Industrial internet defense system and method based on local adaptive graph neural network

Abstract

The invention discloses an industrial internet defense system and method based on a local adaptive graph neural network, and the method comprises the steps: carrying out the data initialization, constructing a connection relation of industrial internet equipment into a graph structure, carrying out the normalization of an adjacent matrix, and initializing a learning graph; defining a model optimization loss objective function; adopting a GCN graph convolutional network or an SGC simplified graph convolutional network to train a node classification model; carrying out gradient analysis and poisoning edge identification, and carrying out direction derivation on loss to obtain a gradient connected with a local important node; according to the gradient, selecting the anchor nodes which are most connected with each target node as a cutting set, and according to the cutting set, cutting and updating the graph structure; and inputting the updated graph structure into the model again for training, and repeating the operation and cutting process until the training function converges. According to the scheme, the stability of an industrial internet topological structure and the accuracy of model prediction are kept in the face of graph poisoning attacks.

Description

Technical Field

[0001] This invention relates to the field of internet defense technology, and in particular to an industrial internet defense system and method based on a local adaptive graph neural network. Background Technology

[0002] With the development of the Industrial Internet of Things (IIoT), a massive number of industrial devices, sensors, and control terminals have formed a complex interconnected network structure. To achieve intelligent manufacturing, process monitoring, and safety control, Graph Neural Networks (GNNs) are widely used for topology modeling, node state prediction, and anomaly detection in industrial networks.

[0003] However, existing GNNs exhibit significant vulnerabilities to adversarial attacks: attackers can mislead model predictions by injecting forged edges or altering node connections into the network topology, causing false alarms or missed detections in monitoring systems, leading to scheduling chaos or even security incidents. Current defense methods primarily employ a global optimization approach, which has the following drawbacks: 1. Ignoring the characteristic that attacks are concentrated on local critical nodes (such as core control devices); 2. Global defense disrupts the structure of unattacked areas; 3. Performance degradation occurs in the absence of attacks, making it difficult to meet the high availability requirements of industrial environments.

[0004] Therefore, an adaptive defense framework oriented towards local nodes is needed, which can both identify and remove poisoned edges while maintaining topological integrity and model performance. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides an industrial internet defense system and method based on local adaptive graph neural networks, which maintains the stability of the industrial internet topology and the accuracy of model predictions when facing graph poisoning attacks.

[0006] This invention is achieved using the following technical solution: The first aspect is an industrial internet defense method based on local adaptive graph neural networks, which includes the following steps: Step S1: Data initialization, constructing the connection relationships of industrial internet devices into a graph structure. , For a set of nodes, Let be the set of edges. For the node feature matrix; for the adjacency matrix Normalize and initialize the learning graph. , ; Step S2: Define the model optimization objective function, including traditional node classification loss, structural constraint loss, and node degree constraint loss; Step S3: Train the node classification model using a GCN graph convolutional network or a SGC simplified graph convolutional network; Step S4: Gradient analysis and poisoned edge identification. The loss is directionally differentiated to obtain the gradient of the connection with the locally important nodes. Step S5: Select the node with the longest connection to each target node based on the gradient. Each anchor node is used as a clipping set. Clipping is performed based on the clipping set, and the graph structure is updated. Step S6: Re-input the updated graph structure into the model for training, and repeat steps S1 to S5 and the pruning process until the training function converges.

[0007] Specifically, the objective function in step S2 is expressed as: ; Among them, classification loss The traditional node classification loss, i.e., the cross-entropy between predicted and true values, is expressed as: ; The introduced structural constraint loss is expressed as: ; The node degree constraint loss is expressed as: ; in, These are the control parameters for the loss value. The number of perturbation edges that need to be pruned for a single target node; The threshold parameter representing the pruning of a single node. for Confidence level of its true label.

[0008] Specifically, in step S3 of model training, the propagation formula for each layer is: ; The probability of the predicted node class in the output layer is represented as follows: ; in, , For activation function, The normalized adjacency matrix in step S1 , .

[0009] Specifically, step S4 includes the following steps: Step S41: Apply chain rule to the classification loss term Taking the derivative, we get: ; ; ; in For nodes exist c Category embedding component representation, Represents a node i Hidden layer representation, Represents a node i The vector of the real label, The probability distribution of the classes predicted by the model; Step S42: Further scale the gradient terms and retain only the dominant terms to obtain the gradient approximation: ; Step S43: Differentiate the structural constraint loss to obtain: ; Step S44: Considering the two endpoints of the edge, differentiate the loss with respect to the node degree constraint to obtain: ; ; ; Step S45: Let's assume at this time... For a clean graph, the inner product is represented by embeddings that indicate similar characteristics. Replace the current ,make , By taking the absolute value of the gradient and using a unified sign, the final gradient matrix is ​​represented as follows: .

[0010] Specifically, the cutting method in step S5 is as follows: For the target node To obtain its possible existence k Anchor nodes If node i and k If there are connections between anchor nodes, they are directly clipped, as shown below: ; ; in, Represents a node The local neighborhood matrix, Represents a node The Anchor nodes, This represents the adjacency matrix recovered from the poisoned graph. For the recovered edge set, Represents the element product.

[0011] Specifically, the clipping update graph structure includes: The adjacency matrix is ​​updated as follows: ; The updated graph structure is as follows: ; ; ; in, This is for cropping the mask matrix.

[0012] On the other hand, the industrial internet defense system based on local adaptive graph neural networks is built on a three-layer network architecture, consisting of, from bottom to top: an industrial terminal device layer, an edge gateway layer, and a cloud server layer; the edge gateway layer includes the following modules: Data acquisition and caching module: Receives topology and status data from the terminal, forms a graph data buffer, and supports the formation of dynamic graph snapshots through sliding time windows; Topology construction and preprocessing module: Parses link information into an adjacency matrix and normalizes it, preprocesses missing data and outliers, and constructs multiple subgraphs according to device type and service partition; The basic GNN modeling module trains or fine-tunes a GCN graph convolutional network or a SGC simplified graph convolutional network based on the current graph structure, performs node classification or state prediction, and outputs the embedding representation of each node. Compared with classification results Simultaneously perform one forward and one backward propagation to obtain the gradient of the loss function; DLGNN Local Adaptive Defense Module: Inserts gradient calculation and local edge clipping rules into the forward or backward process of the basic GNN modeling module; Policy Decision and Access Control Module: Combines the purified trusted graph S with the node prediction results The data is submitted to the strategy engine, which generates control decisions based on preset rules. Log and audit module: Records the reason for each edge pruning operation and retains snapshots of the original topology and the cleaned topology.

[0013] Specifically, the DLGNN local adaptive defense module includes: Target node selection unit: Configures rules and comprehensively selects a set of target nodes; Gradient calculation and fusion unit: for each target node Calculate the classification loss gradient, structure constraint gradient, and degree constraint gradient to obtain the edge gradient matrix. ; Scaling and normalizing the gradient ensures that the contributions of different loss terms are of the same order of magnitude; and configuring the weight parameters. ; Local edge scoring and pruning unit: For each target node, select the k anchor nodes with the largest absolute gradient values ​​from its neighbor set. If there is an edge between the target node and the anchor node, mark it as an edge to be pruned. If there are too many edges to be pruned, the target node is considered a poisoned node. Associativity constraint limits the maximum number of edges that can be pruned from a single low-degree node. Topological iterative update unit: according to the mask matrix The adjacency matrix S is updated iteratively. The proportion of edges to be pruned in a single iteration is controlled by a global threshold. When the objective function converges or the number of edges pruned in multiple consecutive iterations is lower than the set threshold, the topology is judged to be stable.

[0014] Specifically, the industrial terminal equipment layer consists of various types of industrial field equipment, including sensors, machine tools, industrial robots, and PLC controllers; the cloud server layer includes: The centralized management module for models and strategies stores model versions and parameter configurations from different industries and factories, and issues unified or tiered defense strategies based on the overall network security situation. Global Situation Awareness and Risk Assessment Module: Aggregates and analyzes alarms and pruning statistics of each edge node, identifies collaborative attack behaviors across factories and sites, and provides risk maps and trend analysis reports for operation and maintenance personnel.

[0015] The beneficial effects of this invention are as follows: The industrial internet defense system and method based on local adaptive graph neural networks proposed in this invention perform defense operations only around the target node through a local adaptive pruning mechanism, thereby protecting the integrity of the non-attack area structure; a gradient-based local node detection method is proposed to identify poisoned edges from both the node degree change and gradient direction perspectives, enhancing the defense accuracy of critical equipment nodes; a node degree constraint and local structure learning mechanism are introduced to maintain overall network connectivity and normal communication paths while removing poisoned edges, meeting the high availability requirements of industrial environments; compared with full graph optimization methods such as ProGNN, DLGNN only needs to update local subgraphs, significantly reducing computational and storage complexity, and is suitable for large-scale industrial internet data environments. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0017] Figure 1 This is the basic logic diagram of industrial internet defense based on local adaptive graph neural network in this embodiment of the invention; Figure 2 This is a diagram illustrating the architecture of an industrial internet defense system based on a local adaptive graph neural network, as described in this invention. Figure 3 This is a model framework diagram in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0019] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0020] The following is in conjunction with the appendix Figures 1-3 The following describes some embodiments of the present invention in detail. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0021] This invention proposes an industrial internet defense system and method based on local adaptive graph neural networks. In a preferred embodiment, the industrial internet defense method based on local adaptive graph neural networks includes the following steps: Step S1: Data initialization, constructing the connection relationships of industrial internet devices into a graph structure. , For a set of nodes, Let be the set of edges. For the node feature matrix; for the adjacency matrix Perform normalization and initialize the learning graph; Step S2: Define the model optimization objective function, including traditional node classification loss, structural constraint loss, and node degree constraint loss; Step S3: Train the node classification model using a GCN graph convolutional network or a SGC simplified graph convolutional network; Step S4: Gradient analysis and poisoned edge identification. The loss is directionally differentiated to obtain the gradient of the connection with the locally important nodes. Step S5: Select the node with the longest connection to each target node based on the gradient. Each anchor node is used as a clipping set. Clipping is performed based on the clipping set, and the graph structure is updated. Step S6: Re-input the updated graph structure into the model for training, and repeat steps S1 to S5 and the pruning process until the training function converges.

[0022] The following detailed description of this solution is provided with reference to specific embodiments: In this embodiment, the process is as follows: Figure 1 As shown, a closed-loop system is formed, consisting of "input data - model training - poisoned edge identification - graph structure update - model retraining - learning graph output". Through multiple iterations, the attacked graph structure is continuously purified, achieving defense while maintaining high efficiency and stability of system performance. The specific details of each step are as follows.

[0023] (1) Data initialization The connection relationships of industrial internet devices are constructed as a graph structure. ; : A set of nodes, representing devices or terminals in the Industrial Internet; Edge set: Represents the communication relationships between devices; : Node feature matrix, each row represents the attributes or operating status of the node device.

[0024] Adjacency matrix Normalize: ; Initialize learning graph , .

[0025] (2) Definition of objective function In this embodiment, the model optimization objective consists of three parts: ; Control parameters for each loss value; Classification loss The traditional node classification loss is the cross-entropy between predicted and true values: .

[0026] Because directly deleting perturbation edges achieves defense more quickly, and because carefully designed perturbation edges often introduce significant errors into the model with relatively small perturbations, the number of perturbation edges is much smaller than the number of edges in the original clean image. Therefore, to prevent excessive clipping, a structural constraint loss is introduced each time perturbation edges are trimmed. : ; k is the number of perturbation edges that need to be pruned for a single target node.

[0027] Starting with locally important nodes, attacks tend to choose low-degree nodes as anchor nodes, so pruning perturbed edges results in a relatively larger degree change for low-degree nodes. Simultaneously, to avoid graph connectivity issues caused by target nodes simultaneously selecting the same low-degree node for pruning, we consider both important nodes as target nodes and anchor nodes, encouraging target nodes to easily choose low-degree nodes but avoiding over-selection, further leading to structure learning with node degree constraints: ; in The threshold parameter representing the pruning of a single node. for Confidence level of its true label.

[0028] (3) Model training The node classification model is trained using a Graph Convolutional Network (GCN) or a Simplified Graph Convolutional Network (SGC). The propagation formula for each layer is as follows: ;in , This is the activation function.

[0029] Output layer predicts node class probabilities: .

[0030] (4) Gradient analysis and poisoned edge identification The presence of perturbation edges can cause nodes to incorrectly learn other misleading features, increasing the loss. Consequently, the gradient of perturbation edges is higher than that of normal edges during training. Since the gradient of the model training is globally optimized to reduce the loss, to consider locally important nodes, we need to take the directional derivative of the loss to obtain the gradient of the connection with the locally important nodes.

[0031] In this embodiment, for the classification loss term The derivative of can be obtained using the chain rule: ; ; ; in For nodes In the embedding component representation of category c, This represents the hidden layer representation of node i. The vector representing the true label of node i. The probability distribution of the classes predicted by the model.

[0032] because The supervision signal depends only on the prediction result of the target node i. Therefore, when calculating the derivative, only the direction of the target node is considered, and the backward contribution of neighboring nodes is not included. Further scaling of the gradient term and retaining only the dominant term yields the following approximate gradient form: ; The derivative for structural constraints is readily obtained: ; Meanwhile, regarding the degree constraint loss Taking the derivative, we know that pruning an edge in a graph affects the degree of the nodes at both ends, so we need to consider the nodes at both ends of the edge: ; ; ; Since the existence of edges in a clean graph can be expressed by embedding similarity, let's assume that... For a clean graph, the inner product is represented by embeddings that indicate similar characteristics. Replace the current Ideally, all pruned edges selected during training are perturbation edges, and all are within the node degree threshold. In this case, let... , To ensure the positive accumulation of all contributions, the absolute values ​​of the gradients are used with a unified sign, so the final gradient matrix is: .

[0033] (5) Safety cutting and structural renewal After obtaining the gradient matrix at this point, select the node with the longest connection to each target node based on the gradient. Each anchor node serves as a clipping set, and the graph structure is updated by clipping based on the clipping set.

[0034] In this embodiment, the main principle of the defense strategy is to find the neighboring nodes of the target node in the poisoned graph that are most likely to be the perturbation edges during its training process. If a connection exists, it is pruned to update the graph structure at this time. For example, the target node... Obtain its k possible anchor nodes If node i has connections to k anchor nodes, then prune directly: ; ; Represents a node The local neighborhood matrix, Represents a node The Anchor nodes, This represents the adjacency matrix recovered from the poisoned graph. The edge set to be recovered. Represents the element product.

[0035] Updating the adjacency matrix: ; For cropping the mask matrix; Updating the graph structure: ; ; .

[0036] Due to the importance of industrial equipment, it cannot be completely cut off at once. Instead, multiple cuts with a small value k are used to restore the original topology.

[0037] Will Re-enter the model for training, and repeat the above operations and pruning process until the training function converges.

[0038] This invention also proposes an industrial internet defense system based on a local adaptive graph neural network, the overall architecture of which is as follows: Figure 3 As shown, from bottom to top, it includes: industrial terminal equipment layer, edge gateway layer, and cloud server layer.

[0039] Industrial Terminal Equipment Layer: This layer consists of various types of industrial field devices, including sensors, machine tools, industrial robots, and PLC controllers. Functions include: (1) Periodic (e.g., every 5-60 seconds) or event-triggered reporting: The node feature matrix X includes device type, protocol stack information, service traffic statistics, alarm count, CPU / memory load, etc. Current link relationships (adjacency information), including adjacency relationships and industrial protocol session relationships.

[0040] (2) Supports edge gateways issuing: Topology correction suggestions (such as prohibiting communication with certain suspected malicious nodes); Access control policies (such as closing ports and limiting bandwidth).

[0041] Edge Gateway Layer: The edge gateway layer internally deploys the DLGNN local adaptive defense module of this invention and the basic graph neural network model (such as GCN or SGC). The specific module division is as follows: Data acquisition and caching module: Receives topology and status data from the terminal to form a graph data buffer; supports the formation of dynamic graph snapshots by sliding time windows (such as the most recent 10 to 30 minutes).

[0042] Topology construction and preprocessing module: parses link information into an adjacency matrix. Normalize the data; interpolate missing data and truncate or smooth out outliers; construct multiple sub-graphs (such as production line sub-graphs and factory area sub-graphs) according to equipment type and business partition.

[0043] The basic GNN modeling module (GCN / SGC) trains or fine-tunes the GCN / SGC based on the current graph G for node classification (e.g., normal / suspicious / malicious) or state prediction; it outputs the embedding representation of each node. Compared with classification results Perform one forward and backward propagation to obtain the gradient of the loss function. .

[0044] DLGNN Local Adaptive Defense Module: Internally further divided into: Target node selection unit; selects the target node set based on the following rules. : Key business equipment (such as main PLC, control center switch); Degree anomaly nodes (degree values ​​change by more than 2 to 3 times the average change); Nodes with low classification confidence or whose prediction results change frequently.

[0045] Gradient calculation and fusion unit: for each target node Calculate the classification loss gradient, structure constraint gradient, and degree constraint gradient to obtain the edge gradient matrix. Gradient scaling and normalization ensure that the contributions of different loss terms are of the same order of magnitude; weight parameters can be configured. It is used to balance security and connectivity.

[0046] Local edge scoring and pruning unit: For each target node, select the k anchor nodes with the largest absolute gradient values ​​from its neighbor set; if there is an edge between the target node and the anchor node, mark it as an "edge to be pruned"; if there are too many "edges to be pruned", the target node is considered a poisoned node; associativity constraint limits the maximum number of edges that can be pruned from a single low-degree node.

[0047] Topological iterative update unit: according to the mask matrix Iterative update of adjacency matrix S: The proportion of edges pruned in a single iteration is controlled by a global threshold (e.g., no more than 3-5% of the total number of edges in the entire network) to avoid large-scale topology changes at once; when the objective function converges or the number of edges pruned in multiple consecutive iterations is lower than the set threshold, it is determined that the topology has become stable.

[0048] Policy Decision and Access Control Module: Combines the purified trusted graph S with the node prediction results Submitted to the policy engine; the policy engine generates control decisions based on preset rules, for example: Refuse control commands from nodes deemed infected; Limit bandwidth between abnormal connections.

[0049] Log and audit module: Records the reason for each edge pruning operation, including changes in nodes, gradient values, and degrees; retains snapshots of the original topology and the pruned topology for post-event traceability and algorithm evaluation.

[0050] In this embodiment, the cloud server layer includes: Centralized management of models and policies: Stores model versions and parameter configurations from different industries and factories; issues unified or tiered defense policies based on the overall network security situation; Global situational awareness and risk assessment: Aggregate and analyze alarms and pruning statistics of each edge node; identify coordinated attack behaviors across factories and sites; and provide risk maps and trend analysis reports for operation and maintenance personnel.

[0051] In this embodiment, the number of terminal devices in the Industrial Internet is large and their structure is complex, with frequent dynamic changes in topology. Attackers typically forge connections or inject malicious edges at the terminal device layer. Due to the limited computing power of the terminals, deploying defense algorithms on the device side is not feasible. Therefore, this solution deploys the DLGNN local adaptive defense module on the edge gateway side, which is used to: receive topology state data uploaded from industrial terminal devices and construct a poisoning graph. (For graphs that may be compromised by attacks), DLGNN automatically identifies suspicious attack edges, updates the graph structure S, and returns a reliable topology to the cloud or device side to determine whether certain access requests and control commands have been misled by attacks.

[0052] The complete operation flow of the DLGNN local adaptive defense module in the system is as follows: Step 1: Terminal device → Edge gateway (upload topology and status) Industrial terminal devices periodically or event-triggeredly upload node status feature matrix X, current link topology / connection information (which may include poisoned edges), and edge gateways construct poisoning graphs. .

[0053] Step 2: Perform initial GNN (GCN / SGC) training on the edge gateway side. The edge gateway performs one forward and backward propagation on the current graph locally to obtain the classification loss, node embedding, and gradient; these gradients will serve as the core basis for the subsequent DLGNN to identify poisoned edges.

[0054] Step 3: Local Gradient Analysis of DLGNN DLGNN selects "target nodes with attack risks" (critical nodes, nodes with abnormal degrees, alarm nodes, etc.) from the uploaded graph. For each target node... Calculate the classification loss gradient (high sensitivity to attack edges), the structural sparsity gradient (degree of deviation from a clean graph), and the node degree constraint gradient (avoiding damage to low-degree node structures); synthesize these to obtain the edge gradient matrix: Use gradient strength to assess which edge is most likely to be a malicious edge inserted by the attacker.

[0055] Step 4: DLGNN prunes malicious edges and updates the topology For each target node, select the k anchor nodes (attack nodes) with the highest gradients from its neighbors. If there is an edge between them, perform pruning: .

[0056] Step 5: Retrain and iterate until the topology is stable. The updated graph is fed back into the GNN model, making the predictions more accurate, gradually weakening the poisoning effect, and continuously restoring the structure. After a few rounds, the "clean topology" is fully restored, and finally a reliable graph structure S is obtained.

[0057] Step 6: DLGNN decision output for industrial control / cloud analytics The resulting trusted topology is used to filter malicious control commands or abnormal access requests. For example, if a device's adjacency structure is abnormal, its control privileges can be automatically reduced or manual review can be triggered, providing input to the industrial control operating system and edge firewall for dynamic access control policy adjustments.

[0058] Step 7: DLGNN decision output for industrial control / cloud analytics The edge gateway periodically uploads the following to the cloud server: cleaned topology S, node prediction tags, poisoned edge trimming logs, and device anomaly indicators; providing basic data for global analysis, cross-factory risk assessment, and multi-site collaborative defense in the cloud.

[0059] In this embodiment, DLGNN is not a completely new GNN network, but rather a local adaptive structure learning module embedded in any GNN model. In this invention, it is combined with the GCN / SGC model to form a complete "model + defense" architecture.

[0060] The basic GNN representation model (GCN or SGC) is used for node classification tasks, providing gradient signals and generating embedding representations for each node, thus providing feature basis for structure learning; the propagation formula for the GCN layer is: The graph neural network represents the first... The node representation matrix of the layer (hidden layer features), Indicates the first The learnable weight matrix of the layer.

[0061] The SGC layer omits all nonlinearities: Normalized adjacency matrix of Power of 1 This represents the final output prediction matrix.

[0062] The DLGNN local structure adaptation module is the core of this scheme. DLGNN inserts two key functions in each forward / backward process of GNN: (1) Gradient Calculation Unit: Calculates the current edge gradient matrix during each model training iteration. ; (2) Local Edge Pruning Rule Unit: For each target node, select the k neighbors with the highest gradients to form an anchor node set, and delete the corresponding poisoned edges in the adjacency matrix; output the updated adjacency matrix S. Finally, DLGNN and GCN / SGC are combined to form... Figure 2 The structure shown.

[0063] This solution has the following technical advantages: (1) Significantly improved defense performance: Under various typical graph poisoning attacks (such as Nettack, IGAttack, SGAttack, FGAttack), GCN with integrated defense mechanisms showed superior classification accuracy on multiple datasets (Cora, Citeseer, Pubmed). DLGNN is the defense framework, RAND and DEG are the ablation of RAND and DEG respectively, and random pruning and minimum degree ranking pruning are directly adopted.

[0064] For example, under the Nettack attack on the Cora dataset, the accuracy reached 89.8%, which is significantly higher than traditional methods such as GCN-SVD (49.9%) and GCN-Jaccard (72.1%).

[0065] Table 1: Comparison of classification accuracy (%) between the preprocessed model and the target attack model (OOM: Out of memory) Table 2: Comparison of classification accuracy with model defense under target attack (OOM: Out of memory) (2) Maintaining high accuracy on clean graphs: Unlike traditional global defense strategies that cause performance degradation when there is no attack, the framework can maintain accuracy comparable to the original model in the "no attack" state through local structure updates and degree constraints (Cora dataset: 84.5%).

[0066] Table 3: Comparison of classification accuracy under clean images (3) Improve the robustness and reliability of industrial networks: Through adaptive defense and topology repair mechanisms, the real connection structure between industrial equipment can be effectively restored, avoiding key nodes from being misled or isolated, thereby ensuring the stable operation of the system and the reliability of real-time monitoring.

[0067] (4) Low algorithm complexity and strong scalability: Gradient-guided update of local target nodes is adopted, and the time complexity is approximately Compared to global optimization algorithms such as ProGNN, it reduces redundant computation by more than 40%, making it suitable for large-scale industrial network protection.

[0068] (5) It has good versatility and practical value: This framework can be applied not only to the security protection of the industrial Internet, but also to graph data scenarios that rely on topology analysis, such as smart manufacturing, smart grid, and smart transportation, providing a new technical paradigm for security defense in multiple fields.

[0069] For the foregoing embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to this application.

[0070] The above embodiments describe the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Modifications and variations made by those skilled in the art without departing from the spirit and scope of the invention should be within the protection scope of the appended claims.

Claims

1. An industrial internet defense method based on local adaptive graph neural networks, characterized in that, Includes the following steps: Step S1: Data initialization, constructing the connection relationships of industrial internet devices into a graph structure. , For a set of nodes, Let be the set of edges. The node feature matrix; For adjacency matrix Normalize and initialize the learning graph. , ; Step S2: Define the model optimization objective function, including traditional node classification loss, structural constraint loss, and node degree constraint loss; Step S3: Train the node classification model using a GCN graph convolutional network or a SGC simplified graph convolutional network; Step S4: Gradient analysis and poisoned edge identification. The loss is directionally differentiated to obtain the gradient of the connection with the locally important nodes. Step S5: Select the node with the longest connection to each target node based on the gradient. Each anchor node is used as a clipping set. Clipping is performed based on the clipping set, and the graph structure is updated. Step S6: Re-input the updated graph structure into the model for training, and repeat steps S1 to S5 and the pruning process until the training function converges.

2. The industrial internet defense method based on local adaptive graph neural networks as described in claim 1, characterized in that, The objective function in step S2 is expressed as follows: ； Among them, classification loss The traditional node classification loss, i.e., the cross-entropy between predicted and true values, is expressed as: ； The introduced structural constraint loss is expressed as: ； The node degree constraint loss is expressed as: ； in, These are the control parameters for the loss value. The number of perturbation edges that need to be pruned for a single target node; The threshold parameter representing the pruning of a single node. for Confidence level of its true label.

3. The industrial internet defense method based on local adaptive graph neural networks as described in claim 2, characterized in that, In step S3 of model training, the propagation formula for each layer is: ； The probability of the predicted node class in the output layer is represented as follows: ； in, , For activation function, The normalized adjacency matrix in step S1 , .

4. The industrial internet defense method based on local adaptive graph neural networks as described in claim 3, characterized in that, Step S4 specifically includes the following steps: Step S41: Apply chain rule to the classification loss term Taking the derivative, we get: ； ； ； in For nodes exist c Category embedding component representation, Represents a node i Hidden layer representation, Represents a node i The vector of the real label, The probability distribution of the classes predicted by the model; Step S42: Further scale the gradient terms and retain only the dominant terms to obtain the gradient approximation: ； Step S43: Differentiate the structural constraint loss to obtain: ； Step S44: Considering the two endpoints of the edge, differentiate the loss with respect to the node degree constraint to obtain: ； ； ； Step S45: Let's assume at this time... For a clean graph, the inner product is represented by embeddings that indicate similar characteristics. Replace the current ,make , By taking the absolute value of the gradient and using a unified sign, the final gradient matrix is ​​represented as follows: 。 5. The industrial internet defense method based on local adaptive graph neural networks as described in claim 4, characterized in that, The specific cutting method in step S5 is as follows: For the target node To obtain its possible existence k anchor nodes If node i and k If there are connections between anchor nodes, they are directly clipped, as shown below: ； ； in, Represents a node The local neighborhood matrix, Represents a node The Anchor nodes, This represents the adjacency matrix recovered from the poisoned graph. For the recovered edge set, Represents the element product.

6. The industrial internet defense method based on local adaptive graph neural networks as described in claim 5, characterized in that, The clipping update graph structure includes: Update the adjacency matrix: ； The updated graph structure is as follows: ； ； ； in, This is for cropping the mask matrix.

7. An industrial internet defense system based on a local adaptive graph neural network, used to implement the industrial internet defense method based on a local adaptive graph neural network as described in any one of claims 1 to 6, characterized in that, The system is built on a three-layer network architecture, consisting of, from bottom to top: an industrial terminal device layer, an edge gateway layer, and a cloud server layer; the edge gateway layer includes the following modules: Data acquisition and caching module: Receives topology and status data from the terminal, forms a graph data buffer, and supports the formation of dynamic graph snapshots through sliding time windows; Topology construction and preprocessing module: Parses link information into an adjacency matrix and normalizes it, preprocesses missing data and outliers, and constructs multiple subgraphs according to device type and service partition; The basic GNN modeling module trains or fine-tunes a GCN graph convolutional network or a SGC simplified graph convolutional network based on the current graph structure, performs node classification or state prediction, and outputs the embedding representation of each node. Compared with classification results Simultaneously perform one forward and one backward propagation to obtain the gradient of the loss function; DLGNN Local Adaptive Defense Module: Inserts gradient calculation and local edge clipping rules into the forward or backward process of the basic GNN modeling module; Policy Decision and Access Control Module: Combines the purified trusted graph S with the node prediction results The data is submitted to the strategy engine, which generates control decisions based on preset rules. Log and audit module: Records the reason for each edge pruning operation and retains snapshots of the original topology and the cleaned topology.

8. The industrial internet defense system based on a local adaptive graph neural network as described in claim 7, characterized in that, The DLGNN local adaptive defense module specifically includes: Target node selection unit: Configures rules and comprehensively selects a set of target nodes; Gradient calculation and fusion unit: for each target node Calculate the classification loss gradient, structure constraint gradient, and degree constraint gradient to obtain the edge gradient matrix. ; Scaling and normalizing the gradient ensures that the contributions of different loss terms are of the same order of magnitude; and configuring the weight parameters. ; Local edge scoring and pruning unit: For each target node, select the k anchor nodes with the largest absolute gradient values ​​from its neighbor set. If there is an edge between the target node and the anchor node, mark it as an edge to be pruned. If there are too many edges to be pruned, the target node is considered a poisoned node. Associativity constraint limits the maximum number of edges that can be pruned from a single low-degree node. Topological iterative update unit: according to the mask matrix The adjacency matrix S is updated iteratively. The proportion of edges to be pruned in a single iteration is controlled by a global threshold. When the objective function converges or the number of edges pruned in multiple consecutive iterations is lower than the set threshold, the topology is judged to be stable.

9. The industrial internet defense system based on a local adaptive graph neural network as described in claim 7, characterized in that, The industrial terminal equipment layer consists of various types of industrial field equipment, including sensors, machine tools, industrial robots, and PLC controllers; the cloud server layer includes: The centralized management module for models and strategies stores model versions and parameter configurations from different industries and factories, and issues unified or tiered defense strategies based on the overall network security situation. Global Situation Awareness and Risk Assessment Module: Aggregates and analyzes alarms and pruning statistics of each edge node, identifies collaborative attack behaviors across factories and sites, and provides risk maps and trend analysis reports for operation and maintenance personnel.

Images