Safety assessment method and system for granary management platform

Abstract

The invention relates to the technical field of safety assessment, in particular to a safety assessment method and system for a granary management platform. According to the method, firstly, entities of a granary management platform serve as nodes, entity interaction information serves as edges, and a granary dynamic graph structure is constructed; then, based on a hierarchical training strategy, when samples are sufficient, a target granary data set is directly used for training, when the samples are insufficient, multi-source heterogeneous data of different regions of the same grain seeds and different grain seeds of the same region are introduced, generalization safety features of the grain seeds are enhanced, and then fine adjustment is performed by using target data, so that the precision and generalization of a granary safety evaluation model are ensured; then, dynamically adjusting a snapshot interception interval according to a granary load state, and accurately identifying four types of abnormal events in combination with multi-moment dynamic graph snapshots and snapshot increment information; and finally, the risk value is calculated based on the abnormal event, and the grade is matched, so that the evaluation result has quantification precision and practical operation guidance, the comprehensiveness and accuracy of the granary management platform safety evaluation are improved, and the evaluation efficiency is optimized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security assessment, in particular to a security assessment method and system of a granary management platform. BACKGROUND

[0002] The granary management platform is the core infrastructure for ensuring the safe and efficient operation of the whole process of grain purchase, storage and allocation. The platform security is directly related to the quality of grain storage, asset security and business continuity, so security assessment has become a key link in granary management.

[0003] However, the existing security assessment methods for the granary management platform focus on equipment operation state monitoring, single data integrity verification and other local dimensions, which is easy to lead to missed judgment. At the same time, the existing assessment models are mostly trained by using historical operation data of a single granary, while small and medium-sized granaries or newly built granaries generally have a problem of lack of security event samples, which leads to model overfitting and poor generalization ability, resulting in low security assessment efficiency and poor accuracy. SUMMARY

[0004] The purpose of the present application is to provide a security assessment method and system of a granary management platform.

[0005] The technical solution of the present application is as follows: A security assessment method of a granary management platform, comprising the following steps: S1, the subsystems, devices, data, interfaces and users in the target granary management platform are taken as nodes, and the data flow, control flow, interface call and permission access are taken as edges, and a granary dynamic graph structure is constructed; S2, a plurality of running event samples of the historical target granary management platform are obtained to form a target granary dataset; it is judged whether the number of samples in the target granary dataset is greater than a training sample number threshold, If yes, the target granary dataset is used to train a security assessment model to obtain a granary security assessment model, and S3 is executed; If no, the running event information of other granary management platforms in the same region and different grain types is obtained, and a multi-source heterogeneous dataset is made; the multi-source heterogeneous dataset is processed by generalization to obtain a generalized dataset; the security assessment model is trained by using the generalized dataset to obtain a generalized security assessment model; the granary security assessment model is trained by using the target granary dataset to obtain a granary security assessment model, and S3 is executed; S3, according to the corresponding interception interval time of the granary load state, the granary dynamic graph structure within a fixed time range is intercepted to obtain a plurality of dynamic graph snapshots; The plurality of dynamic graph snapshots and snapshot incremental information are processed by the granary security assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events and permission access abnormal events; Based on the data flow abnormal event, the control flow abnormal event, the interface call abnormal event, the permission access abnormal event, the target grain warehouse management platform security risk value is calculated, the corresponding security risk level is matched, and the security evaluation result is formed.

[0006] In S2, when training the security evaluation model using the generalized data set, data of the same grain and different regions is used as positive samples, and data of the same region and different grains is used as negative samples. A double-constraint contrast smoothing loss function is used for training to enable the model to learn the common security features of grain and ignore regional differences.

[0007] The double-constraint contrast smoothing loss is based on the grain commonality contrast loss, the regional noise suppression loss, and the feature smoothing loss.

[0008] In the process of the grain warehouse security evaluation model in S3: the node feature matrix and the edge feature matrix of each dynamic graph snapshot are fused to obtain multiple snapshot fusion features; each snapshot fusion feature is processed by a first fully connected layer to identify abnormal events in each dynamic graph snapshot, and the abnormal event static analysis result containing each abnormal event type and the corresponding probability value is obtained after being summarized; the snapshot incremental information is processed by a spatial attention and a gated recurrent unit, and then processed by a second fully connected layer to obtain the abnormal event dynamic analysis result containing the abnormal event type and the corresponding probability value; the abnormal event static analysis result and the abnormal event dynamic analysis result are summarized, and the number and probability mean of each abnormal event type are obtained to obtain the data flow abnormal event, the control flow abnormal event, the interface call abnormal event, and the permission access abnormal event.

[0009] In the edge feature matrix, the data flow edge feature is the weighted sum of the transmission rate fluctuation rate, the data packet loss rate, and the encryption verification pass rate; the control flow edge feature is the weighted sum of the instruction feedback error rate, the execution delay, and the retry trigger rate; the interface call edge feature is the weighted sum of the abnormal return code proportion and the call frequency deviation degree; and the permission access edge feature is the weighted sum of the permission mismatch degree, the temporary authorization proportion, and the sensitive access period abnormality rate.

[0010] The target grain warehouse management platform security risk value in S3 is based on the event-based risk of abnormal events, the propagation risk, and the coordination risk.

[0011] The generalization processing in S2 can be achieved by heterogeneous format normalization, semantic normalization, and feature generalization enhancement processing.

[0012] A security evaluation system for a grain warehouse management platform is used to implement the security evaluation method of the grain warehouse management platform, comprising: The granary dynamic graph structure generation module is configured to construct a granary dynamic graph structure by taking subsystems, devices, data, interfaces and users in the target granary management platform as nodes and taking data flow, control flow, interface calling and permission access as edges. The granary safety evaluation model generation module is configured to obtain a plurality of running event samples of a historical target granary management platform to form a target granary data set; determine whether the number of samples in the target granary data set is greater than a training sample number threshold; if yes, train a safety evaluation model by using the target granary data set to obtain a granary safety evaluation model and execute the safety evaluation result generation module; if no, obtain running event information of other granary management platforms in different regions for the same grain or in the same region for different grains to make a multi-source heterogeneous data set; perform generalization processing on the multi-source heterogeneous data set to obtain a generalized data set; train the safety evaluation model by using the generalized data set to obtain a generalized safety evaluation model; train the generalized safety evaluation model by using the target granary data set to obtain a granary safety evaluation model and execute the safety evaluation result generation module. The safety evaluation result generation module is configured to intercept a granary dynamic graph structure in a fixed time range according to a corresponding interception interval time of a granary load state to obtain a plurality of dynamic graph snapshots; perform processing on the plurality of dynamic graph snapshots and snapshot increment information by using the granary safety evaluation model to obtain data flow abnormal events, control flow abnormal events, interface calling abnormal events and permission access abnormal events; calculate a safety risk value of the target granary management platform based on the data flow abnormal events, the control flow abnormal events, the interface calling abnormal events and the permission access abnormal events, match a corresponding safety risk level and form a safety evaluation result.

[0013] A safety evaluation device of a granary management platform includes a processor and a memory, wherein the processor implements the safety evaluation method of the granary management platform described above when executing the computer program stored in the memory.

[0014] A computer readable storage medium for storing a computer program, wherein the computer program is executed by a processor to implement the safety evaluation method of the granary management platform described above.

[0015] The beneficial effects of the present application are as follows: This invention provides a security assessment method for a grain warehouse management platform. First, it constructs a dynamic graph structure for the grain warehouse by treating the platform's subsystems, equipment, data, interfaces, and users as nodes, and data flow, control flow, interface calls, and access permissions as edges. This achieves full-link modeling of the physical entities and logical interactions of the grain warehouse management platform. Then, it employs a hierarchical training strategy that prioritizes target data and supplements it with multi-source data. When sufficient samples are available, the model is directly trained using the target grain warehouse dataset to ensure it closely reflects the characteristics of the warehouse. When samples are insufficient, multi-source heterogeneous data from different regions for the same grain type and different grain types within the same region are introduced. After generalization processing to enhance the common safety features of the grain types, the model is then fine-tuned using the target data. This approach addresses the overfitting problem caused by the scarcity of samples from a single grain depot, and enhances the model's adaptability to different scenarios through multi-source data generalization, ensuring the accuracy and generalization of the grain depot safety assessment model. Next, the snapshot interval is dynamically adjusted according to the grain depot's load status, ensuring real-time anomaly monitoring while avoiding wasted computing power. Furthermore, by combining multi-time dynamic graph snapshots and snapshot increment information, four types of abnormal events are accurately identified, effectively capturing temporal correlations and cascading risks. Finally, risk values ​​are calculated and levels are matched based on abnormal events, giving the assessment results both quantitative accuracy and practical guidance, improving the comprehensiveness and accuracy of the grain depot management platform's safety assessment, and optimizing assessment efficiency. Attached Figure Description

[0016] The solutions and advantages of this application will become clear to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of the invention.

[0017] In the attached diagram: Figure 1 This is a flowchart illustrating the method of this embodiment. Detailed Implementation

[0018] Exemplary embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings.

[0019] Example 1 This embodiment provides a security assessment method for a grain storage management platform. (See also...) Figure 1 This includes the following steps: S1. Take the subsystems, equipment, data, interfaces and users in the target grain warehouse management platform as nodes, and take the data flow, control flow, interface call and permission access as edges to construct a dynamic graph structure of the grain warehouse. S2. Obtain multiple operational event samples from the historical target grain depot management platform to form a target grain depot dataset; determine whether the number of samples in the target grain depot dataset is greater than the training sample size threshold. If it is greater, train a safety assessment model using the target grain depot dataset to obtain a grain depot safety assessment model, and proceed to S3; if it is less than the threshold, obtain operational event information from other grain depot management platforms for the same grain type in different regions and different grain types in the same region to create a multi-source heterogeneous dataset; generalize the multi-source heterogeneous dataset to obtain a generalized dataset; train a safety assessment model using the generalized dataset to obtain a generalized safety assessment model; train a generalized safety assessment model using the target grain depot dataset to obtain a grain depot safety assessment model, and proceed to S3. S3. Based on the corresponding interception interval time according to the grain warehouse load status, the dynamic graph structure of the grain warehouse within a fixed time range is intercepted to obtain multiple dynamic graph snapshots; the multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse safety assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events; based on the data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events, the safety risk value of the target grain warehouse management platform is calculated, and the corresponding safety risk level is matched to form the safety assessment result.

[0020] The specific steps are detailed below.

[0021] S1. Take the subsystems, equipment, data, interfaces and users in the target grain warehouse management platform as nodes, and take the data flow, control flow, interface call and permission access as edges to construct a dynamic graph structure of the grain warehouse.

[0022] By treating the subsystems, equipment, data, interfaces, and users of the grain warehouse management platform as nodes, and data flow, control flow, interface calls, and access permissions as edges, a full-link model of the physical entities and logical interactions of the grain warehouse management platform can be achieved. Compared with the traditional single-dimensional assessment that only focuses on the operating status of equipment or the integrity of data, it can capture cross-dimensional abnormal information, eliminate isolated assessment blind spots, and facilitate the improvement of the accuracy and efficiency of subsequent safety assessments.

[0023] The grain warehouse management platform consists of multiple subsystems, including: a warehouse management subsystem (responsible for managing grain storage, outbound operations, inventory, and transfer); an environmental monitoring subsystem (used to monitor environmental parameters such as temperature, humidity, gas concentration, and pests in the grain warehouse in real time through a sensor network); a security monitoring subsystem (used for video surveillance, access control systems, and intrusion detection); an equipment control subsystem (used to control ventilation fans, air conditioners, dehumidifiers, and fumigation equipment); a business management subsystem (involving business processes such as grain purchase and sale, inventory statistics, and financial settlement); and an operation and maintenance management subsystem (used for the maintenance and management of equipment in the grain warehouse, including equipment status monitoring and maintenance records).

[0024] Each subsystem in the platform contains several devices to support the normal operation of the subsystem.

[0025] The platform generates data during its operation (information generated throughout the entire platform process), such as acquisition data, storage data, device data, and user operation data.

[0026] In the platform, interfaces are the interaction channels connecting different entities, including communication interfaces between devices and subsystems, collaboration interfaces between subsystems, and interfaces for interfacing with external systems.

[0027] Users are the main operators of the platform, and they are divided into administrators, maintenance personnel, data collection personnel, and supervisors according to their roles.

[0028] Data flow refers to the information transmission behavior between nodes, such as: devices transmitting temperature and humidity data to storage monitoring, and the acquisition subsystem writing acquisition records to data nodes.

[0029] Control flow refers to command-based interactive behaviors, such as the storage monitoring subsystem sending start / stop commands to the ventilation fan, or the administrator issuing prevention commands to the security subsystem.

[0030] Interface calls are node interactions implemented through interfaces, such as the acquisition subsystem calling the data management subsystem's interface to query historical data, and maintenance personnel accessing device status through terminal interfaces.

[0031] Access permissions refer to user-defined node operations, such as the access permissions of personnel to access the acquisition subsystem for data entry, or the access permissions of supervisors to view data nodes.

[0032] S2. Obtain multiple operational event samples from the historical target grain depot management platform to form a target grain depot dataset; determine whether the number of samples in the target grain depot dataset is greater than the training sample size threshold. If it is greater, train a safety assessment model using the target grain depot dataset to obtain a grain depot safety assessment model, and proceed to S3; if it is less than the threshold, obtain operational event information from other grain depot management platforms for the same grain type in different regions and different grain types in the same region to create a multi-source heterogeneous dataset; generalize the multi-source heterogeneous dataset to obtain a generalized dataset; train a safety assessment model using the generalized dataset to obtain a generalized safety assessment model; train a generalized safety assessment model using the target grain depot dataset to obtain a grain depot safety assessment model, and proceed to S3.

[0033] By employing a hierarchical training strategy that prioritizes target data and supplements it with multi-source data, the model is trained directly using the target grain warehouse dataset when there are sufficient samples, ensuring that the model closely matches the characteristics of the warehouse. When there are insufficient samples, multi-source heterogeneous data from different regions for the same grain type and different grain types in the same region are introduced. After generalization processing to strengthen the common safety features of grain types, the model is then fine-tuned using the target data. This approach not only solves the problem of model overfitting caused by the scarcity of samples from a single grain warehouse, but also improves the model's adaptability to different scenarios through multi-source data generalization, ensuring the accuracy and generalization of the safety assessment model.

[0034] First, multiple operational event samples from the historical target grain warehouse management platform were obtained, including normal event samples and abnormal event samples, forming a target grain warehouse dataset applicable to the specific environment of the target grain warehouse.

[0035] Then, determine whether the number of samples in the target grain warehouse dataset is greater than the threshold for the number of training samples.

[0036] If the value is greater than the target grain warehouse dataset, it indicates that the training data for the grain warehouse management platform is sufficient. Therefore, the safety assessment model is directly trained using the target grain warehouse dataset to obtain the grain warehouse safety assessment model, and the safety assessment operation in S3 is executed.

[0037] If the value is not greater than the target value, obtain the operation event information of other grain warehouse management platforms and create a multi-source heterogeneous dataset. The multi-source heterogeneous dataset is generalized to obtain a generalized dataset. The generalized dataset is used to train a safety assessment model to obtain a generalized safety assessment model. The target grain warehouse dataset is used to train a generalized safety assessment model to obtain a grain warehouse safety assessment model. The specific steps are detailed below.

[0038] Step 1: Collect operational event information for different regions with the same grain type and different grain types within the same region to ensure data heterogeneity while preserving relevance. After data filtering based on business relevance and risk type matching, redundant data irrelevant to the target grain warehouse is removed. The filtered data is then aligned dimensionally with the target grain warehouse dataset (including but not limited to using timestamp + node type + risk event methods). The unified fields are collection time, grain type, equipment ID, event type, feature parameters, and risk label to form a multi-source heterogeneous dataset.

[0039] Business relevance is calculated using the following formula: , To determine the business relevance between the grain warehouse data to be screened and the target grain warehouse, The first in the target grain depot business parameter sequence i Several parameters (such as purchase volume, ventilation duration). The first in the sequence of grain warehouse business parameters to be screened i One parameter, I The total number of parameters in the sequence. , These are the mean values ​​of the target grain depot business parameter series and the mean values ​​of the grain depot business parameter series to be screened. Highly relevant data are retained, while lowly relevant data are removed.

[0040] Step 2: The multi-source heterogeneous dataset undergoes heterogeneous format normalization, semantic normalization, and feature generalization enhancement to obtain a generalized dataset. Heterogeneous format normalization is achieved by standardizing the numerical, text, and structured data types in the multi-source heterogeneous dataset. Semantic normalization is based on a grain storage domain knowledge dictionary (including mappings for equipment, risk, and business) to calculate semantic similarity (cosine similarity) between the text to be aligned and the standard semantics, achieving alignment. Feature generalization enhancement includes, but is not limited to, using principal component analysis.

[0041] Step 3: Train the safety assessment model using the generalized dataset to obtain the generalized safety assessment model. When training the safety assessment model using the generalized dataset, data from different regions but the same grain type are used as positive samples, and data from different grain types within the same region are used as negative samples. A dual-constraint contrastive smoothing loss function is used to control the training, allowing the model to learn common safety features related to grain types while ignoring regional differences. This reduces the complexity of the feature space and reserves adaptation space for subsequent fine-tuning of the target grain warehouse dataset, ultimately achieving the goal of excellent generalization training performance, fast fine-tuning convergence, and high accuracy.

[0042] The formula for calculating the dual-constraint contrastive smoothing loss is as follows: , , , , These are respectively: dual-constraint contrast smoothing loss, grain species commonality contrast loss, regional noise suppression loss, and feature smoothing loss. , , These are commonality comparison weight, regional noise suppression weight, and feature smoothing weight, respectively.

[0043] Common losses of grain varieties The calculation formula is as follows: , For the positive sample set, The total number of negative samples. , , Samples i , j , k eigenvectors, MFor grain type safety level masks, only safety features related to the grain type, such as moisture, temperature, and mold alarms, are retained with a mask value of 1. Region-specific features (such as local device codes) are masked with a value of 0. To obtain a positive sample temperature coefficient, reduce the distance within the same grain variety. The negative sample temperature coefficient amplifies the distance between different grain species. Using the cosine similarity function, the commonality comparison loss of grain varieties allows the model to learn the core safety rules of grain varieties. These common features can be directly used as the basic features for subsequent fine-tuning of the specific characteristics of the target grain warehouse.

[0044] Area noise suppression loss The calculation formula is as follows: , , These are the regional feature vectors and the common feature vectors of grain varieties (masked). M (Filtered features) This is a regional characteristic difference function. , As an entropy function, the regional noise suppression loss minimizes the mutual information between regional features and grain type features, making the common grain type features learned by the model independent of the region. This removes interference from regional differences, making the common features purer. Subsequent fine-tuning only needs to focus on the characteristics of the target grain warehouse, reducing the difficulty of fine-tuning.

[0045] Feature smoothing loss The calculation formula is as follows: , The trace function of a matrix. For the eigenvalue functions of the Hessian matrix, The matrix formed for all samples, This represents the perturbation value. The smoother the feature space, the more precise the parameter adjustments during fine-tuning can be to better suit the target bin's specificity, thus improving generalization performance.

[0046] Finally, a generalized safety assessment model is trained using the target grain warehouse dataset to obtain a grain warehouse safety assessment model applicable to the target grain warehouse, and S3 is executed.

[0047] S3. Based on the corresponding interception interval time according to the grain warehouse load status, the dynamic graph structure of the grain warehouse within a fixed time range is intercepted to obtain multiple dynamic graph snapshots; the multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse safety assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events; based on the data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events, the safety risk value of the target grain warehouse management platform is calculated, and the corresponding safety risk level is matched to form the safety assessment result.

[0048] The snapshot capture interval is dynamically adjusted according to the grain warehouse load status, which not only ensures the real-time monitoring of anomalies during core business periods but also avoids wasting computing power. Combined with multi-time dynamic graph snapshots and snapshot incremental information input models, four types of abnormal events are accurately identified, effectively capturing temporal correlations and chain risks. Based on abnormal events, risk values ​​are calculated and matched levels, making the assessment results both quantitatively accurate and practically instructive. This improves the comprehensiveness and accuracy of safety assessments, optimizes assessment efficiency, and fits the actual scenario of dynamic changes in grain warehouse operations.

[0049] First, by monitoring the number of subsystems in operation and the peak data flow in the target grain warehouse management platform, the load status value is calculated to determine the grain warehouse load status. The grain warehouse load status is divided into high load status (purchase season or equipment maintenance period), medium load status (storage scheduling period), and low load period (routine storage period). Based on the corresponding interception interval time of the grain warehouse load status, the dynamic graph structure of the grain warehouse within a fixed time range is intercepted (complete node-edge information is intercepted and a snapshot is generated), resulting in multiple dynamic graph snapshots.

[0050] The formulas for calculating the above load state values ​​are as follows: , for t The load status value at any given time. for t The number of subsystems running at any given time. The total number of subsystems, for t Peak data stream at any given moment The highest historical data flow peak value indicates the highest load status level and the easier it is to approach a high load status.

[0051] Then, multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse safety assessment model to obtain data flow anomaly events, control flow anomaly events, interface call anomaly events, and access permission anomaly events. The snapshot increment information is specifically a feature matrix formed by the change information of two consecutive dynamic graph snapshots (which can be obtained by comparing node and edge information).

[0052] The specific details of the process of handling multiple dynamic graph snapshots and snapshot increment information in the grain warehouse safety assessment model are as follows.

[0053] Step 1: Fuse the node feature matrix and edge feature matrix of each dynamic graph snapshot to obtain multiple snapshot fused features, along with snapshot incremental information, as input to the grain warehouse safety assessment model.

[0054] In the node feature matrix, the subsystem node feature is a weighted sum of load fluctuation coefficient and abnormal command response ratio. Load fluctuation coefficient = maximum load value / minimum load value within a fixed time frame; abnormal command response ratio = number of abnormal control flow commands / total number of commands (can be used to detect data flow anomalies). The device node feature is a weighted sum of operating parameter deviation and fault propagation warning value. Operating parameter deviation = (real-time value - standard value) / standard value (can be used to detect data flow anomalies); fault propagation warning value = number of associated device anomalies / total number of associated devices. The data node feature is a weighted sum of tampering warning value and sensitive data marking rate. Tampering warning value = hash check inconsistency. Number of transmissions / Total number of transmissions (can be used to detect abnormal data streams); Sensitive data marking rate = Sensitive data volume / Total data volume (can be used to detect abnormal access permissions); Interface node characteristics are the weighted sum of response latency gradient and cross-domain call ratio; Response latency gradient = Current latency - Average latency of the previous 3 calls (can be used to detect abnormal interface calls); Cross-domain call ratio = Number of cross-subsystem calls / Total number of calls; User node characteristics are the weighted sum of sensitive operation ratio and abnormal operation behavior degree; Abnormal operation behavior degree = Edit distance between the current operation sequence and the historical normal sequence (can be used to detect abnormal access permissions); Sensitive operation ratio = Number of sensitive data accesses / Total number of operations.

[0055] In the edge feature matrix, the data flow edge feature is the weighted sum of transmission rate fluctuation, data packet loss rate, and encryption verification pass rate; the control flow edge feature is the weighted sum of instruction feedback error rate, execution delay, and retry trigger rate; the interface call edge feature is the weighted sum of the proportion of abnormal return codes and the deviation of call frequency; and the permission access edge feature is the weighted sum of permission mismatch, temporary authorization proportion, and abnormal rate during sensitive access periods.

[0056] Step 2: Each snapshot fusion feature is processed by the first fully connected layer to quickly identify four types of abnormal events in each dynamic graph snapshot. The results are then summarized to obtain static analysis results of abnormal events containing each abnormal event type and its corresponding probability value. The abnormal event types include data flow abnormal events, control flow abnormal events, interface call abnormal events, and access permission abnormal events. At the same time, the snapshot incremental information is processed by spatial attention and gated loop units, and then processed by the second fully connected layer to obtain dynamic analysis results of abnormal events containing the abnormal event types and their corresponding probability values.

[0057] Step 3: Summarize the static analysis results and dynamic analysis results of abnormal events, the number and average probability of each type of abnormal event, and obtain the data flow abnormal events (including probability values), control flow abnormal events (including probability values), interface call abnormal events (including probability values), and access control abnormal events (including probability values).

[0058] Finally, based on data flow anomaly events, control flow anomaly events, interface call anomaly events, and permission access anomaly events, the security risk value of the target grain warehouse management platform is calculated, and the corresponding security risk level is matched to form a security assessment result.

[0059] The security risk value of the target grain warehouse management platform is obtained based on the event-based risk, propagation risk, and collaborative risk of abnormal events. The specific calculation formula is as follows: , , , , These are the target grain warehouse management platform safety risk values, the first m The event-based risk value, propagation risk value, and collaborative risk value of anomaly events.

[0060] Event Base Risk Value The calculation formula is as follows: , , , For the first m The impact weight of each type of abnormal event is determined based on the degree of impact of the abnormal event type on grain warehouse safety. For the first m The mean probability of a class of abnormal events. For the first m Density correction factor for abnormal events. For the first m Total number of exception events, No. m Maximum allowed total number of exception events of this type For the first m The probability stability coefficient of a type of abnormal event measures the degree of fluctuation in the probability mean; the larger the value, the stronger the certainty of the risk. For the first m The standard deviation of the probability of anomalies; the more critical the type of anomaly, the higher the frequency of its occurrence in the short term, and the more stable its high probability of persistence, the higher the basic risk value of the anomaly and the worse the security of the grain warehouse management platform.

[0061] Transmission risk value The calculation formula is as follows: , For the first m Class exception to the first n The propagation coefficient of a type of abnormal event can be obtained based on historical data statistics. The shorter the time interval between the occurrence of two types of abnormal events, the greater the propagation coefficient.

[0062] Collaborative Risk Value The calculation formula is as follows: , The amplification factor is the synergistic amplification factor; the more types of abnormal events that occur simultaneously, the larger the synergistic amplification factor. This represents the number of abnormal event types that occur simultaneously. When multiple types of abnormalities occur at the same time, the risk exhibits a synergistic amplification effect.

[0063] This embodiment also provides a security assessment system for a grain storage management platform, used to implement the aforementioned security assessment method for the grain storage management platform, including: The grain warehouse dynamic graph structure generation module is used to construct the grain warehouse dynamic graph structure by taking the subsystems, equipment, data, interfaces and users in the target grain warehouse management platform as nodes and the data flow, control flow, interface call and permission access as edges. The grain warehouse safety assessment model generation module is used to acquire multiple operational event samples from historical target grain warehouse management platforms, forming a target grain warehouse dataset. It determines whether the number of samples in the target grain warehouse dataset exceeds a training sample threshold. If it does, it trains a safety assessment model using the target grain warehouse dataset, obtaining the grain warehouse safety assessment model, and executes the safety assessment result generation module. If the number of samples is less than the threshold, it acquires operational event information from other grain warehouse management platforms for the same grain type in different regions and different grain types in the same region, creating a multi-source heterogeneous dataset. The multi-source heterogeneous dataset undergoes generalization processing to obtain a generalized dataset. A safety assessment model is trained using the generalized dataset to obtain a generalized safety assessment model. Finally, using the target grain warehouse dataset, the generalized safety assessment model is trained again to obtain the grain warehouse safety assessment model, and the safety assessment result generation module executes. The security assessment result generation module is used to extract the dynamic graph structure of the grain warehouse within a fixed time range according to the interception interval corresponding to the grain warehouse load status, and obtain multiple dynamic graph snapshots. The multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse security assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events. Based on the data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events, the security risk value of the target grain warehouse management platform is calculated, and the corresponding security risk level is matched to form the security assessment result.

[0064] This embodiment also provides a security assessment device for a grain storage management platform, including a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the aforementioned security assessment method for the grain storage management platform.

[0065] This embodiment also provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned security assessment method for the grain warehouse management platform.

[0066] This embodiment provides a security assessment method for a grain warehouse management platform. First, it constructs a dynamic graph structure for the grain warehouse by treating the platform's subsystems, equipment, data, interfaces, and users as nodes, and data flow, control flow, interface calls, and access permissions as edges. This achieves full-link modeling of the physical entities and logical interactions of the grain warehouse management platform. Then, it employs a hierarchical training strategy that prioritizes target data and supplements it with multi-source data. When sufficient samples are available, the model is directly trained using the target grain warehouse dataset to ensure it closely reflects the characteristics of the warehouse. When samples are insufficient, multi-source heterogeneous data from different regions for the same grain type and different grain types within the same region are introduced. After generalization processing to enhance the common security features of the grain types, the model is then fine-tuned using the target data. This approach addresses the overfitting problem caused by the scarcity of samples from a single grain depot, and enhances the model's adaptability to different scenarios through multi-source data generalization, ensuring the accuracy and generalization of the grain depot safety assessment model. Next, the snapshot interval is dynamically adjusted according to the grain depot's load status, ensuring real-time anomaly monitoring while avoiding wasted computing power. Combining multi-time dynamic snapshots and incremental snapshot information, four types of abnormal events are accurately identified, effectively capturing temporal correlations and cascading risks. Finally, risk values ​​are calculated and levels are matched based on abnormal events, giving the assessment results both quantitative accuracy and practical guidance, improving the comprehensiveness and accuracy of the grain depot management platform's safety assessment, and optimizing assessment efficiency.

Claims

1. A safety assessment method for a grain warehouse management platform, characterized in that, Includes the following steps: S1. Take the subsystems, equipment, data, interfaces and users in the target grain warehouse management platform as nodes, and take the data flow, control flow, interface call and permission access as edges to construct a dynamic graph structure of the grain warehouse. S2. Obtain multiple operational event samples from the historical target grain warehouse management platform to form the target grain warehouse dataset; determine whether the number of samples in the target grain warehouse dataset is greater than the training sample size threshold. If the value is greater than the target grain warehouse dataset, train a safety assessment model to obtain the grain warehouse safety assessment model, and then execute S3. If the data is too large, obtain the operational event information of different regions for the same grain type and different grain types in the same region from other grain storage management platforms, and create a multi-source heterogeneous dataset; The multi-source heterogeneous dataset is generalized to obtain a generalized dataset; a safety assessment model is trained using the generalized dataset to obtain a generalized safety assessment model; a generalized safety assessment model is trained using the target grain warehouse dataset to obtain a grain warehouse safety assessment model, and S3 is executed. S3. Based on the corresponding time interval of the grain warehouse load status, extract the dynamic graph structure of the grain warehouse within a fixed time range to obtain multiple dynamic graph snapshots; Multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse safety assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events, and permission access abnormal events; Based on data flow anomaly events, control flow anomaly events, interface call anomaly events, and permission access anomaly events, the security risk value of the target grain warehouse management platform is calculated, and the corresponding security risk level is matched to form a security assessment result.

2. The safety assessment method for a grain storage management platform according to claim 1, characterized in that, In S2, when training the safety assessment model using a generalized dataset, data from different regions with the same grain type are used as positive samples, and data from different grain types in the same region are used as negative samples. The training is controlled by a dual-constraint contrastive smoothing loss function, which allows the model to learn common safety features related to grain types and ignore regional differences.

3. The safety assessment method for a grain storage management platform according to claim 2, characterized in that, The dual-constraint contrast smoothing loss is derived from the commonality contrast loss of grain species, the regional noise suppression loss, and the feature smoothing loss.

4. The safety assessment method for a grain storage management platform according to claim 1, characterized in that, During the processing of the S3 grain silo safety assessment model: The node feature matrix and edge feature matrix of each dynamic graph snapshot are fused to obtain multiple snapshot fused features; Each snapshot fusion feature is processed by the first fully connected layer to identify abnormal events in each dynamic graph snapshot. The summaries are then used to obtain static analysis results of abnormal events, which include the type of each abnormal event and its corresponding probability value. After the snapshot incremental information is processed by spatial attention and gated recurrent units, it is processed by the second fully connected layer to obtain the dynamic analysis results of abnormal events, which include the abnormal event type and the corresponding probability value. By summarizing the static and dynamic analysis results of abnormal events, and the number and average probability of each type of abnormal event, we can obtain data flow abnormal events, control flow abnormal events, interface call abnormal events, and access control abnormal events.

5. The safety assessment method for a grain storage management platform according to claim 4, characterized in that, In the edge feature matrix, The data stream edge characteristics are a weighted sum of transmission rate volatility, data packet loss rate, and encryption verification pass rate; The control flow edge features are the weighted sum of instruction feedback error rate, execution latency, and retry trigger rate; the interface call edge features are the weighted sum of the proportion of exception return codes and the deviation of call frequency. The access permission edge features are a weighted sum of permission mismatch, temporary authorization ratio, and abnormal rate during sensitive access periods.

6. The safety assessment method for a grain storage management platform according to claim 1, characterized in that, In S3, the security risk value of the target grain warehouse management platform is obtained based on the event-based risk, propagation risk, and collaborative risk of abnormal events.

7. The safety assessment method for a grain storage management platform according to claim 1, characterized in that, In S2, generalization operations can be achieved through heterogeneous format normalization, semantic normalization, and feature generalization enhancement.

8. A security assessment system for a grain storage management platform, used to implement the security assessment method for the grain storage management platform as described in claim 1, characterized in that, include: The grain warehouse dynamic graph structure generation module is used to construct the grain warehouse dynamic graph structure by taking the subsystems, equipment, data, interfaces and users in the target grain warehouse management platform as nodes and the data flow, control flow, interface call and permission access as edges. The grain warehouse safety assessment model generation module is used to obtain multiple operational event samples from the historical target grain warehouse management platform to form a target grain warehouse dataset; it determines whether the number of samples in the target grain warehouse dataset is greater than the training sample number threshold. If it is greater, it uses the target grain warehouse dataset to train the safety assessment model, obtains the grain warehouse safety assessment model, and executes the safety assessment result generation module. If the data is too large, obtain the operational event information of different regions for the same grain type and different grain types in the same region from other grain storage management platforms, and create a multi-source heterogeneous dataset; The multi-source heterogeneous dataset is generalized to obtain a generalized dataset; a safety assessment model is trained using the generalized dataset to obtain a generalized safety assessment model; a generalized safety assessment model is trained using the target grain warehouse dataset to obtain a grain warehouse safety assessment model; and the safety assessment result generation module is executed. The safety assessment result generation module is used to extract the dynamic graph structure of the grain warehouse within a fixed time range according to the corresponding interception interval time based on the grain warehouse load status, and obtain multiple dynamic graph snapshots; the multiple dynamic graph snapshots and snapshot increment information are processed by the grain warehouse safety assessment model to obtain data flow abnormal events, control flow abnormal events, interface call abnormal events and permission access abnormal events; Based on data flow anomaly events, control flow anomaly events, interface call anomaly events, and permission access anomaly events, the security risk value of the target grain warehouse management platform is calculated, and the corresponding security risk level is matched to form a security assessment result.

9. A safety assessment device for a grain warehouse management platform, characterized in that, It includes a processor and a memory, wherein the processor implements the security assessment method for the grain storage management platform as described in any one of claims 1-7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the security assessment method of the grain storage management platform as described in any one of claims 1-7.

Images