned using vulnerability scanning tools, and the results are matched against vulnerability information in the database. Based on a general vulnerability scoring system, vulnerabilities in the industrial system are quantitatively scored; higher scores indicate a higher risk of exploitation. The score for each vulnerability is automatically obtained, and the score of the highest-risk vulnerability in the system is recorded as [value missing]. ;

[0082] Industrial protocol traffic is captured in real time using network traffic analysis tools. The probability of occurrence of various traffic characteristics within a sliding time window is statistically analyzed. Since the probability distribution entropy value of industrial network traffic characteristics reflects the disorder of the traffic, normal industrial traffic has a low entropy value due to its strong periodicity. Abnormal traffic, such as malicious code injection, can cause a sharp increase in entropy. The traffic entropy value within the sliding window is calculated using the entropy formula and recorded as [value missing]. ;

[0083] Based on these three sets of data, the attack feature vector is obtained. This vector is used to characterize the direct features of network attacks, reflecting the attack intensity, vulnerability risks, and abnormal traffic conditions.

[0084] S102: Constructing Business Impact Vectors

[0085] Extract the planned start-to-end time and actual start-to-end time of production tasks from the system logs, calculate the latency rate, obtain the production latency rate, and record this value as... ;

[0086] The order status is queried in real time through the order system API interface. The total number of orders that timed out and failed to process is recorded as the order loss amount, and this value is recorded as [missing information]. ;

[0087] Deploy dedicated network performance monitoring equipment to collect real-time data on the response latency of the industrial internet against historical baseline values, calculate the rate of change, obtain the response latency change rate, and record this value as... ;

[0088] Based on these three sets of data, the business impact vector is obtained. This vector is used to quantify the indirect impact of attacks on industrial business processes, relating to production efficiency, economic losses, and service quality.

[0089] S103: Constructing Device Control Vectors

[0090] The PLC instruction monitoring system records all input instructions, compares them with a preset normal instruction library, calculates the percentage of abnormal instructions, obtains the instruction abnormality rate, and records this value as [value missing]. ;

[0091] The device firmware hash value is periodically obtained through a trusted execution environment remote proof mechanism, compared with a baseline hash value stored in the blockchain, and the Hamming distance is calculated as the firmware hash difference. This value is recorded as... ;

[0092] The sensor fusion algorithm fuses data from multiple sensors on the same monitored device, calculates the Euclidean distance between the real-time state vector and the normal state center vector, and uses this distance as the state offset Euclidean distance, which is denoted as: ;

[0093] Based on these three sets of data, the device control vector is obtained. This vector is used to describe the abnormal state of industrial equipment, reflecting the risk of the equipment being maliciously controlled or physically malfunctioning.

[0094] S2: Constructing a Triple Function: Based on the raw dataset collected in step S1, transform it into standardized quantitative indicators while retaining the physical characteristics of each dimension, including the periodicity of attacks, the long memory of business processes, and the synergy of devices; the specific steps are as follows:

[0095] S201: Constructing an attack threat function: This function quantifies the overall threat level of an attack, integrating attack frequency, vulnerability risk, and traffic anomalies, and capturing the periodic characteristics of APT attacks. The specific steps are as follows:

[0096] First, the superposition effect of conventional attacks is captured through linear combination (such as high-frequency attacks + high-risk vulnerabilities = high threat); then, the periodicity of APT attacks is simulated through chaotic terms (such as periodically scanning for cyclical patterns of penetration); the sigmoid function maps the results to [0, 1] to ensure that threat values ​​under different scenarios are comparable;

[0097] Its specific mathematical function is shown below:

[0098] ,

[0099] in, The steepness coefficient of the sigmoid function controls the output's... The degree of sensitivity, when The larger, Follow The steeper the change, the more pronounced the change at this time. The value is 1.2; for , , The weights reflect the contribution of each attack feature. Among them, vulnerability risk has the greatest impact on the attack threat, so the weight is 0.5. The number of attacks can reflect the frequency of attacks, so the weight is 0.4. The entropy value change may be affected by other factors and has a smaller impact on the overall attack threat, so the weight is 0.1. The amplitude of the chaotic term is used to adjust the intensity of the periodic perturbation. This parameter reflects the stealthy periodic characteristics of APT attacks. As a periodic parameter, and The time scale is matched, which is then expressed as the flow entropy value fluctuation in a 5-second cycle;

[0100] S202: Constructing the Business Impact Function: Quantifying the impact of the attack on industrial operations, considering the long memory of the business, i.e., the continuous impact of historical states on the present and dynamic weight adjustments. The specific steps are as follows:

[0101] First, the long-term correlation of production delays is captured using fractional derivatives (this differs from integer derivatives, which only focus on instantaneous changes). Then, a Gaussian term is used to measure the overall deviation of business indicators from the normal benchmark. Finally, dynamic weights are introduced to achieve differentiated assessment of short-term fluctuations and long-term interruptions, ensuring the results are controlled within the interval [0, 1]. The specific mathematical function is as follows:

[0102]

[0103] Wherein, the fractional derivative: ; , where the fractional derivative order is used to preserve the memory of business impact; This represents the normal benchmark for business metrics, allowing for 5% production delays, 0 order losses, and 10% fluctuations in service quality. It is expressed as the standard deviation of the Gaussian term, which controls the decay rate of the deviation of business indicators from the benchmark. The smaller the value, the more sensitive it is to the penalty for deviation. In this case, the value is 0.2. The weight is dynamic. When the attack lasts for more than ten minutes, the weight tends to 1, focusing on the cumulative impact of long-term production delays. When the attack lasts for less than 10 minutes, the weight tends to 0, focusing on short-term overall business deviations. At this time, the model should balance the impact of both on the overall situation in the early stage. Therefore, the weight is set to 0.5. This is a dummy variable in the integration process, used only for integration calculations. It has no independent physical dimensions, and its value range is [0, t], covering all historical time points from the initial time to the current time. This is a gamma function.

[0104] S203: Device Control Functions:

[0105] To assess the risk of malicious control of equipment, this method integrates single-device anomalies with collaborative failure processes between devices (such as PLC malfunctions causing sensor data distortion). The specific steps are as follows:

[0106] First, the collaborative relationship between devices is characterized by an energy function (e.g., setting the coupling strength between devices to control the state synchronization of the PLC and sensors); then, the probability of all possible states is normalized by a partition function; an exponential term is used to penalize high instruction failure rates, and finally, the result is obtained and controlled within the interval [0, 1], where a result of 1 indicates that the device is completely normal, and a result of 0 indicates that the device is under deep control; the specific mathematical function is as follows:

[0107]

[0108] in, This represents the exponential penalty term, due to It is a core component of equipment control, and this index penalty term separately reinforces the impact of instruction anomaly rate on risk. Represented as a Boltzmann distribution term, it assesses the cooperative state of a group of equipment based on an energy function, reflecting the risk of associated failures among equipment. The energy function is: The lower the energy, the more reasonable the device group state; the higher the energy, the more conflicting the device group state. Allocation function: Used to normalize the probabilities of all possible states, ensuring that the output of the distribution term is the probability that the device group is in a normal state;

[0109] This represents the threshold for abnormal commands. In industrial scenarios, there are normal fluctuations in equipment commands. As a threshold, it is necessary to accommodate reasonable fluctuations while triggering an acceleration penalty when the abnormality rate exceeds this threshold. Therefore, this value is set to 0.6.

[0110] This indicates the nonlinear strength of the control exponential penalty term, which determines... Exceed The amplification rate of the subsequent risk penalty ensures that the higher the anomaly rate, the faster the risk decays; therefore, the value is set to 1.8.

[0111] J represents the dimensional coordination strength, which is the strength of the tendency for state synchronization between different dimensions of the device in the energy function. It measures the correlation between command anomalies, firmware tampering, and state deviations. It should reflect the correlation but avoid excessive coordination, so the value is 0.5.

[0112] h represents the strength of the single-dimensional anomaly drive. The energy function transforms the degree of anomaly in a single dimension into the strength of the state judgment drive force, which determines the weight of the influence of a single-dimensional anomaly on the normal or abnormal state. It is necessary to avoid one dimension from overdoing the judgment while also conveying the true anomaly signal. Therefore, this value is 0.3.

[0113] T is a temperature parameter. Low temperature can strongly suppress the probability of high energy state, making the system more focused on the real abnormal state of low energy and reducing misjudgment caused by single-dimensional fluctuation. Therefore, this value is 0.1.

[0114] Let spin variables describe the binary states in each dimension: This indicates that the dimension is normal. It represents anomalies and is a quantitative tool that simplifies the description of abnormal states;

[0115] S3: Offensive and Defensive Situation Topology Generation: Based on the quantitative indicators in step S2, a dynamic network topology model is constructed to characterize the propagation path of attacks in the Industrial Internet, the influence intensity between nodes, and the evolution law of the situation, realizing the upgrade from single-point indicators to global situation; first, a dynamic graph model is constructed, and the node state is updated in real time through edge weight calculation. The specific steps are as follows:

[0116] S301: Define the dynamic graph model: Define the set of nodes V and the set of edges. and edge weights The node set includes all key entities in the Industrial Internet (such as PLCs, SCADA servers, sensors, switches, and industrial equipment connected to the intranet, denoted as: ), n represents the number of nodes; the edge set represents the communication links between nodes (such as wired connections between PLCs and sensors, network connections between servers and switches), which changes dynamically with time t (e.g., edges disappear when a link is interrupted, and new edge paths are added when a link connection is added); edge weights represent the attack paths from the affected nodes. propagation to nodes The intensity of the impact.

[0117] S302: Edge Weight: Edge weight is a core indicator in dynamic graph models that characterizes the intensity of an attack's propagation from one node to another. It integrates four factors: attack source strength, target vulnerability, business suppression, and distance decay, ensuring that the attack propagation pattern conforms to the physical logic of the Industrial Internet and accurately reflects the actual patterns of attack propagation in the Industrial Internet. Its specific mathematical function is as follows:

[0118]

[0119] in, Represents a node With nodes Logical distance between them The attenuation coefficient is... ; Represents a node Proximity centrality n is the number of nodes. Represents a node To the node In the Industrial Internet, the shortest path distance typically refers to the number of network hops, i.e., the distance from node to node. To the node The number of intermediate nodes that need to be traversed;

[0120] S303: Node State Update: By collecting the historical states of neighboring nodes, the neighbor states are weighted using edge weights, and then transformed using a feature mapping matrix. The tanh activation function is applied to each mapped neighbor influence, and the results are summed to obtain the total neighbor influence. Finally, the node's own historical state and the total neighbor influence are input into the LSTM network, outputting the new state at time t. The specific mathematical function is as follows:

[0121]

[0122] in, This represents the state vector of node v at time t, which includes information such as the degree to which the node is affected by attacks, its business status, and its device status. This represents the set of neighboring nodes of node v, connected by edges. Connected nodes, The feature mapping matrix represents the transformation of the neighbor node states into a feature space that matches the current node. side The weight indicates the attack originates from neighboring nodes. The intensity of the influence propagated to the node; the tanh activation function compresses the mapped neighbor influence values ​​to [-1, 1], avoiding gradient explosion caused by excessively large values, while retaining both positive and negative influences; LSTM stands for Long Short-Term Memory network, used to retain the historical state of nodes, capture the temporal evolution of the situation, and selectively retain important historical information (such as the cumulative effect of continuous attacks) while forgetting noise (such as transient network fluctuations).

[0123] The update logic of the node state update function is as follows: The current state of node v consists of two parts: its own historical state. The impact of neighboring nodes Neighbor states are determined by edge weights. Weighting ensures that nodes connected by high-weighted edges contribute more.

[0124] S4: Construct a risk prediction model: Integrate the quantitative indicators in S2 with the topological information in S3 to calculate the overall risk situation of the industrial internet and the risk values ​​of key nodes in the future and trigger graded early warnings to achieve a closed loop from situation awareness to risk decision-making.

[0125] S401: Global Risk Value: First, the basic risk item is obtained by calculating the direct coupling risk between attacks and devices. Then, the topology risk item is obtained based on the vulnerability risk of the network structure. Finally, the service acceleration item is obtained by combining the trend indicators of risk deterioration to obtain the global risk function that comprehensively reflects the current global risk. Its specific mathematical function is as follows:

[0126]

[0127] in, Represented as topological risk weights, balancing the rate of change in business impact; The spectral radius of the graph Laplacian matrix reflects the robustness of the network topology;

[0128] It needs to be further explained that, , For degree matrix, The adjacency matrix is ​​obtained from step S3. S3 constructs the dynamic topology graph, whose output consists of two key matrices that change over time. The specific steps are as follows:

[0129] For an adjacency matrix, suppose the dynamic graph has n nodes at time t, then It is an n*n matrix; for matrix elements (recorded as) ):

[0130] If the topology is an unweighted graph: if the node With nodes If they are directly connected at time t, then If not connected, then ;

[0131] If it is a weighted graph: The value equals the node With nodes The weight of the edges between them;

[0132] Degree matrix Its diagonal elements describe the degree of the node, for diagonal elements (recorded as) ):

[0133] For an unweighted graph: equals the sum of the values ​​at time t and the nodes. The number of connected edges, ;

[0134] For a weighted graph: equals the sum of the values ​​at time t and the nodes. The sum of the weights of connected edges is calculated in the same way as above;

[0135] S402: Three-dimensional spatial vector early warning mechanism: By defining a three-dimensional early warning vector based on the current global risk value, risk change rate, and expected future risk, hierarchical early warning can be achieved. The specific analysis is as follows:

[0136] Define a three-dimensional vector The three components respectively characterize different dimensions of risk:

[0137] The current global risk value, i.e. ; Risk change rate, i.e. first derivative ;

[0138] : Expectations of future risk contagion; then , , ;

[0139] Set the warning threshold boundaries for each of the three dimensions: This represents the current risk threshold. This represents the critical value of the rate of change of risk; exceeding this value indicates that the risk is deteriorating at an accelerated pace. This represents the critical value for risk diffusion; exceeding this value indicates that the risk may have spread to the core node.

[0140] Based on the position of vector Z in three-dimensional space, three warning zones are defined:

[0141] Red Alert: and and This indicates that the current risk has exceeded the standard, is rapidly deteriorating, and has spread to core nodes, and a Level 1 response mechanism is triggered.

[0142] Yellow alert: but and This indicates that the risk has not exceeded the standard but the spread is accelerating; or but and This indicates that the risk has exceeded the standard but is not spreading yet, but there is an overall potential trend of risk deterioration or spread, and a level-two response mechanism is required.

[0143] Green Alert: and and This indicates that the risk is within a safe range, with no significant deterioration or spread, and matches a three-level response mechanism;

[0144] The response mechanism includes:

[0145] Level 1 response mechanism: Immediately disconnect the attacked link in the network connection and isolate the abnormal device. When the number of risky devices is uncontrollable, the physical circuit breaker mechanism can be triggered directly to physically isolate all devices.

[0146] Level 2 response mechanism: Focus on monitoring risky devices, update vulnerability patches, strengthen protection of core nodes, increase the frequency of real-time monitoring, and assign technical personnel to monitor;

[0147] Level 3 response mechanism: No special processing is performed, but the three-dimensional vector is updated once per hour.

[0148] This invention constructs a basic dataset covering the three-dimensional space of attack, service, and device through multi-source heterogeneous data collection, extracting attack feature vectors, service impact vectors, and device control vectors. Based on this dataset, a triple function is constructed: the attack threat function integrates linear combination and chaotic terms to quantify the comprehensive attack threat; the service impact function captures the long-memory impact of services through fractional derivatives and Gaussian terms; and the device control function integrates single-device anomaly penalties and the synergistic effect of quantum models to assess the controllability risk of devices. A dynamic network topology model is then constructed based on the triple function quantification indicators, defining nodes, edges, and edge weights, and using LSTM to dynamically update node states, characterizing attack propagation paths and situational evolution. Finally, the triple function indicators and topology information are integrated to calculate the global risk value, triggering red, yellow, and green graded warnings through a three-dimensional vector warning mechanism, and matching response mechanisms such as link disconnection and enhanced monitoring. This forms a full-link industrial internet security protection process from data collection, risk quantification, situational modeling to warning response, achieving multi-scale perception and accurate early warning of the attack and defense situation.

[0149] Secondly: The accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other.

[0150] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for sensing the offensive and defensive posture and risk early warning of the industrial internet, characterized in that, include: S1: By collecting heterogeneous data from multiple sources, a basic dataset covering the three-dimensional space of attack, service, and device is constructed. This basic dataset includes attack feature vectors, service impact vectors, and device control vectors; its specific analysis is as follows: By extracting attack characteristics and counting the number of attack events per unit time, the number of attacks counted per unit time is obtained and recorded as follows. ; System vulnerabilities are discovered through vulnerability scanning, and these vulnerabilities are quantified and scored. The highest-risk vulnerability in the system is then recorded as the highest-scoring vulnerability. ; Network traffic analysis was used to identify abnormal traffic, and the traffic entropy value within the sliding window was calculated and denoted as [value to be filled in]. ; Based on these three sets of data, an attack feature vector reflecting attack intensity, vulnerability risk, and abnormal traffic patterns is obtained. ; The production delay rate is calculated by extracting the planned start-to-end time and the actual start-to-end time of the production task, and this value is recorded as follows. ; The total number of orders that timed out and failed to process is recorded as the order loss amount, and this value is recorded as follows. ; By collecting real-time response latency data from the Industrial Internet and comparing it with historical baseline values, the rate of change in response latency is calculated and recorded as follows: ; Based on these three sets of data, a business impact vector is obtained to quantify the indirect impact of attacks on industrial business processes. ; By comparing all input commands with a preset normal command library, the percentage of abnormal commands is calculated to obtain the command abnormality rate, and this value is recorded as . ; By obtaining the hash value of the device firmware and comparing it with the baseline hash value stored in the blockchain, the firmware hash difference is obtained and recorded as _____. ; By fusing data from multiple sensors on the same monitored device, the Euclidean distance between the real-time state vector and the normal state center vector is calculated as the state offset Euclidean distance, and this value is denoted as: ; Based on these three sets of data, an equipment control vector is obtained to describe the abnormal state of industrial equipment and reflect the risk of malicious control or physical failure of the equipment. ; S2: Construct a triple function based on the aforementioned basic dataset. The triple function includes an attack threat function for quantifying the overall threat level of an attack, a business impact function for quantifying the impact of an attack on industrial operations, and a device control function for assessing the risk of malicious control of equipment. The attack threat function includes: first, capturing the superposition effect of conventional attacks through linear combination; second, simulating the periodicity of APT attacks through chaotic terms; and finally mapping the result to [0, 1] to ensure that threat values ​​under different scenarios are comparable. Its specific mathematical function is shown below: ， ； in, for The steepness coefficient of the function controls the output. The degree of sensitivity; for , , The weights; The amplitude of the chaotic term; As a periodic parameter, and The time scale is matched, which is represented as the flow entropy value fluctuation in a 5-second cycle, where e is the natural constant; The business impact function includes: capturing the long-term correlation of production delays through fractional derivatives (unlike integer derivatives which only focus on instantaneous changes); measuring the degree to which overall business indicators deviate from the normal benchmark through Gaussian terms; and finally introducing dynamic weights to achieve differentiated assessment of short-term fluctuations and long-term interruptions, ensuring the results are controlled within the interval [0, 1]. Its specific mathematical function is as follows: ； in, The order of the fractional derivative is used to preserve the memory of business impact; This represents the normal baseline for business metrics, i.e., the allowable production delays, order losses, and service quality fluctuations; It is expressed as the standard deviation of the Gaussian term, which controls the rate at which business indicators deviate from the benchmark. Dynamic weights; Fractional derivative: ;in These are dummy variables in the integration process, used only for integration calculations, have no independent physical dimensions, and cover all historical time points from the initial moment to the current moment. It is a gamma function; The device control function includes: first, designing an anomaly penalty term for a single device, analyzing the nonlinear impact of the anomaly command rate, then calculating the partition function, normalizing the probability distribution of the device state, and finally integrating the single-device penalty and synergistic effect to construct a complete device control function. A result of 1 indicates that the device is completely normal, and a result of 0 indicates that the device is under deep control. Its specific mathematical function is as follows: ； in, This represents the exponential penalty term. Represented as the Boltzmann distribution term, energy function: Partition function: Used to normalize the probabilities of all possible states; Indicates the threshold for abnormal instructions. This indicates the nonlinear strength of the control exponential penalty term, which determines... Exceed The amplification rate of post-risk penalty, where J represents the dimensional synergy strength, h represents the single-dimensional anomaly driving strength, and T is the temperature parameter. Let spin variables describe the binary states in each dimension: This indicates that the dimension is normal. Indicates an anomaly; S3: Construct a dynamic network topology model based on the quantitative index of the triple function to generate an offensive and defensive topology. The dynamic network topology model includes a set of nodes, a set of edges, and edge weights, and can realize dynamic updates of node states. S4: Integrate the quantitative indicators of the triple function with the topological information of the offensive and defensive situation to construct a risk prediction model, calculate the global risk value, trigger hierarchical early warning through the three-dimensional spatial vector early warning mechanism, and match the corresponding response mechanism.

2. The industrial internet attack and defense situation and risk early warning perception method according to claim 1, characterized in that: The construction of the dynamic network topology model includes: constructing a dynamic graph model by defining a set of nodes, a set of edges, and edge weights; The node set includes all key entities in the Industrial Internet, and this entity set is denoted as: , where n represents the number of nodes; the edge set represents the communication links between nodes, which changes dynamically with time t. The set of all links between nodes is defined as the edge set, denoted as: Edge weight, indicating the attack originates from a node. propagation to nodes The intensity of the influence is denoted as: .

3. The industrial internet attack and defense situation and risk early warning perception method according to claim 2, characterized in that: The edge weights, including: edge weights are core indicators in dynamic graph models that characterize the intensity of an attack propagating from one node to another. They integrate four elements: attack source strength, target vulnerability, service suppression, and distance decay. Their specific mathematical function is as follows: ； in, Represents a node and Logical distance, The attenuation coefficient is... ; Represents a node Proximity centrality n is the number of nodes. Represents a node To the node In the Industrial Internet, the shortest path distance refers to the number of network hops, i.e., the distance from node to node. To the node The number of intermediate nodes that need to be traversed.

4. The industrial internet attack and defense situation and risk early warning perception method according to claim 1, characterized in that: The dynamic update of the node state includes: collecting the historical states of neighboring nodes, weighting the neighbor states with edge weights, transforming them using a feature mapping matrix, applying an activation function to each neighbor's influence after mapping and summing the results to obtain the total neighbor influence, and finally inputting the node's own historical state and the total neighbor influence into an LSTM network to output the new state at time t. The specific mathematical function is as follows: ； in, Represents a node The state vector at time t contains information such as the degree to which the node is affected by the attack, the business status, and the device status; Represents a node The set of neighboring nodes, through edges Connected nodes, The feature mapping matrix represents the transformation of the neighbor node states into a feature space that matches the current node. side The weight indicates the attack originates from neighboring nodes. propagation to nodes The influence strength; tanh activation function, which compresses the mapped neighbor influence values ​​to [-1, 1]; LSTM represents Long Short-Term Memory network.

5. The industrial internet attack and defense situation and risk early warning perception method according to claim 1, characterized in that: The construction of the risk prediction model includes: first, calculating the direct coupling risk between attacks and devices to obtain the basic risk item; then, obtaining the topology risk item based on the vulnerability risk of the network structure; and finally, combining the service acceleration item obtained from the trend indicator of risk deterioration to obtain a global risk function that comprehensively reflects the current global risk. The specific mathematical function is as follows: ； in, Represented as topological risk weights; Let be the spectral radius of the graph Laplacian matrix; , For degree matrix, It is an adjacency matrix.

6. The industrial internet attack and defense situation and risk early warning perception method according to claim 1, characterized in that: The three-dimensional spatial vector early warning mechanism includes: defining a three-dimensional early warning vector based on the current global risk value, risk change rate, and expected future risk to achieve hierarchical early warning, as detailed below: Define a three-dimensional vector The three components respectively characterize different dimensions of risk: The current global risk value, i.e. ; Risk change rate, i.e. first derivative ; : Expectations of future risk contagion; then , , ; Set the warning threshold boundaries for each of the three dimensions: , , ; Based on the position of vector Z in three-dimensional space, three warning zones are defined: Red Alert: and and This indicates that the current risk has exceeded the standard, is rapidly deteriorating, and has spread to core nodes, and a Level 1 response mechanism is triggered. Yellow alert: but and This indicates that the risk has not exceeded the standard but the spread is accelerating; or but and This indicates that the risk has exceeded the standard but will not spread for the time being, and a Level II response mechanism has been implemented. Green Alert: and and This indicates that the risk is within a safe range, with no significant deterioration or spread, and matches a three-level response mechanism; The response mechanism includes: Level 1 response mechanism: Immediately disconnect the attacked link in the network connection and isolate the abnormal device. When the number of risky devices is uncontrollable, the physical circuit breaker mechanism can be triggered directly to physically isolate all devices. Level 2 response mechanism: Focus on monitoring risky devices, update vulnerability patches, strengthen protection of core nodes, increase the frequency of real-time monitoring, and assign technical personnel to monitor; Level 3 response mechanism: No special processing is performed, but the three-dimensional vector is updated once per hour.

Images