Industrial operation and maintenance high-risk instruction intelligent identification method and system based on instruction sequence analysis

Abstract

The invention discloses an industrial operation and maintenance high-risk instruction intelligent identification method and system based on instruction sequence analysis, and the method comprises the steps: intercepting an operation and maintenance instruction inputted by a remote user in real time through an operation and maintenance gateway, and constructing an instruction sequence according to a time window; performing vectorization representation on the instruction sequence, and generating an overall sequence representation vector by adopting a sequence coding model; performing similarity calculation on the overall sequence representation vector and the high-risk sequence center vector, and outputting risk confidence; calculating a comprehensive risk score in combination with the permission coefficient, the time sensitivity coefficient and the context factor; and making a decision according to a comparison result of the comprehensive risk score and a risk threshold, and identifying an industrial operation and maintenance high-risk instruction. The method can accurately identify the potential high-risk instruction behavior, reduces the system security risk, and has the advantages of high identification precision, strong real-time performance and good expandability.

Description

Technical Field

[0001] This invention relates to the field of smart grid technology, specifically to a method and system for intelligent identification of high-risk industrial operation and maintenance commands based on command sequence analysis. Background Technology

[0002] With the deep integration of industrial control systems and information technology, remote operation and maintenance of industrial equipment has become an important means to ensure production continuity and efficiency. However, the large number of remote command execution operations involved in this process also brings significant security risks. According to a 2023 industrial cybersecurity research report released by Gartner, approximately 38% of industrial operation and maintenance security incidents stem from misoperation or malicious exploitation of high-risk commands, making it one of the important factors affecting the security of industrial control systems.

[0003] Currently, the high-risk command identification methods commonly used in the industry can be mainly divided into the following categories: One approach is static detection based on rule matching. These methods rely on pre-defined rule bases (such as open-source rule sets like Snort) to identify dangerous operation commands. While convenient to deploy and computationally inexpensive, they have significant limitations in practical applications. Their matching method depends on string features, making it difficult to identify semantically equivalent but structurally different command variants. Furthermore, static rules are prone to incomplete coverage, resulting in a high false positive rate and severely impacting the continuity of normal operation and maintenance processes.

[0004] Second, there is the dynamic detection method using machine learning models. This type of method automatically identifies abnormal operation patterns by training the model and has a certain generalization ability. However, in industrial operation and maintenance scenarios, real attack samples are scarce, and the command corpus is complex and limited in quantity, resulting in limited training effectiveness and an actual accuracy rate typically below 70%. Furthermore, these models are highly dependent on computing resources during inference, often requiring dedicated hardware such as GPUs or TPUs, making them difficult to implement in resource-constrained portable operation and maintenance gateway devices.

[0005] Third, there is the security handling mechanism that relies on regular expressions combined with manual review. While regular expression-based instruction filtering methods can achieve basic matching of some dangerous instructions, they have significant shortcomings when dealing with instructions with complex parameter structures and dynamically changing semantics. For example, this method struggles to handle instructions containing wildcards or dynamically adjusted parameters, and it lacks awareness of the execution context, failing to identify potential high-risk behavior patterns such as "high-privilege operations outside of working hours." While administrators manually approve remote operation instructions to control risk, which can improve decision-making accuracy to some extent, the response time is generally long, with an average review cycle exceeding 2 hours, making it difficult to meet the real-time interception requirements for high-risk operations. More importantly, manual judgment standards are greatly influenced by individual differences, resulting in inconsistent processing results and a high risk of mistakenly allowing or blocking instructions.

[0006] In summary, existing technologies for identifying high-risk commands are limited to viewing individual commands in isolation, neglecting the logical connections between operations. This leads to the inability to identify combined attacks, such as the disruptive chain of backing up configuration → deleting the original configuration → restarting the service, where each individual command may be legitimate, resulting in missed delayed attacks: malicious commands are scattered across different time windows (e.g., probing before penetration); legitimate operations are mistakenly deleted; and high-risk command fragments (e.g., `rm`) are intercepted out of context, impacting operational continuity. Therefore, a novel intelligent high-risk command identification scheme based on inter-command correlation analysis is urgently needed to achieve real-time identification, accurate interception, and continuous optimization of high-risk commands. Summary of the Invention

[0007] The technical problem to be solved by this invention is to provide a method for intelligent identification of high-risk industrial operation and maintenance commands based on command sequence analysis, which can balance high real-time performance, strong robustness and high recognition accuracy, and significantly improve the security protection capability of industrial operation and maintenance systems. To solve the above-mentioned technical problems, the technical solution adopted by the present invention includes the following steps: S1) The operation and maintenance gateway intercepts remote user input operation and maintenance commands in real time and constructs command sequences based on time windows; S2) The instruction sequence is vectorized and a sequence encoding model is used to generate the overall sequence representation vector; S3) Calculate the similarity between the overall sequence representation vector and the center vector of the high-risk sequence, and output the risk confidence score; S4) Calculate the comprehensive risk score by combining the authority coefficient, time sensitivity coefficient, and contextual factors; S5) Make decisions based on the comparison results of comprehensive risk scores and risk thresholds to identify high-risk instructions for industrial operation and maintenance.

[0008] Furthermore, The formula for constructing the instruction sequence in step S1) is:

[0009] Where i represents the number of the currently intercepted instruction. For intercepted operation and maintenance instructions, For time window, Indication of instructions Execution time, express Instructions executed at that time To use the current instruction The instruction sequence constructed based on the reference, is executed before... The set of operation and maintenance instructions executed within a time period and its own composition.

[0010] Furthermore, step S2) specifically includes the following steps: S2.1) Each instruction in the sequence Mapped to vector :

[0011] in, This represents an embedded function, which includes features such as instruction path, key parameters, and timestamps. S2.2) Modeling vector sequences based on sequence encoders: ,

[0012] in, For recurrent neural network encoder models, The vector represents the entire sequence; Furthermore, the training objective of the sequence encoder model adopts a triplet loss function:

[0013] in, For anchor sequences, For positive sample sequences, For negative sample sequences, This is the interval hyperparameter.

[0014] Furthermore, step S2) also includes each operation and maintenance gateway periodically uploading its local sequence encoder model parameters to the cloud aggregation node, using a weighted federated aggregation algorithm based on sample size:

[0015] in, Indicates the first Each gateway in round Model parameters, This represents the number of local samples. A global model is formed in the cloud and broadcast to all gateway nodes for updates. Furthermore, the similarity calculation formula in step S3) is:

[0016] in, The overall sequence representation vector, high-risk instruction sequence center vector library , For the i-th high-risk instruction in the high-risk instruction library, the highest similarity calculation result is used as the risk confidence of the sequence. .

[0017] Furthermore, the similarity calculation process in step S3) also includes generating a sequence summary fingerprint from instruction sequences with a risk confidence level higher than a preset value and storing it in a cache.

[0018] Furthermore, step S4) involves calculating the comprehensive risk by combining the risk confidence level with contextual factors:

[0019] in, For risk confidence level, This is the permission coefficient. The time sensitivity coefficient, This is the historical risk coefficient (the ratio of the number of abnormal operations to the total number of operations). As the risk confidence level weight, For the permission coefficient weight, The time sensitivity coefficient, Weighted by historical risk coefficient;

[0020] in, It represents the standard deviation of the time difference between adjacent instructions in an instruction sequence.

[0021] This invention also proposes an intelligent identification system for high-risk industrial operation and maintenance commands based on command sequence analysis, comprising: a command acquisition module, a command modeling module, a high-risk matching module, a scoring module, a decision-making module, a caching module, a federated agent, and a cloud aggregation node; wherein: Command acquisition module: Used to listen for and capture remote operation commands through the operation and maintenance gateway in real time, and record the command execution time and parameter information in chronological order; Instruction modeling module: used to model instructions based on a preset time window. The collected consecutive instructions are aggregated into an instruction sequence, ensuring that the time span between the first and last instructions in the sequence does not exceed [a certain value]. ; Similarity detection module: used to vectorize the instruction sequence and generate an overall sequence representation vector through a sequence encoding model; then, the similarity of this vector with the center vector of historical high-risk instruction sequences is calculated to obtain the risk confidence. Scoring module: Used to calculate a comprehensive risk score by combining risk confidence level, authority coefficient, time sensitivity coefficient and contextual factors; Decision module: Based on the output of the scoring module, the risk score is compared with a preset threshold to make a decision on whether to intercept or allow passage. Cache module: Used to store the summary fingerprints of frequently occurring low-risk instruction sequences and their judgment results. When subsequent inputs hit the cache, the results can be reused directly, thereby accelerating the recognition process. Federation Agent: As a bridge between the operation and maintenance gateway and the cloud aggregation node, it is responsible for local model training and participates in the federated learning process to achieve knowledge sharing across devices; Cloud aggregation node: Used to receive model parameter updates from multiple operation and maintenance gateways, perform federated average aggregation to generate a global model, and distribute the aggregated model to each operation and maintenance gateway node to achieve continuous optimization of the overall model; The identification system is used to implement the steps of the above-mentioned intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis.

[0022] The present invention also proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0023] Compared with the prior art, the advantages of the present invention are as follows: This invention proposes an intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis. By constructing a command sequence within a preset time window, it can effectively capture the contextual dependencies between consecutive commands, thereby avoiding the problem of missed detection caused by relying solely on matching a single command.

[0024] This invention also achieves lightweight deployment on edge gateway devices by employing a sequence encoding model to vectorize and detect the similarity of instruction sequences, thereby improving detection efficiency and real-time performance. By introducing a caching mechanism, it generates summary fingerprints for low-risk sequences and reuses the recognition results, reducing redundant calculations and improving overall processing performance. Through a federated learning mechanism, each operation and maintenance gateway can achieve cross-domain aggregation of model parameters without sharing the original instruction data, thus improving the model's generalization ability in multiple scenarios. At the same time, the introduction of permission coefficients, time sensitivity coefficients, and context factors in the risk scoring process makes risk assessment more comprehensive and accurate. Attached Figure Description

[0025] Figure 1This is a flowchart of a method for intelligent identification of high-risk industrial operation and maintenance commands based on command sequence analysis, according to the present invention.

[0026] Figure 2 This is an architecture diagram of an intelligent identification system for high-risk industrial operation and maintenance commands based on command sequence analysis, according to the present invention. Detailed Implementation The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0027] The technical solution adopted in this embodiment is as follows: Figure 1 As shown, it includes the following steps: S1) The operation and maintenance gateway intercepts remote user input operation and maintenance commands in real time and constructs command sequences based on time windows; S2) The instruction sequence is vectorized and a sequence encoding model is used to generate the overall sequence representation vector; S3) Calculate the similarity between the overall sequence representation vector and the center vector of the high-risk sequence, and output the risk confidence score; S4) Calculate the comprehensive risk score by combining the authority coefficient, time sensitivity coefficient, and contextual factors; S5) Make decisions based on the comparison results of comprehensive risk scores and risk thresholds to identify high-risk instructions for industrial operation and maintenance.

[0028] Preferred, The formula for constructing the instruction sequence in step S1) is:

[0029] Where i represents the number of the currently intercepted instruction. For intercepted operation and maintenance instructions, For time window, Indication of instructions Execution time, express Instructions executed at that time To use the current instruction The instruction sequence constructed based on the reference, is executed before... The set of operation and maintenance instructions executed within a time period and its own composition.

[0030] Preferably, step S2) specifically includes the following steps: S2.1) Each instruction in the sequence Mapped to vector :

[0031] in, This represents an embedded function, which includes features such as instruction path, key parameters, and timestamps. S2.2) Modeling vector sequences based on sequence encoders: ,

[0032] in, For recurrent neural network encoder models, The vector represents the entire sequence; Preferably, the training objective of the sequence encoder model adopts a triplet loss function:

[0033] in, For anchor sequences, For positive sample sequences, For negative sample sequences, This is the interval hyperparameter.

[0034] This embodiment uses a triplet loss function, which reduces the vector distance between the "anchor sequence" and the "positive sample sequence" while increasing the distance with the "negative sample sequence". Through triplet loss pre-training, the model can learn a more compact and discriminative sequence vector representation, thereby reducing the complexity of similarity calculation.

[0035] Preferably, step S2) further includes each operation and maintenance gateway periodically uploading local sequence encoder model parameters to the cloud aggregation node, using a weighted federated aggregation algorithm based on sample size:

[0036] in, Indicates the first Each gateway in round Model parameters, This represents the number of local samples. A global model is formed in the cloud and broadcast to all gateway nodes for updates.

[0037] Through federated learning, multiple operation and maintenance gateways can share model parameter updates without exchanging raw instruction data, achieving knowledge sharing across scenarios and devices, and obtaining the following benefits: The cloud-based aggregation model can quickly integrate the optimization results of each gateway, avoiding long-term training for each gateway individually; the updated model is directly distributed to each gateway, reducing the time cost of repeated training; and in the detection phase, because the model learns more typical high-risk instruction features during the aggregation process, the similarity matching converges faster during inference, thereby improving detection efficiency.

[0038] Meanwhile, the aggregated global model contains high-risk instruction features from different environments, significantly improving generalization performance; it can avoid "overfitting" or "missed detection" caused by data scarcity in a single gateway; and it has a stronger ability to identify complex high-risk behaviors across scenarios (such as combined attacks), thereby improving detection accuracy.

[0039] Furthermore, as more gateways participate in training, the model gradually improves, forming a dynamically evolving security protection capability that can continuously optimize the detection process; and each gateway only uploads model parameters and does not expose raw command data, meeting the security compliance requirements of industrial operations and maintenance. Preferably, the similarity calculation formula in step S3) is:

[0040] in, The overall sequence representation vector, high-risk instruction sequence center vector library , For the i-th high-risk instruction in the high-risk instruction library, the highest similarity calculation result is used as the risk confidence of the sequence. .

[0041] Preferably, the similarity calculation process in step S3) further includes generating a sequence summary fingerprint of the instruction sequence with a risk confidence level higher than a preset value and storing it in a cache.

[0042] In this embodiment, the fingerprint calculation method is as follows: ,in For hash functions, For each instruction, a mapping vector is provided. The cache adopts an LRU strategy and is updated uniformly after recognition is completed.

[0043] Preferably, step S4) involves calculating the comprehensive risk by combining the risk confidence level with contextual factors:

[0044] in, For risk confidence level, This is the permission coefficient. The time sensitivity coefficient, This is the historical risk coefficient (the ratio of the number of abnormal operations to the total number of operations). As the risk confidence level weight, For the permission coefficient weight, The time sensitivity coefficient, Weighted by historical risk coefficient;

[0045] in, It represents the standard deviation of the time difference between adjacent instructions in an instruction sequence.

[0046] like Figure 2 As shown, this embodiment also proposes an intelligent identification system for high-risk industrial operation and maintenance commands based on command sequence analysis, including: a command acquisition module, a command modeling module, a high-risk matching module, a scoring module, a decision-making module, a caching module, a federated agent, and a cloud aggregation node; wherein: Command acquisition module: Used to listen for and capture remote operation commands through the operation and maintenance gateway in real time, and record the command execution time and parameter information in chronological order; Instruction modeling module: used to model instructions based on a preset time window. The collected consecutive instructions are aggregated into an instruction sequence, ensuring that the time span between the first and last instructions in the sequence does not exceed [a certain value]. ; Similarity detection module: used to vectorize the instruction sequence and generate an overall sequence representation vector through a sequence encoding model; then, the similarity of this vector with the center vector of historical high-risk instruction sequences is calculated to obtain the risk confidence. Scoring module: Used to calculate a comprehensive risk score by combining risk confidence level, authority coefficient, time sensitivity coefficient and contextual factors; Decision module: Based on the output of the scoring module, the risk score is compared with a preset threshold to make a decision on whether to intercept or allow passage. Cache module: Used to store the summary fingerprints of frequently occurring low-risk instruction sequences and their judgment results. When subsequent inputs hit the cache, the results can be reused directly, thereby accelerating the recognition process. Federation Agent: As a bridge between the operation and maintenance gateway and the cloud aggregation node, it is responsible for local model training and participates in the federated learning process to achieve knowledge sharing across devices; Cloud aggregation node: Used to receive model parameter updates from multiple operation and maintenance gateways, perform federated average aggregation to generate a global model, and distribute the aggregated model to each operation and maintenance gateway node to achieve continuous optimization of the overall model; The identification system is used to implement the steps of the above-mentioned intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis.

[0047] This embodiment also proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0048] In summary, the advantages of this embodiment are: This embodiment proposes an intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis. By constructing a command sequence within a preset time window, it can effectively capture the contextual dependencies between consecutive commands, thereby avoiding the problem of missed detection caused by relying solely on matching a single command.

[0049] This embodiment also employs a sequence encoding model to vectorize and detect the similarity of instruction sequences, enabling lightweight deployment on edge gateway devices and improving detection efficiency and real-time performance. By introducing a caching mechanism, summary fingerprints are generated for low-risk sequences and the recognition results are reused, reducing redundant calculations and improving overall processing performance. Through a federated learning mechanism, each operation and maintenance gateway achieves cross-domain aggregation of model parameters without sharing the original instruction data, thereby improving the model's generalization ability in multiple scenarios. At the same time, permission coefficients, time sensitivity coefficients, and context factors are introduced in the risk scoring process, making risk assessment more comprehensive and accurate.

[0050] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0051] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for intelligent identification of high-risk industrial operation and maintenance commands based on command sequence analysis, characterized in that, include: S1) The operation and maintenance gateway intercepts remote user input operation and maintenance commands in real time and constructs command sequences based on time windows; S2) The instruction sequence is vectorized and a sequence encoding model is used to generate the overall sequence representation vector; S3) Calculate the similarity between the overall sequence representation vector and the center vector of the high-risk sequence, and output the risk confidence score; S4) Calculate the comprehensive risk score by combining the authority coefficient, time sensitivity coefficient, and contextual factors; S5) Make decisions based on the comparison results of comprehensive risk scores and risk thresholds to identify high-risk instructions for industrial operation and maintenance.

2. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 1, characterized in that, The formula for constructing the instruction sequence in step S1) is: Where i represents the number of the currently intercepted instruction. For intercepted operation and maintenance instructions, For time window, Indication of instructions Execution time, express Instructions executed at that time To use the current instruction The instruction sequence constructed based on the reference, is executed before... The set of operation and maintenance instructions executed within a time period and its own composition.

3. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 2, characterized in that, Step S2) specifically includes the following steps: S2.1) Each instruction in the sequence Mapped to vector : in, This represents an embedded function, which includes features such as instruction path, key parameters, and timestamps. S2.2) Modeling vector sequences based on sequence encoders: ， in, For recurrent neural network encoder models, It is a vector representing the entire sequence.

4. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 3, characterized in that, The training objective of the sequence encoder model is to use a triplet loss function: in, For anchor sequences, For positive sample sequences, For negative sample sequences, This is the interval hyperparameter.

5. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 3, characterized in that, Step S2) further includes each operation and maintenance gateway periodically uploading local sequence encoder model parameters to the cloud aggregation node, using a weighted federated aggregation algorithm based on sample size: in, Indicates the first Each gateway in round Model parameters, This represents the number of local samples. A global model is formed in the cloud and broadcast to all gateway nodes for updates.

6. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 1, characterized in that, The similarity calculation formula in step S3) is: in, The overall sequence representation vector, high-risk instruction sequence center vector library , For the i-th high-risk instruction in the high-risk instruction library, the highest similarity calculation result is used as the risk confidence of the sequence. .

7. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 1, characterized in that, Step S3) The similarity calculation process also includes generating a sequence summary fingerprint for instruction sequences with a risk confidence level higher than a preset value and storing it in a cache.

8. The intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis according to claim 4, characterized in that, Step S4) The risk scoring method involves calculating the overall risk by combining the risk confidence level with contextual factors: in, For risk confidence level, This is the permission coefficient. The time sensitivity coefficient, This is the historical risk coefficient (the ratio of the number of abnormal operations to the total number of operations). As the risk confidence level weight, For the permission coefficient weight, The time sensitivity coefficient, Weighted by historical risk coefficient; in, It represents the standard deviation of the time difference between adjacent instructions in an instruction sequence.

9. A high-risk industrial operation and maintenance command intelligent identification system based on command sequence analysis, characterized in that, include: The system includes an instruction acquisition module, an instruction modeling module, a high-risk matching module, a scoring module, a decision-making module, a caching module, a federated agent, and a cloud aggregation node; among which: Command acquisition module: Used to listen for and capture remote operation commands through the operation and maintenance gateway in real time, and record the command execution time and parameter information in chronological order; Instruction modeling module: used to model instructions based on a preset time window. The collected consecutive instructions are aggregated into an instruction sequence, ensuring that the time span between the first and last instructions in the sequence does not exceed [a certain value]. ; Similarity detection module: used to vectorize the instruction sequence and generate an overall sequence representation vector through a sequence encoding model; then, the similarity of this vector with the center vector of historical high-risk instruction sequences is calculated to obtain the risk confidence. Scoring module: Used to calculate a comprehensive risk score by combining risk confidence level, authority coefficient, time sensitivity coefficient and contextual factors; Decision module: Based on the output of the scoring module, the risk score is compared with a preset threshold to make a decision on whether to intercept or allow passage. Cache module: Used to store the summary fingerprints of frequently occurring low-risk instruction sequences and their judgment results. When subsequent inputs hit the cache, the results can be reused directly, thereby accelerating the recognition process. Federation Agent: As a bridge between the operation and maintenance gateway and the cloud aggregation node, it is responsible for local model training and participates in the federated learning process to achieve knowledge sharing across devices; Cloud aggregation node: Used to receive model parameter updates from multiple operation and maintenance gateways, perform federated average aggregation to generate a global model, and distribute the aggregated model to each operation and maintenance gateway node to achieve continuous optimization of the overall model; The identification system is used to implement the steps of the intelligent identification method for high-risk industrial operation and maintenance commands based on command sequence analysis as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the intelligent identification method for high-risk industrial operation and maintenance instructions based on instruction sequence analysis as described in any one of claims 1 to 8.

Images