Industrial internet platform security test method and system

Abstract

The embodiment of the invention discloses an industrial internet platform security test method and system, the method is executed by a security test module deployed at edge nodes, and the method comprises the following steps: collecting multi-dimensional context features among the edge nodes in real time; the multi-dimensional context features are input into a trust scoring unit based on a liquid neural network, the liquid neural network adopts a continuous time dynamic evolution mechanism to model a non-stationary time sequence, and an instantaneous trust score of each edge node is generated in real time; dynamically adjusting an access control policy according to the instantaneous trust score; injecting synthetic attack traffic in a test period, recording a trust score response curve of the liquid neural network to attacks, and calculating a false alarm rate and a missing report rate; automatically optimizing internal time parameters, a first threshold value and a second threshold value of the liquid neural network according to the false alarm rate, the missing report rate and the network delay constraint, and generating a security test report containing trust convergence time and strategy switching overhead; according to the invention, the accuracy and response speed of anomaly detection are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of industrial internet security technology, and in particular to a security testing method and system for industrial internet platforms. Background Technology

[0002] Security testing of industrial internet platforms faces technical challenges such as limited edge computing resources, non-stationary network transmission, production interruptions during testing, and static policy thresholds. Existing methods mostly employ discrete time-series models, which struggle to accurately model latency jitter and noise interference in 5G environments, leading to high false positive rates in trust scoring. Centralized testing architectures suffer from high round-trip latency, making it difficult to meet the millisecond-level real-time requirements of industrial control. Fixed threshold strategies lack dynamic adaptability to new types of attacks and are easily bypassed by firmware tampering or protocol malformation attacks.

[0003] The aforementioned issues result in insufficient overall platform resilience, making it difficult for operations and maintenance personnel to detect vulnerabilities before attacks occur and to achieve second-level iteration of strategies during attack evolution. Therefore, a novel security testing method is needed that can simultaneously overcome problems such as resource constraints, non-stationary interference, zero-downtime testing, and static thresholding. Summary of the Invention

[0004] This application provides a security testing method and system for an industrial internet platform, which significantly improves the accuracy and response speed of anomaly detection.

[0005] This application provides the following solution: According to the first aspect, a security testing method for an industrial internet platform is provided. The method is executed by a security testing module deployed at edge nodes. The method includes: real-time acquisition of multi-dimensional context features between edge nodes, including device fingerprints, communication latency jitter, firmware version hashes, and physical environment noise spectrum; inputting the multi-dimensional context features into a trust scoring unit based on a liquid neural network, wherein the liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generates an instantaneous trust score for each edge node in real time; dynamically adjusting access control policies based on the instantaneous trust scores, wherein communication is rejected when the trust score is below a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first and second thresholds; injecting synthetic attack traffic during the test period, recording the trust score response curve of the liquid neural network to the attack, and calculating the false positive rate and false negative rate; and automatically optimizing the internal time parameters of the liquid neural network and the first and second thresholds based on the false positive rate, false negative rate, and network latency constraints to generate a security test report including trust convergence time and policy switching overhead.

[0006] According to one achievable method in the embodiments of this application, the security testing module is deployed in a containerized form on a mobile edge computing server and in the form of a firmware patch on a legacy operating technology device, and the two are synchronized through a lightweight message queue.

[0007] According to one achievable method in the embodiments of this application, the liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series, and generates an instantaneous trust score for each edge node in real time, including: normalizing the collected multi-dimensional context features and inputting them as input vectors into the dynamic unit of the liquid neural network; updating the hidden state according to the current input vector and the hidden state at the previous time step using continuous-time evolution rules; calculating the similarity between the hidden state and the preset trust benchmark vector in real time and mapping it to an instantaneous trust score; smoothing and filtering the instantaneous trust score and outputting the final trust value used for policy decision-making.

[0008] According to one achievable method in the embodiments of this application, injecting synthetic attack traffic during the test period includes: generating at least three types of synthetic attack traffic according to an industrial protocol template, wherein the attack traffic includes malformed function code messages, replay authentication packets, and firmware hash tampering payloads; and injecting the synthetic attack traffic in batches at random time intervals under a preset normal traffic background, while marking the message at the injection time as a real attack label.

[0009] According to one achievable method in the embodiments of this application, the step of recording the trust score response curve of the liquid neural network to the attack and calculating the false positive rate and false negative rate includes: recording the instantaneous trust score sequence output by the liquid neural network in real time to form a response curve aligned with the time axis; setting a trust score below a third threshold as an alarm event, comparing the alarm event with the real attack label, counting the number of false positive events and the number of false negative events respectively, and calculating the false positive rate and false negative rate.

[0010] According to one achievable method in an embodiment of this application, the automatic optimization of the internal time parameters of the liquid neural network includes: optimizing the internal time parameters of the liquid neural network using an online gradient descent method, with the optimization objective being to minimize the weighted sum of the false alarm rate and the false negative rate, while simultaneously satisfying the constraint that the network latency is less than 50ms.

[0011] According to one achievable method in the embodiments of this application, the automatic optimization of the first threshold and the second threshold includes: every hour, calculating the 10% quantile as the new first threshold and the 70% quantile as the new second threshold based on the trust score histogram of all historical attack samples in the past hour; monitoring the increase of attack samples per unit time in real time, and immediately triggering the above recalculation and pushing the updated threshold to all edge nodes when the increase of attack samples is greater than or equal to 20.

[0012] According to a second aspect, an industrial internet platform security testing system is provided, characterized in that it includes a security testing module deployed at edge nodes. The security testing module includes: a multi-dimensional data acquisition unit configured to collect multi-dimensional context features between edge nodes in real time, the multi-dimensional context features including device fingerprints, communication latency jitter, firmware version hashes, and physical environment noise spectrum; a trust score calculation unit configured to input the multi-dimensional context features into a trust scoring unit based on a liquid neural network, the liquid neural network using a continuous-time dynamic evolution mechanism to model non-stationary time series and generate an instantaneous trust score for each edge node in real time; and an access control policy adjustment unit, configured to... The system is configured to dynamically adjust access control policies based on the instantaneous trust score, wherein communication is denied when the trust score is below a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first and second thresholds; a false positive rate and false negative rate calculation unit is configured to inject synthetic attack traffic during the test period, record the trust score response curve of the liquid neural network to the attack, and calculate the false positive rate and false negative rate; a test report generation unit is configured to automatically optimize the internal time parameters of the liquid neural network and the first and second thresholds based on the false positive rate, false negative rate, and network latency constraints, and generate a security test report that includes trust convergence time and policy switching overhead.

[0013] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects above.

[0014] According to a fourth aspect, an electronic device is provided, comprising: one or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method described in any one of the first aspects.

[0015] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application acquires multi-dimensional contextual features in real time and inputs them into a trust scoring unit based on a liquid neural network. It utilizes a continuous-time dynamic evolution mechanism to accurately model non-stationary time series, generating instantaneous trust scores to achieve rapid response to dynamic threats. Access control policies are dynamically adjusted based on the trust scores, including denying communication below a first threshold and initiating challenge response secondary authentication between the first and second thresholds, effectively reducing false positive and false negative rates while adapting to network latency constraints. Synthetic attack traffic is injected during the testing period, response curves are recorded, and performance indicators are calculated. Finally, by automatically optimizing the time parameters and thresholds of the liquid neural network, a report including trust convergence time and policy switching overhead is generated. This method significantly improves the robustness and real-time performance of industrial internet platforms, reduces false positive and false negative rates, improves optimization efficiency to the minute level, is suitable for resource-constrained edge environments, and promotes closed-loop iteration of security testing.

[0016] Of course, any product implementing this application does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart of the industrial internet platform security testing method provided in the embodiments of this application; Figure 2 This is a structural block diagram of the industrial internet platform security testing system provided in the embodiments of this application; Figure 3 A schematic block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0021] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0022] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0023] Figure 1 This document provides a flowchart of a security testing method for an industrial internet platform, which can be executed by a security testing module deployed on an edge node. Figure 1 As shown, the method may include the following steps: Step 101: Collect multi-dimensional context features between edge nodes in real time. The multi-dimensional context features include device fingerprint, communication latency jitter, firmware version hash, and physical environment noise spectrum.

[0024] Step 102: Input the multidimensional context features into the trust scoring unit based on the liquid neural network. The liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generate the instantaneous trust score of each edge node in real time.

[0025] Step 103: Dynamically adjust the access control policy based on the instantaneous trust score, wherein communication is rejected when the trust score is lower than the first threshold, and challenge response secondary authentication is initiated when the trust score is between the first threshold and the second threshold.

[0026] Step 104: Inject synthetic attack traffic during the test period, record the trust score response curve of the liquid neural network to the attack, and calculate the false positive rate and false negative rate.

[0027] Step 105: Based on the false positive rate, false negative rate, and network latency constraints, automatically optimize the internal time parameters of the liquid neural network and the first and second thresholds to generate a security test report that includes trust convergence time and policy switching overhead.

[0028] As can be seen from the above process, this application achieves rapid response to dynamic threats by real-time acquisition of multi-dimensional contextual features and inputting them into a trust scoring unit based on a liquid neural network. It utilizes a continuous-time dynamic evolution mechanism to accurately model non-stationary time series and generate instantaneous trust scores. Access control policies are dynamically adjusted based on the trust scores, including denying communication below a first threshold and initiating challenge response secondary authentication between the first and second thresholds, effectively reducing false positive and false negative rates while adapting to network latency constraints. Synthetic attack traffic is injected during the testing period, response curves are recorded, and performance indicators are calculated. Finally, by automatically optimizing the time parameters and thresholds of the liquid neural network, a report including trust convergence time and policy switching overhead is generated. This method significantly improves the robustness and real-time performance of industrial internet platforms, reduces false positive and false negative rates, improves optimization efficiency to the minute level, is suitable for resource-constrained edge environments, and promotes closed-loop iteration of security testing.

[0029] To facilitate understanding of this application, the system architecture on which it is based is described first. This application is used for security testing of an industrial internet platform. It is executed by a security testing module deployed on an edge node. This security testing module is a software or firmware component responsible for the specific operation of the method; deployment on an edge node means that this module is installed or integrated on the edge node. In the industrial internet, an edge node refers to a computing device close to the data source, such as a mobile edge computing (MEC) server or a modified operations technology (OT) device, rather than a centralized cloud server. The advantages of this deployment method are reduced latency, improved real-time performance, and convenient local data processing.

[0030] As an feasible approach, the security testing module is deployed in a containerized form on the MEC server and as a firmware patch on legacy OT devices, with both synchronized through a lightweight message queue.

[0031] The security testing module is deployed on the MEC server using containerization technology. This approach encapsulates the module into independent containers, such as using Docker or similar tools, enabling rapid deployment, resource isolation, and version management. As edge computing nodes in 5G networks, the MEC server possesses powerful processing capabilities, and containerization allows the module to run without interfering with other applications on the server, reducing deployment time and maintenance costs. This approach is particularly suitable for dynamic environments, enabling one-click updates via image pulling.

[0032] For legacy OT devices, the safety testing module is deployed as a firmware patch. Legacy OT devices typically refer to older operating technology hardware, such as programmable logic controllers or sensors, which have limited resources and are not easily upgraded. Through firmware patches, the module can be embedded as a small code increment into the device's existing firmware, avoiding a complete firmware rewrite. This approach minimizes the impact on device performance while preserving the integrity of original functionality, ensuring stable operation in the industrial field.

[0033] Synchronization between the two is achieved through a lightweight message queuing mechanism. Such queuing systems, such as the MQTT protocol or similar open-source tools, focus on low-overhead data exchange, supporting asynchronous communication and real-time push. Container modules on the MEC server and patch modules on the OT device can exchange collected data, trust scores, or optimization parameters without causing network congestion. This synchronization method enhances system coordination, ensures information consistency between edge nodes, and thus maintains an efficient security testing process in a distributed environment.

[0034] The following describes in detail each step of the above process and the effects that can be further produced, with reference to the embodiments. It should be noted that the terms "first" and "second" involved in this disclosure do not have limitations in terms of size, order, or quantity, but are only used to distinguish them in name. For example, "first threshold" and "second threshold" are used to distinguish two thresholds.

[0035] First, the above step 101, namely "real-time acquisition of multi-dimensional context features between edge nodes, including device fingerprint, communication latency jitter, firmware version hash and physical environment noise spectrum", will be described in detail with reference to the embodiments.

[0036] Edge nodes typically refer to computing devices close to the data source, such as mobile edge computing servers or operational technology devices. The interaction data between these nodes is considered as multi-dimensional contextual features, providing comprehensive environmental and behavioral insights for subsequent trust assessment and anomaly detection.

[0037] Device fingerprinting, as one of the multi-dimensional contextual features, is a digital description of the unique identity of each edge node. It forms an unforgeable "fingerprint" by extracting the device's hardware identifier, software configuration, or behavioral patterns, similar to human fingerprint recognition. This feature helps distinguish legitimate devices from potential intruders, such as quickly verifying the authenticity of access nodes in 5G networks and preventing identity spoofing attacks.

[0038] Communication latency jitter reflects the stability fluctuations in data transmission between nodes. Specifically, latency jitter refers to the non-uniform variation in communication delay, which may be caused by network congestion, interference, or malicious tampering. By monitoring this characteristic in real time, the system can identify abnormal behavior, such as latency spikes caused by distributed denial-of-service attacks, thereby improving the overall robustness of the network.

[0039] Firmware version hashes are used to verify the integrity and consistency of edge node software firmware. They are calculated by comparing a hash value from the firmware code with a preset version. A change in the hash value may indicate firmware tampering or improper upgrades. Collecting this characteristic helps detect supply chain attacks or malware injections early, ensuring devices operate in a trusted state.

[0040] The physical environment noise spectrum captures the noise distribution characteristics of the physical space where a node is located, typically involving spectral analysis of sound waves, electromagnetic waves, or other environmental signals. For example, in an industrial setting, abnormal noise spectra may originate from equipment malfunctions, external interference, or physical intrusion. By incorporating this feature, the system extends beyond the digital level to physical security monitoring, enabling multimodal context awareness.

[0041] The real-time collection of these multi-dimensional features collectively forms a dynamic security foundation. They are integrated and input into subsequent neural network models to form a quantitative assessment of node trust, ultimately supporting access control and attack simulation testing.

[0042] The following describes in detail step 102, namely, "inputting multi-dimensional contextual features into a trust scoring unit based on a liquid neural network, wherein the liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generate instantaneous trust scores for each edge node in real time," with reference to an embodiment.

[0043] The core of this step lies in using the previously collected multidimensional contextual features as input, passing them to a scoring unit specifically designed for trust assessment. The core component of this unit is a liquid neural network, which processes the input data and outputs quantified results. Through this input mechanism, the system can transform fragmented contextual information into actionable trust metrics, ensuring efficient security decision-making in the edge environment of the industrial internet platform.

[0044] Multidimensional contextual features typically undergo preprocessing steps, such as normalization or feature extraction, before input to adapt to the computational needs of neural networks. These features are organized into vector form and directly fed into the trust scoring unit. This input method emphasizes the immediacy and completeness of the data, avoiding the latency of traditional batch processing methods, thus supporting real-time application scenarios.

[0045] The trust scoring unit is built on a liquid neural network, an advanced neural computing model that, unlike traditional static neural networks, emphasizes dynamic adaptability. By simulating fluid-like state changes, liquid neural networks can handle complex and variable input signals and perform exceptionally well on resource-constrained edge nodes.

[0046] Liquid Neural Networks employ a continuous-time dynamic evolution mechanism to process data. This mechanism allows the network state to evolve continuously over time, rather than being updated in discrete steps. It is trained using a time backpropagation algorithm, which unfolds the network into a series of feedforward networks over time and aggregates the errors to update the weights, thus adapting to the continuous-time dynamic evolution mechanism. This training process emphasizes the network's dynamic adaptability rather than relying on large-scale pre-trained datasets. It describes the network's internal dynamics through differential equations, such as the gradual change of hidden states over time, thereby capturing subtle temporal dependencies. This network is particularly useful for modeling non-stationary time series. Non-stationary time series refer to data streams whose statistical properties change over time, such as communication jitter or noise spectra affected by interference in industrial environments. Through the dynamic evolution mechanism, the network can adapt to the non-stationarity of the sequence, such as mean drift or variance fluctuations, thereby accurately predicting potential anomalies rather than relying on fixed patterns.

[0047] The final output of this feature is the real-time generation of an instantaneous trust score for each edge node. The instantaneous trust score is a numerical metric, typically between zero and one hundred, reflecting the node's current trust level. This real-time capability relies on the network's low computational overhead and continuous evolution, ensuring the score is updated within milliseconds, facilitating subsequent access control and threat response.

[0048] As an feasible approach, the liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series, generating an instantaneous trust score for each edge node in real time. This includes: normalizing the collected multi-dimensional context features and inputting them as input vectors into the dynamic unit of the liquid neural network; updating the hidden state according to the current input vector and the hidden state at the previous time step using continuous-time evolution rules within each time step; calculating the similarity between the hidden state and a preset trust benchmark vector in real time, mapping it to an instantaneous trust score; and smoothing and filtering the instantaneous trust score to output the final trust value used for policy decision-making.

[0049] Specifically, the normalized features are organized into an input vector and directly fed into the dynamic unit of the liquid neural network. This dynamic unit is the core component of the network, responsible for receiving external inputs and initiating the evolution of the internal state. The time step is a small discrete interval used to approximate continuous-time dynamics. Although liquid neural networks inherently employ a continuous-time model, in practice, they are often discretized using numerical integration methods such as Euler's method. The update process follows continuous-time evolution rules, for example, describing the gradual change of the hidden state through ordinary differential equations, where the current input provides the external drive, while the previous hidden state carries historical information. This rule allows the network to capture long-term dependencies and non-stationary characteristics of time series, avoiding the rigidity of traditional discrete networks.

[0050] The next step is to calculate the similarity between the hidden state and the preset trust benchmark vector in real time and map it to an instantaneous trust score. The hidden state is a vector representation within the network, containing an abstract encoding of the input features. The preset trust benchmark vector is a reference standard, typically defined based on historical data or expert knowledge under normal scenarios. Similarity calculation can employ metrics such as cosine similarity or Euclidean distance, mapping the results to a specific score range, such as zero to one hundred. This real-time nature ensures that scores are generated within milliseconds, making it suitable for highly dynamic industrial internet environments.

[0051] Finally, the instantaneous trust score is smoothed and filtered to output the final trust value used for policy decisions. Smoothing filtering aims to remove noise and short-term fluctuations from the score sequence, for example, through moving averages or low-pass filters, resulting in a more stable output value. This final trust value becomes the basis for downstream access control policies, ensuring the reliability and consistency of decisions.

[0052] The following describes in detail step 103, namely, "dynamically adjusting the access control policy based on the instantaneous trust score, wherein communication is rejected when the trust score is lower than a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first threshold and a second threshold," with reference to the embodiments.

[0053] Instantaneous trust scores reflect the current trust status of edge nodes. Dynamically adjusting access control policies means that policies change as scores fluctuate, for example, strengthening protection when scores drop or relaxing restrictions when scores stabilize. This dynamism relies on the real-time output of the liquid neural network, ensuring that the adjustment process is completed within milliseconds, adapting to the network's low-latency requirements.

[0054] When the trust score falls below a first threshold, the system directly rejects communication. The first threshold is a preset lower limit, such as 30, representing a node with very low trustworthiness, potentially posing serious risks such as malicious intrusion or device tampering. Rejecting communication at this point immediately blocks potential threats, preventing data leaks or system crashes, while simultaneously logging the event for subsequent analysis. This measure prioritizes security and is suitable for high-risk scenarios.

[0055] When the trust score falls between the first and second thresholds, the system initiates a challenge-response secondary authentication. The second threshold is a relatively high limit, such as 70, indicating that the node's trustworthiness is moderate and requires further verification. The challenge-response mechanism involves sending a random challenge code and requesting the node to respond, for example, through cryptographic hash calculations, to confirm the legitimacy of the identity. This secondary authentication balances security and availability, avoiding business disruptions caused by excessive rejection.

[0056] Preferably, when dynamically adjusting the access control policy based on the instantaneous trust score, this application may further include: when the trust score is higher than or equal to the second threshold, directly allowing communication and granting full access rights; when the trust score is in the middle range, a permission degradation mode may be introduced, such as restricting nodes to only access non-sensitive data or perform read-only operations; risk assessment linkage may also be added, triggering an alarm to notify the administrator or log recording when the trust score drops, for subsequent auditing and evidence collection.

[0057] The following describes in detail step 103, namely "injecting synthetic attack traffic during the test period, recording the trust score response curve of the liquid neural network to the attack, and calculating the false positive rate and false negative rate," with reference to the embodiments.

[0058] This step involves proactively introducing simulated threats within a pre-defined testing period to test the system's detection capabilities and response mechanisms. This period is typically regular or event-triggered, such as hourly or daily, designed to simulate real-world attack scenarios without disrupting normal production operations. Through this proactive testing, the system can expose potential vulnerabilities and provide a data foundation for subsequent optimizations, ensuring continuous improvement of security mechanisms.

[0059] Injecting synthetic attack traffic is a key step in this feature. Synthetic attack traffic refers to artificially generated malicious data packets or sequences of behaviors. This traffic is constructed based on industry protocol templates. Preferably, this application generates at least three types of synthetic attack traffic, including malformed function code messages, replay authentication packets, and firmware hash tampering payloads. The injection process is performed against a normal traffic background, executed in batches at random time intervals to mimic the stealth and suddenness of real attacks. This approach allows the testing module to control the attack strength and type, while simultaneously labeling the packets at the injection moment as real attack tags, facilitating subsequent comparative analysis.

[0060] Recording the trust score response curve of a liquid neural network to an attack involves real-time monitoring of changes in the network's output. The response curve is a time-series graph, with the horizontal axis representing time and the vertical axis representing the instantaneous trust score. During the attack injection, the system continuously captures the sequence of trust scores generated by the network, forming a response curve aligned with the time axis. This recording helps visualize the network's sensitivity to different attack types, such as peaks and troughs where the score drops sharply, thus revealing the model's dynamic response characteristics.

[0061] The calculation of false positive and false negative rates is based on quantitative evaluation using recorded curves and labels. This comparison process matches system-generated alarms with pre-labeled attack tags. Real attack tags originate from the injection phase of synthetic attack traffic, such as marking specific packets as malicious. This event-by-event comparison helps identify the accuracy of the system's judgments, forming the core data source for evaluation. The false positive rate refers to the proportion of normal behavior incorrectly identified as an attack, while the false negative rate refers to the proportion of real attacks that are not detected. By setting alarm thresholds, such as considering a trust score below a certain value as an alarm, alarm events are compared with real tags, the number of false positives and false negatives is counted, and the corresponding ratios are calculated. The false positive rate is typically the number of false positives divided by the total number of normal events, and the false negative rate is the number of false negatives divided by the total number of attack events. This ratio calculation uses standard performance indicator formulas and outputs as percentages, facilitating comparison with other security systems and iterative improvement.

[0062] As an implementable approach, this application defines an alarm event as a trust score falling below a third threshold when calculating the false positive and false negative rates. The alarm events are compared with actual attack labels, and the number of false positives and false negatives are counted separately, with the false positive and false negative rates calculated accordingly. The third threshold is an independent preset value, such as fifty, used to distinguish between normal and abnormal states. When the instantaneous trust score drops below this threshold, the system automatically marks it as an alarm event. This setting is similar to a warning line, designed to capture signals of potential threats while avoiding invalid alarms caused by oversensitivity.

[0063] The following describes in detail step 105, namely, "automatically optimizing the internal time parameters of the liquid neural network and the first and second thresholds based on the false positive rate, false negative rate, and network latency constraints, and generating a security test report that includes trust convergence time and policy switching overhead," with reference to the embodiments.

[0064] False positive rate and false negative rate, serving as the basis for optimization, reflect the system's accuracy in attack detection. Network latency constraints are another key input, typically referring to the upper limit of latency in industrial scenarios, such as less than fifty milliseconds. This constraint ensures that the optimization process does not sacrifice real-time performance; for example, it avoids introducing additional computational overhead when adjusting parameters, thus making the system suitable for highly dynamic edge computing environments.

[0065] Automatic optimization first targets the internal time parameters of the liquid neural network. These parameters mainly include the time constant, which controls the rate of continuous evolution of the network state. Using online gradient descent or similar algorithms, the system minimizes the weighted sum of the false positive and false negative rates while adhering to delay constraints. This adjustment allows the network to better adapt to non-stationary time series and improves the efficiency of processing contextual features.

[0066] Simultaneously, the optimization process also involves adjusting the first and second thresholds. The first threshold defines the lower limit for denying communication, while the second threshold defines the upper limit for initiating secondary authentication. These thresholds can be dynamically migrated through quantile calculations or historical data histograms, for example, recalculated hourly based on past samples, to ensure that the strategy matches the current threat landscape.

[0067] As an implementable approach, dynamically optimizing the first and second thresholds includes: calculating the 10% quantile as the new first threshold and the 70% quantile as the new second threshold every hour based on the trust score histogram of all historical attack samples in the past hour; monitoring the increase in attack samples per unit time in real time, and immediately triggering the above recalculation and pushing the updated thresholds to all edge nodes when the increase in attack samples is greater than or equal to 20.

[0068] Specifically, every hour, the system automatically retrieves all samples marked as "real attacks" from the past 60 minutes and calculates a histogram of their trust scores. The histogram is a heatmap, with low-scoring samples piled up on the left and high-scoring samples sparse on the right. The system takes the left 10% as the new first threshold and the left 70% as the new second threshold. Simply put: the more aggressive the attack, the more low-scoring samples there are, causing both thresholds to shift to the left, automatically narrowing the security gate; when the attack subsides, the thresholds shift to the right, and production efficiency immediately recovers.

[0069] The real-time monitoring component acts like an "attack radar." It counts the number of new attack samples added in the last minute every second. Once the increase reaches or exceeds 20, the system immediately skips the waiting period and accelerates the calculation process from one hour in advance. It completes the histogram, quantiles, and recalculation in just 3 seconds and pushes the new threshold across the entire network. The edge nodes receive the data and it takes effect within 0.5 seconds, requiring no restart or manual intervention.

[0070] Finally, a security test report is generated after optimization. This report includes trust convergence time, which is the time required for the trust score to stabilize after fluctuations, and policy switching overhead, which is the resource consumption such as computation time or network bandwidth when adjusting access control policies. This type of report provides quantitative insights, enabling administrators to assess the overall system performance and achieve continuous iteration in industrial internet platforms.

[0071] The methods provided in this application can be applied to various scenarios, including but not limited to: First, in smart manufacturing plants, this method can be deployed at 5G edge nodes to perform real-time trust assessment and attack simulation testing on legacy OT devices such as PLC controllers. By dynamically adjusting access policies through liquid neural networks, it effectively prevents supply chain attacks and communication tampering, ensures continuous production line operation, reduces false alarm and false negative rates, and improves production efficiency. Second, in smart grid systems, this method is integrated into MEC servers to collect multi-dimensional contextual features to monitor the security status of substation equipment. During periods of high load, it injects synthetic attack traffic, automatically optimizes thresholds and time parameters, and quickly responds to potential intrusions, ensuring the stability and low-latency response of power transmission, making it suitable for remote monitoring scenarios. Finally, in intelligent transportation infrastructure, this method is used for testing roadside units and vehicle edge nodes, generating trust scores in real time to prevent DDoS attacks, supporting challenge-response authentication, reducing the risk of traffic signal disruption, and promoting the safe deployment of autonomous driving systems.

[0072] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0073] According to another embodiment, an industrial internet platform security testing system is provided, including a security testing module 200 deployed at an edge node, the security testing module 200 comprising: The multidimensional data acquisition unit 201 is configured to acquire multidimensional context features between edge nodes in real time. The multidimensional context features include device fingerprint, communication latency jitter, firmware version hash, and physical environment noise spectrum.

[0074] The trust score calculation unit 202 is configured to input the multidimensional context features into a trust scoring unit based on a liquid neural network, which uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generate instantaneous trust scores for each edge node in real time.

[0075] Access control policy adjustment unit 203 is configured to dynamically adjust access control policy based on the instantaneous trust score, wherein communication is rejected when the trust score is lower than a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first threshold and a second threshold.

[0076] The false positive and false negative rate calculation unit 204 is configured to inject synthetic attack traffic during the test period, record the trust score response curve of the liquid neural network to the attack, and calculate the false positive rate and false negative rate. The test report generation unit 205 is configured to automatically optimize the internal time parameters of the liquid neural network and the first threshold and the second threshold based on the false positive rate, false negative rate and network latency constraints, and generate a security test report that includes trust convergence time and policy switching overhead.

[0077] As an feasible approach, the security testing module is deployed in a containerized form on a mobile edge computing server and in the form of firmware patches on legacy operating technology devices, with both synchronized through a lightweight message queue.

[0078] As an implementable approach, the trust score calculation unit 202, when modeling non-stationary time series using a continuous-time dynamic evolution mechanism in a liquid neural network and generating instantaneous trust scores for each edge node in real time, can be configured as follows: The collected multi-dimensional context features are normalized and input as input vectors to the dynamic unit of the liquid neural network; within each time step, the hidden state is updated according to the current input vector and the hidden state of the previous time step using continuous-time evolution rules; the similarity between the hidden state and a preset trust benchmark vector is calculated in real time and mapped to an instantaneous trust score; the instantaneous trust score is smoothed and filtered to output the final trust value used for policy decision-making.

[0079] As an implementable approach, the false positive / false negative rate calculation unit 204 can be configured to generate at least three types of synthetic attack traffic according to an industrial protocol template, including malformed function code messages, replay authentication packets, and firmware hash tampering payloads; and inject the synthetic attack traffic in batches at random time intervals under a preset normal traffic background, while marking the message at the injection time as a real attack label.

[0080] As an implementable approach, the false positive rate and false negative rate calculation unit 204 can be configured to: record the instantaneous trust score sequence output by the liquid neural network in real time to form a response curve aligned with the time axis; set a trust score below a third threshold as an alarm event; compare the alarm event with the real attack label; count the number of false positive events and false negative events respectively; and calculate the false positive rate and false negative rate.

[0081] As an implementable approach, the test report generation unit 205 can be configured to automatically optimize the internal time parameters of the liquid neural network by optimizing the internal time parameters of the liquid neural network through an online gradient descent method, with the optimization objective being to minimize the weighted sum of the false alarm rate and the false negative rate, while satisfying the constraint that the network latency is less than 50ms.

[0082] As an implementable approach, the test report generation unit 205 can be configured to automatically optimize the first threshold and the second threshold as follows: every hour, calculate the 10% quantile as the new first threshold and the 70% quantile as the new second threshold based on the trust score histogram of all historical attack samples in the past hour; monitor the attack sample increment per unit time in real time, and immediately trigger the above recalculation and push the updated threshold to all edge nodes when the attack sample increment is greater than or equal to 20.

[0083] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. Components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0084] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0085] In addition, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method described in any of the foregoing method embodiments.

[0086] And an electronic device, comprising: One or more processors; and A memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method described in any of the foregoing method embodiments.

[0087] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any of the foregoing method embodiments.

[0088] in, Figure 3 The architecture of an electronic device is illustrated, which may include a processor 310, a video display adapter 311, a disk drive 312, an input / output interface 313, a network interface 314, and a memory 320. The processor 310, video display adapter 311, disk drive 312, input / output interface 313, network interface 314, and memory 320 can communicate with each other via a communication bus 330.

[0089] The processor 310 can be implemented using a general-purpose CPU, microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits to execute relevant programs in order to implement the technical solution provided in this application.

[0090] The memory 320 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 320 can store the operating system 321 for controlling the operation of the electronic device 300, and the basic input / output system (BIOS) 322 for controlling the low-level operations of the electronic device 300. Additionally, it can store a web browser 323, a data storage management system 324, and an industrial internet platform security testing system 325, etc. The aforementioned industrial internet platform security testing system 325 can be the application program that specifically implements the aforementioned steps in this embodiment. In summary, when implementing the technical solution provided in this application through software or firmware, the relevant program code is stored in the memory 320 and is called and executed by the processor 310.

[0091] Input / output interface 313 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0092] Network interface 314 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0093] Bus 330 includes a pathway for transmitting information between various components of the device, such as processor 310, video display adapter 311, disk drive 312, input / output interface 313, network interface 314, and memory 320.

[0094] It should be noted that although the above-described device only shows the processor 310, video display adapter 311, disk drive 312, input / output interface 313, network interface 314, memory 320, bus 330, etc., in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the solution of this application, and does not necessarily include all the components shown in the figures.

[0095] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer program product. This computer program product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0096] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A security testing method for an industrial internet platform, characterized in that, The method is executed by a security testing module deployed on an edge node, and the method includes: Real-time acquisition of multi-dimensional context features between edge nodes, including device fingerprints, communication latency jitter, firmware version hashes, and physical environment noise spectrum; The multidimensional context features are input into a trust scoring unit based on a liquid neural network. The liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generate instantaneous trust scores for each edge node in real time. The access control policy is dynamically adjusted based on the instantaneous trust score, wherein communication is denied when the trust score is below a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first threshold and a second threshold. Synthetic attack traffic was injected during the test period, the trust score response curve of the liquid neural network to the attack was recorded, and the false positive rate and false negative rate were calculated. Based on the false positive rate, false negative rate, and network latency constraints, the internal time parameters of the liquid neural network and the first and second thresholds are automatically optimized to generate a security test report that includes trust convergence time and policy switching overhead.

2. The industrial internet platform security testing method according to claim 1, characterized in that, The security testing module is deployed in a containerized form on a mobile edge computing server and in the form of firmware patches on legacy operating technology devices, and the two are synchronized through a lightweight message queue.

3. The industrial internet platform security testing method according to any one of claims 1-2, characterized in that, The liquid neural network uses a continuous-time dynamic evolution mechanism to model non-stationary time series, and generates the instantaneous trust score for each edge node in real time, including: The collected multidimensional context features are normalized and then used as input vectors to input the dynamic units of the liquid neural network. Within each time step, the hidden state is updated according to the current input vector and the hidden state of the previous time step using the continuous-time evolution rule; The similarity between the hidden state and the preset trust benchmark vector is calculated in real time and mapped to an instantaneous trust score. The instantaneous trust score is smoothed and filtered to output the final trust value used for policy decision-making.

4. The industrial internet platform security testing method according to any one of claims 1-3, characterized in that, The injected synthetic attack traffic during the testing period included: At least three types of synthetic attack traffic are generated based on an industrial protocol template, including malformed function code messages, replay authentication packets, and firmware hash tampering payloads. Under a preset normal traffic background, the synthetic attack traffic is injected in batches at random time intervals, and the packets at the injection time are marked as real attack tags.

5. The industrial internet platform security testing method according to any one of claims 1-4, characterized in that, The process of recording the trust score response curve of the liquid neural network to the attack and calculating the false positive rate and false negative rate includes: The instantaneous trust score sequence of the liquid neural network output is recorded in real time to form a response curve aligned with the time axis; An alarm event is defined as a trust score falling below the third threshold. Alarm events are compared with actual attack tags to count the number of false alarms and false negatives, and the false alarm rate and false negative rate are calculated.

6. The industrial internet platform security testing method according to any one of claims 1-5, characterized in that, The internal time parameters of the automatically optimized liquid neural network include: The internal time parameters of the liquid neural network are optimized using the online gradient descent method. The optimization objective is to minimize the weighted sum of the false alarm rate and the false negative rate, while satisfying the constraint that the network latency is less than 50ms.

7. The industrial internet platform security testing method according to any one of claims 1-6, characterized in that, Automatic optimization of the first threshold and the second threshold includes: Every hour, the 10% quantile is calculated as the new first threshold and the 70% quantile as the new second threshold based on the trust score histogram of all historical attack samples in the past hour. The system monitors the increase in attack samples per unit time in real time. When the increase in attack samples is greater than or equal to 20, the system immediately triggers the above recalculation and pushes the updated threshold to all edge nodes.

8. A security testing system for an industrial internet platform, characterized in that, This includes a security testing module deployed at edge nodes, the security testing module comprising: The multidimensional data acquisition unit is configured to acquire multidimensional context features between edge nodes in real time. The multidimensional context features include device fingerprints, communication latency jitter, firmware version hashes, and physical environment noise spectrum. The trust score calculation unit is configured to input the multidimensional context features into the trust scoring unit based on the liquid neural network, which uses a continuous-time dynamic evolution mechanism to model non-stationary time series and generate the instantaneous trust score of each edge node in real time. The access control policy adjustment unit is configured to dynamically adjust the access control policy based on the instantaneous trust score, wherein communication is denied when the trust score is lower than a first threshold, and challenge response secondary authentication is initiated when the trust score is between the first threshold and a second threshold. The false positive and false negative rate calculation unit is configured to inject synthetic attack traffic during the test period, record the trust score response curve of the liquid neural network to the attack, and calculate the false positive rate and false negative rate. The test report generation unit is configured to automatically optimize the internal time parameters of the liquid neural network and the first and second thresholds based on the false positive rate, false negative rate, and network latency constraints, to generate a security test report that includes trust convergence time and policy switching overhead.

9. An electronic device, characterized in that, include: One or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 7.

Images