Industrial big data visual management system based on big data analysis

Abstract

The invention discloses an industrial big data visual management system based on big data analysis, and relates to the technical field of industrial data management, and the system comprises a data collection module, a data analysis module, a visual early warning module and a strategy optimization module. The data analysis module integrates the three-dimensional data to form a single-main-body full-process and single-element full-access double-track chain, the single-main-body full-process and single-element full-access double-track chain is fused to obtain a behavior track chain, and abnormal nodes are identified through double verification; the visual early warning module visually presents data in a layered manner through a statistical layer and a risk layer, and triggers real-time early warning; the strategy optimization module extracts risk scenes based on the visual data, and adopts different optimization strategies respectively. According to the method, complete tracing of the operation track, accurate identification of abnormal nodes and dynamic optimization of strategies are realized, and the industrial data security control and operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of industrial data management technology, specifically to an industrial big data visualization management system based on big data analytics. Background Technology

[0002] Industrial big data visualization management systems are a core support for industrial production and operation, and are widely used in scenarios such as industrial production scheduling, equipment maintenance, and data security management. However, existing technologies still have the following shortcomings in practical applications:

[0003] First, data collection focuses primarily on the operational behavior itself, lacking collaborative collection of related information such as the identity of the subject and the operational scenario, resulting in insufficient data correlation and difficulty in supporting full-process traceability;

[0004] Secondly, it does not form a complete trajectory chain for the entire process of a single entity's operation and the full access of a single element, making it impossible to accurately reconstruct the operation logic and the full picture of element access. At the same time, it lacks dual verification of time continuity and logical correlation, which is prone to misjudgment or omission.

[0005] Third, the visualization presentation is disconnected from risk warnings, and statistical data and abnormal information are not integrated in a hierarchical manner, making it difficult for administrators to quickly locate high-frequency risk points;

[0006] Therefore, there is an urgent need for an industrial big data visualization management system based on big data analytics. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides an industrial big data visualization management system based on big data analytics, which solves the problems of inaccurate industrial data management, inefficient anomaly identification, and lagging strategy optimization.

[0008] To achieve the above objectives, the present invention provides the following technical solution: an industrial big data visualization management system based on big data analysis, comprising:

[0009] The data acquisition module collects three-dimensional information on the permission operations and de-identification behaviors of all visualization elements in the industrial visualization system to obtain full audit data. The three-dimensional information includes subject information, behavior information, and scene association information.

[0010] The data analysis module performs structured integration of all audit data, obtaining a single entity's full-process operation trajectory chain and a single element's full access trajectory chain. At the same time, the two are combined to obtain a behavior trajectory chain, and abnormal nodes are identified based on the behavior trajectory chain.

[0011] The visual early warning module constructs a dedicated audit visualization dashboard, visually presenting the behavioral trajectory chain and abnormal nodes in two layers: statistical layer and risk layer.

[0012] The strategy optimization module, based on a visual dashboard, analyzes the commonalities and root causes of abnormal nodes and optimizes the strategies accordingly.

[0013] As a further aspect of the present invention, the main information includes an operator's identity identifier and a login account; the operator's identity identifier includes name and department. The behavioral information includes details of the visual elements of the operation, the operation type, the operation timestamp, and the operation result; the details of the visual elements of the operation include name, sensitivity level, and function type; the operation type is one of viewing, exporting, drilling down, requesting permissions, or triggering desensitization; the operation result is one of success or failure. The scenario association information includes details of the access terminal, network environment, business scenario, and approval status; the access terminal details include device model, MAC address, and operating system; the network environment is one of intranet, public network, or VPN; the business scenario is one of daily office work, cross-departmental collaboration, external auditing, or remote operation and maintenance; and the approval status is one of approval or no approval.

[0014] As a further aspect of the present invention, the specific steps for obtaining the single-subject full-process operation trajectory chain and the single-element full-access trajectory chain are as follows:

[0015] Using "login account + operation timestamp" as the core association key, scattered individual operation records are integrated into structured data units: each data unit contains 10 categories of complete information, including operator identity, login account, details of the operation's visual elements, operation type, operation timestamp, operation result, access terminal details, network environment, business scenario, and approval status.

[0016] Using the login account as the unique identifier, all data units of the account are sorted in ascending order by the operation timestamp to form a single entity's full-process operation trajectory chain;

[0017] Using the name of the visualized element being operated on as a unique identifier, all data units accessing that visualized element are sorted in ascending order by the operation timestamp, and the access frequency is counted to form a single-element full access trajectory chain.

[0018] As a further aspect of the present invention, the specific operation for obtaining the behavior trajectory chain is as follows:

[0019] Using "login account + operation timestamp + operation visual element name" as the joint unique association key, all data units of the single subject full-process operation trajectory chain and the single element full access trajectory chain are matched: the visual element name of the operation corresponding to the same login account under the same operation timestamp of the two chains is identified. If the two names are the same, it indicates that it is a duplicate operation record, and only one complete data unit needs to be retained. For independent records that are not matched, they are all retained as independent data units.

[0020] Using the single-subject full-process operation trajectory chain as the main line, the unmatched independent records in the single-element full access trajectory chain are regarded as visual element association branches and embedded under the corresponding visual element operation node of the main line. That is, the main line node retains the complete information of the subject's own operation, and the branch nodes mark the access information of other subjects, thus obtaining the behavior trajectory chain.

[0021] As a further aspect of the present invention, the specific operation for abnormal node identification based on behavioral trajectory chains is as follows:

[0022] Two core data categories are extracted from the behavioral trajectory chain: one is the timestamp sequence, which is organized into a set of continuous time nodes according to the order of operations; the other is the node attribute set, which matches the five types of labeled attributes of each node according to the corresponding timestamp, forming a structured dataset corresponding to timestamps and attributes. The five types of labeled attributes include operation type, sensitivity level of visual elements, terminal device model, network environment, and approval status.

[0023] Based on the obtained structured dataset, time continuity and logical correlation checks are performed on each node, including:

[0024] Time continuity check: If the timestamp interval between the node and the previous adjacent operation node is within the normal industrial operation time range, it indicates that the time continuity is normal; otherwise, it indicates that the time continuity is abnormal. The first node is considered to have normal time continuity by default.

[0025] Logical correlation verification is performed only if both access scenario compliance and operation-sensitivity level adaptation requirements are met; otherwise, it is judged as logical correlation abnormal.

[0026] If a node exhibits any anomaly in either the time continuity check or the logical correlation check, it is marked as an abnormal node, and a structured label corresponding to that abnormal node is generated.

[0027] As a further aspect of the present invention, the compliance of the access scenario refers to meeting one of the following conditions: ① the terminal device model is an internal terminal and the network environment is an intranet; ② when the terminal device model is an external terminal, the network environment is a VPN or public network and the approval status is approved.

[0028] The operation-sensitivity level adaptation refers to meeting one of the following conditions: ① When the sensitivity level of the visual element is high, the operation type is only allowed to perform viewing and desensitization triggering; ② When the sensitivity level of the visual element is medium or low, the operation type is only allowed to perform viewing, drill-down, and permission request; ③ Regardless of the sensitivity level of the visual element, as long as the operation type is export, the approval status must be approved.

[0029] As a further aspect of the present invention, the formation of structured tags corresponding to abnormal nodes specifically includes:

[0030] The timestamp features and core attribute features of the abnormal node are obtained. The timestamp features include the absolute time value and the timestamp interval with the previous adjacent operation node. The core attribute features include the operation type, terminal device model, network environment, and approval status.

[0031] The timestamp feature, core attribute feature, and anomaly type are bound together to obtain a set of tag elements for the anomaly node: If it is a time continuity anomaly, the "timestamp interval with the previous adjacent operation node" in the timestamp feature and the "operation type" in the core attribute feature are included in the tag element set; if it is a logical correlation anomaly, the "absolute time value" in the timestamp feature and the "operation type, terminal device model, network environment, and approval status" in the core attribute features are included in the tag element set; if it is a time continuity anomaly and a logical correlation anomaly, both the timestamp feature and the core attribute feature are included in the tag element set.

[0032] Using the anomaly type as a prefix, the set of tag elements is combined according to the corresponding logical order to form structured tags. The corresponding logical order specifically refers to: if it is a time continuity anomaly, it is sorted according to "operation type → timestamp interval with the previous adjacent operation node"; if it is a logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value"; if it is a time continuity anomaly + logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value → timestamp interval with the previous adjacent operation node".

[0033] As a further aspect of the present invention, the specific steps for visualizing the statistical layer are as follows:

[0034] Using behavioral trajectory chains and structured labels of abnormal nodes as data sources, access frequency data is aggregated by the name of the visualized element, operation frequency data is aggregated by the department of the operator's identity, and usage frequency data is aggregated by the sensitivity level of the visualized element.

[0035] The data on access frequency of visual elements is matched with a heatmap, with the name of the visual element on the horizontal axis and access frequency on the vertical axis, and the color intensity corresponding to the frequency. The data on department operation frequency is matched with a bar chart, with the department on the horizontal axis and operation frequency on the vertical axis. The data on the percentage of use frequency of the sensitivity level of visual elements is matched with a pie chart, with the sensitivity level of the visual element as the category and the usage frequency as the percentage.

[0036] Clicking on the color block corresponding to a visualization element in a heatmap will automatically retrieve the complete behavioral trajectory chain data of that visualization element; clicking on a bar in a bar chart will automatically filter out the behavioral trajectory chain data of all operators in that department; clicking on a sector of the sensitivity level of a visualization element in a pie chart will automatically summarize all visualization elements corresponding to that sensitivity level.

[0037] As a further aspect of the present invention, the specific steps for visualizing the risk layer are as follows:

[0038] If it is a time continuity anomaly label, then extract the timestamp interval of the previous adjacent operation node from the label element set, and calculate the difference t between the timestamp interval of the previous adjacent operation node and the benchmark value of the normal operation interval in the industrial scenario: if |t|∈[0,tmax], then it is judged as a potential risk, and if |t|>tmax, then it is judged as a high risk, where tmax is the difference threshold.

[0039] If the tag is a logically related abnormal tag, the operation type, terminal device model, network environment, and approval status are extracted from the tag element set in sequence and combined. If the combination is consistent with the combination of "view or export + external terminal + public network + no approval", it is judged as high risk; if the combination is consistent with the combination of "view or export + internal terminal + intranet + no approval", it is judged as potential risk.

[0040] If the labels are "abnormal time continuity" and "abnormal logical correlation", then it is directly judged as high risk.

[0041] High-risk abnormal nodes are displayed in reverse chronological order and marked with a red background; potentially risky abnormal nodes are marked with a yellow background; all abnormal nodes need to be associated with a corresponding behavioral trajectory chain code.

[0042] When a new structured tag is added to an abnormal node in the system, a real-time alert is automatically triggered: a red or yellow alert pop-up appears in the risk layer of the dashboard, and the structured tag and the associated behavioral trajectory chain code are pushed to the administrator via system message or SMS. The administrator can directly jump to the corresponding statistics layer to view the details by clicking the alert pop-up.

[0043] As a further aspect of the present invention, the specific operation for strategy optimization is as follows:

[0044] Based on the heatmap and pie chart of the statistical layer, extract the top 3 most frequently accessed highly sensitive visual elements and the set of visual elements whose corresponding sensitivity level usage accounts for more than 40%, and mark them as the high-frequency and high-sensitivity visual element set.

[0045] Based on the bar chart of the statistical layer and the abnormal node data of the risk layer, the top 5 departments with the highest operation frequency in the bar chart are first selected. Then, from all abnormal nodes in the risk layer, nodes belonging to the top 5 departments and whose structured labels contain "view or export + no approval" are extracted to obtain the set of departments to which these nodes belong and are marked as the set of high-frequency operation departments.

[0046] For each department in the set of high-frequency operation departments or the set of low-frequency operation departments, match each visualization element in the set of high-frequency and high-sensitivity visualization elements one by one, and count the access frequency of each visualization element. If the access frequency of a visualization element is greater than or equal to 1.5 times the average access frequency of all visualization elements in that department, then include it in the high-frequency visualization element set of that department. At the same time, find the intersection of the high-frequency visualization element sets corresponding to all departments in the set of high-frequency operation departments or the set of low-frequency operation departments to obtain high-frequency visualization element set one and high-frequency visualization element set two.

[0047] Strategy optimization is performed based on two sets of high-frequency visualization elements, specifically including:

[0048] After obtaining the first set of high-frequency visualization elements, retain the viewing permissions of each department in the high-frequency operation department set for the visualization elements in the high-frequency visualization element set, cancel the export permission without approval, and export requires approval from the direct administrator. At the same time, when viewing the target visualization elements, the default is medium anonymization, and when exporting, it is automatically upgraded to high anonymization.

[0049] After obtaining the second set of high-frequency visualization elements, directly cancel the unapproved access permissions of each department in the non-high-frequency operation department set to the visualization elements in the high-frequency visualization element set. It is necessary to initiate a cross-departmental collaboration application and obtain approval from the head of the department to which the target visualization element belongs. At the same time, after approval, only basic anonymized viewing permissions are granted, and export is prohibited.

[0050] This invention provides an industrial big data visualization management system based on big data analysis, which has the following advantages compared with existing technologies:

[0051] (1) This invention collects full data from three dimensions of subject, behavior and scene association to form a dual trajectory chain of single subject full process and single element full access, and then merges the two to obtain a behavior trajectory chain containing main line and branches, so as to realize the complete restoration of operation behavior and associated scene, and provide comprehensive data support for subsequent anomaly identification.

[0052] (2) The present invention adopts a dual verification mechanism of time continuity and logical correlation, and combines scenario compliance and operation-sensitivity level adaptation rules to identify abnormal nodes and generate structured labels containing abnormal types and core features. This mechanism avoids misjudgment and missed judgment caused by single-dimensional judgment and improves the accuracy of abnormal identification.

[0053] (3) This invention presents the data in a hierarchical and visual manner through statistical and risk layers, enabling intuitive display and rapid correlation query of operation frequency and risk level. At the same time, it extracts core risk scenarios based on the visualized data and formulates targeted optimization strategies, solving the problems of existing technologies where visualization and risk warning are disconnected and strategy optimization relies on human experience. Attached Figure Description

[0054] Figure 1 This is the system principle block diagram of the present invention;

[0055] Figure 2 This is a flowchart illustrating the steps for identifying abnormal nodes in this invention.

[0056] Figure 3 A flowchart illustrating the steps involved in strategy optimization for this invention. Detailed Implementation

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] Example 1

[0059] like Figure 1 This invention provides an industrial big data visualization management system based on big data analytics, comprising:

[0060] The data acquisition module collects three-dimensional information on the permission operations and de-identification behaviors of all visualization elements in the industrial visualization system to obtain full audit data. The three-dimensional information includes subject information, behavior information, and scene association information.

[0061] The visualization elements are concrete data interaction units with independent functions and unique identifiers in the industrial big data visualization management system. They are the direct objects of user operation, such as core process parameter charts and equipment status monitoring indicator cards.

[0062] The main information includes the operator's identity identifier and login account; the operator's identity identifier includes name and department.

[0063] The login account is a unique identifier within the system. Combined with the name and department, the operator's identity can be fully identified, avoiding the problem of unclear responsibility caused by shared accounts.

[0064] The behavioral information includes details of the visual elements of the operation, operation type, operation timestamp, and operation result. The details of the visual elements of the operation include name, sensitivity level (divided into high, medium, and low), and function type. The operation type is one of viewing, exporting, drilling down, permission requesting, and desensitization triggering. The operation result is one of success or failure.

[0065] The details of the visualization element are a collection of information after the core attributes of a single visualization element are decomposed in a structured manner, which clarifies the key characteristics of the element (including name, sensitivity level, and function type). These attributes are the necessary information to describe the visualization element.

[0066] Behavioral information needs to clearly specify what was done (details of the visual element), what action was performed (operation type), when it was done (operation timestamp), and whether it was successful or not (operation result). This is the core factual basis for judging whether the operation is compliant and whether there is any risk.

[0067] The scenario-related information includes access terminal details, network environment, business scenario, and approval status. The access terminal details include device model, MAC address, and operating system. The network environment is one of intranet, public network, or VPN. The business scenario is one of daily office work, cross-departmental collaboration, external auditing, or remote operation and maintenance. The approval status is one of approval or no approval.

[0068] In industrial settings, the compliance of the same operation can vary significantly across different scenarios. Relying solely on the subject and behavioral information is insufficient to distinguish between normal collaboration and malicious attacks. By supplementing the context of the operation, misjudgments or omissions due to a lack of scenario-related information can be avoided. Furthermore, access terminal details and network environment can uniquely identify the access source, preventing the risk of identity and scenario spoofing.

[0069] The data analysis module performs structured integration of all audit data, obtaining a single entity's full-process operation trajectory chain and a single element's full access trajectory chain. The specific operations are as follows:

[0070] Using "login account + operation timestamp" as the core association key, scattered individual operation records are integrated into structured data units: each data unit contains 10 complete information categories, including operator identity, login account, details of the operation's visual elements, operation type, operation timestamp, operation result, access terminal details, network environment, business scenario, and approval status, ensuring no data omissions;

[0071] Using the login account as the unique identifier, all data units of the account are sorted in ascending order by operation timestamp to form a single entity's full-process operation trajectory chain, which fully presents the continuous operation logic of the same user.

[0072] The operations of the same user have a natural logical connection. Sorting the operations in ascending order by timestamp can completely restore the entire process of performing a certain task. This not only solves the problem of being unable to identify the responsible party by scattered operation records, but also provides data support for the identification of time continuity anomalies.

[0073] Using the name of the visualized element being operated on as a unique identifier, all data units accessing that visualized element are sorted in ascending order by the operation timestamp, and the access frequency is counted to form a single-element full access trajectory chain, thus fully presenting the operation records of the same visualized element.

[0074] Sort by timestamp in ascending order to trace the operation sequence of all access subjects, while counting access frequency makes it easy to quickly locate high-frequency and sensitive visual elements. While meeting the full lifecycle monitoring of core visual elements, it can also provide key support for the identification of logical correlation anomalies.

[0075] The behavior trajectory chain is obtained by combining the single-entity full-process operation trajectory chain with the single-element full-access trajectory chain. The specific steps are as follows:

[0076] Using "login account + operation timestamp + operation visual element name" as the joint unique association key, all data units of the single-subject full-process operation trajectory chain and the single-element full access trajectory chain are matched: the visual element name of the operation corresponding to the same login account under the same operation timestamp of the two chains is identified. If the two names are the same, it indicates that it is a duplicate operation record, and only one complete data unit needs to be retained. For independent records that are not matched, such as access operations of other subjects in the single-element full access trajectory chain, they are all retained as independent data units.

[0077] Using the single-subject full-process operation trajectory chain as the main line (this trajectory chain is arranged in ascending order of timestamps), the unmatched independent records in the single-element full access trajectory chain (operations of other subjects accessing the visual element) are used as visual element association branches and embedded under the corresponding visual element operation node of the main line. That is, the main line node retains the complete information of the subject's own operation, and the branch nodes mark the access information of other subjects (including the 10 types of complete information mentioned above), thus obtaining the behavior trajectory chain.

[0078] All main nodes and branch nodes of the behavior trajectory chain are labeled with attributes: each node is fully labeled with 10 types of collected information, namely, operator identity, login account, details of the operation's visual elements, operation type, operation timestamp, operation result, access terminal details, network environment, business scenario, and approval status. Among them, access terminal details, network environment, business scenario, and approval status are all associated in the form of floating pop-ups, and the complete field information can be viewed by clicking on the node.

[0079] The visual early warning module builds a dedicated audit visualization dashboard, which visualizes the behavioral trajectory chain and abnormal nodes in two layers: statistical layer and risk layer.

[0080] The specific steps for visualizing the data in a statistical layer are as follows:

[0081] Using the behavioral trajectory chain and abnormal node structured tags output by the data analysis module as data sources, access frequency data is aggregated by the name of the visualized element, operation frequency data is aggregated by the department of the operator's identity, and usage frequency data is aggregated by the sensitivity level of the visualized element.

[0082] For example, after aggregation, the results are as follows: core process parameter chart (ID10086) was accessed 32 times, equipment status chart (ID10087) was accessed 25 times, production department operations were performed 120 times, technical department operations were performed 85 times, highly sensitive visualization elements were used 68 times, and moderately sensitive visualization elements were used 32 times.

[0083] The data on access frequency of visual elements is matched with a heatmap, with the name of the visual element on the horizontal axis and access frequency on the vertical axis, and the color intensity corresponding to the frequency. The data on department operation frequency is matched with a bar chart, with the department on the horizontal axis and operation frequency on the vertical axis. The data on the percentage of use frequency of the sensitivity level of visual elements is matched with a pie chart, with the sensitivity level of the visual element as the category and the usage frequency as the percentage.

[0084] Clicking on the color block corresponding to a visualization element in a heatmap will automatically retrieve the complete behavioral trajectory chain data of that visualization element; clicking on the bar of a department in a bar chart will automatically filter out the behavioral trajectory chain data of all operators in that department; clicking on the sector of the sensitivity level of a visualization element in a pie chart will automatically summarize all visualization elements corresponding to that sensitivity level.

[0085] The specific steps for visualizing the risk layer are as follows:

[0086] Risk level determination is based on the structured tags of abnormal nodes generated by the data analysis module, specifically including:

[0087] If the label is a time continuity anomaly, the timestamp interval between the previous adjacent operation node is extracted from the label element set, and the difference t between the timestamp interval between the previous adjacent operation node and the benchmark value of the normal operation interval in the industrial scenario is calculated: if |t|∈[0,tmax], it is judged as a potential risk, and if |t|>tmax, it is judged as a high risk. Here, tmax is the difference threshold, which needs to be preset according to the actual situation.

[0088] If the tag is a logically related abnormal tag, the operation type, terminal device model, network environment, and approval status are extracted from the tag element set in sequence and combined. If the combination is consistent with the combination of "view or export + external terminal + public network + no approval", it is judged as high risk; if the combination is consistent with the combination of "view or export + internal terminal + intranet + no approval", it is judged as potential risk.

[0089] If the labels are "abnormal time continuity" and "abnormal logical correlation", then it is directly judged as high risk.

[0090] High-risk abnormal nodes are displayed in reverse chronological order of their generation time and marked with a red background; potential-risk abnormal nodes are marked with a yellow background; all abnormal nodes need to be associated with a corresponding behavioral trajectory chain code.

[0091] When a new structured tag is added to an abnormal node in the system, a real-time alert is automatically triggered: a red (high risk) or yellow (potential risk) alert pop-up appears in the risk layer of the dashboard. At the same time, the structured tag and the associated behavioral trajectory chain code are pushed to the administrator via system message or SMS. The administrator can directly jump to the corresponding statistics layer to view the details by clicking the alert pop-up.

[0092] The strategy optimization module, based on a visual dashboard, analyzes the commonalities and root causes of abnormal nodes and optimizes the strategies accordingly.

[0093] Example 2

[0094] This embodiment further discloses a method for identifying abnormal nodes based on behavioral trajectory chains, as described in Embodiment 1. Figure 2 As shown, the specific content includes:

[0095] Two core data categories were extracted from the behavioral trajectory chain: one is the timestamp sequence, which is organized into a set of continuous time nodes according to the order of operations; the other is the node attribute set, which matches the five types of labeled attributes of each node according to the corresponding timestamp, forming a structured dataset corresponding to timestamps and attributes. The five types of labeled attributes include operation type, sensitivity level of visual elements, terminal device model, network environment, and approval status label.

[0096] The full set of 10 categories of complete information contains a large amount of non-risk-related data, such as MAC address, operating system version, and department name. If all of these are included in the node attribute set, it will increase the computational load of data splitting, storage, and verification, resulting in a decrease in the speed of anomaly identification. Extracting the above 5 core attributes allows the system to focus on the core risk dimensions and avoid redundant data occupying computational resources.

[0097] Based on the obtained structured dataset, time continuity and logical correlation checks are performed on each node to filter out nodes with anomalies, including:

[0098] Time continuity check: If the timestamp interval between the first node and the previous adjacent operation node is within the normal industrial operation time range, it indicates that the time continuity is normal; otherwise, it indicates that the time continuity is abnormal. Since the first node has no preceding operation node, there is no basis for judging the timestamp interval, and it is assumed that the node's time continuity is normal.

[0099] Logical correlation verification is performed only if both access scenario compliance and operation-sensitivity level adaptation requirements are met; otherwise, it is judged as logical correlation abnormal.

[0100] Access scenario compliance refers to meeting one of the following conditions: ① The terminal device model is an internal terminal and the network environment is an intranet; ② When the terminal device model is an external terminal, the network environment is a VPN or public network and the approval status is approved.

[0101] Operation-sensitivity level adaptation refers to meeting one of the following conditions: ① When the sensitivity level of the visual element is high, the operation type is only allowed to perform viewing and desensitization triggering; ② When the sensitivity level of the visual element is medium or low, the operation type is only allowed to perform viewing, drill-down, and permission request; ③ Regardless of the sensitivity level of the visual element, as long as the operation type is export, the approval status must be approved.

[0102] If a node exhibits any anomaly in either the time continuity check or the logical correlation check, it is marked as an anomalous node, and a corresponding structured label is generated for that anomalous node, including:

[0103] The timestamp features and core attribute features of the abnormal node are obtained. The timestamp features include the absolute time value and the timestamp interval with the previous adjacent operation node. The core attribute features include the operation type, terminal device model, network environment, and approval status.

[0104] The timestamp feature, core attribute feature, and anomaly type are bound together to obtain a set of tag elements for the anomaly node: If it is a time continuity anomaly, the "timestamp interval with the previous adjacent operation node" in the timestamp feature and the "operation type" in the core attribute feature are included in the tag element set; if it is a logical correlation anomaly, the "absolute time value" in the timestamp feature and the "operation type, terminal device model, network environment, and approval status" in the core attribute features are included in the tag element set; if it is a time continuity anomaly and a logical correlation anomaly, both the timestamp feature and the core attribute feature are included in the tag element set.

[0105] Using the anomaly type as a prefix, the set of tag elements is combined according to the corresponding logical order to form structured tags. The corresponding logical order specifically refers to: if it is a time continuity anomaly, it is sorted according to "operation type → timestamp interval with the previous adjacent operation node"; if it is a logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value"; if it is a time continuity anomaly + logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value → timestamp interval with the previous adjacent operation node".

[0106] Example 3

[0107] This embodiment further discloses a strategy optimization method based on Embodiments 1 and 2, such as... Figure 3 The specific process is as follows:

[0108] Based on the heatmap and pie chart of the statistical layer, extract the top 3 most frequently accessed highly sensitive visual elements and the set of visual elements whose corresponding sensitivity level usage accounts for more than 40%, and mark them as the high-frequency and high-sensitivity visual element set.

[0109] Based on the bar chart of the statistical layer and the abnormal node data of the risk layer, the top 5 departments with the highest operation frequency in the bar chart are first selected. Then, from all abnormal nodes in the risk layer, nodes belonging to the top 5 departments and whose structured labels contain "view or export + no approval" are extracted to obtain the set of departments to which these nodes belong and are marked as the set of high-frequency operation departments.

[0110] The set of high-frequency, high-sensitivity visualization elements is combined with the set of high-frequency operating departments and the set of low-frequency operating departments, respectively, to obtain two sets of high-frequency visualization elements: Set 1 and Set 2. The specific operation is as follows:

[0111] For each department in the set of high-frequency operation departments or the set of low-frequency operation departments, match each visualization element in the set of high-frequency and high-sensitivity visualization elements one by one, and count the access frequency of each visualization element. If the access frequency of a visualization element is greater than or equal to 1.5 times the average access frequency of all visualization elements in the department, then include it in the high-frequency visualization element set of the department. Finally, find the intersection of the high-frequency visualization element sets corresponding to all departments in the set of high-frequency operation departments or the set of low-frequency operation departments to obtain high-frequency visualization element set one and high-frequency visualization element set two.

[0112] For the set of high-frequency visual elements, these visual elements are the focus of attention for multiple departments that operate frequently and have no approval risk. Taking them as a core optimization target can allow the optimization of permissions and desensitization strategies to focus on the high-risk visual elements with the widest impact.

[0113] For the second set of high-frequency visualization elements, non-high-frequency departments should access high-sensitivity visualization elements less frequently. However, these visualization elements are accessed frequently by multiple non-high-frequency departments, which may lead to issues such as permission abuse and business overstepping. Therefore, it can be used as another core optimization target to fill the security vulnerabilities caused by focusing only on high-frequency departments.

[0114] Strategy optimization is performed based on two sets of high-frequency visualization elements, specifically including:

[0115] After obtaining the first set of high-frequency visualization elements, retain the viewing permissions of each department in the high-frequency operation department set for the visualization elements in the high-frequency visualization element set, cancel the export permission without approval, and export requires approval from the direct administrator. At the same time, when viewing the target visualization elements, the default is medium anonymization, and when exporting, it is automatically upgraded to high anonymization.

[0116] After obtaining the second set of high-frequency visualization elements, directly cancel the unapproved access permissions of each department in the non-high-frequency operation department set to the visualization elements in the high-frequency visualization element set. It is necessary to initiate a cross-departmental collaboration application and obtain approval from the head of the department to which the target visualization element belongs. At the same time, after approval, only basic anonymized viewing permissions are granted, and export is prohibited.

[0117] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0118] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. An industrial big data visualization management system based on big data analytics, characterized in that: include: The data acquisition module collects three-dimensional information on the permission operations and de-identification behaviors of all visualization elements in the industrial visualization system to obtain full audit data. The three-dimensional information includes subject information, behavior information, and scene association information. The data analysis module performs structured integration of all audit data, obtaining a single entity's full-process operation trajectory chain and a single element's full access trajectory chain. At the same time, the two are combined to obtain a behavior trajectory chain, and abnormal nodes are identified based on the behavior trajectory chain. The visual early warning module constructs a dedicated audit visualization dashboard, visually presenting the behavioral trajectory chain and abnormal nodes in two layers: statistical layer and risk layer. The strategy optimization module, based on a visual dashboard, analyzes the commonalities and root causes of abnormal nodes and optimizes the strategies accordingly.

2. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The main information includes the operator's identity identifier and login account. The operator's identity identifier includes name and department. The behavioral information includes details of the visual elements of the operation, operation type, operation timestamp, and operation result. The details of the visual elements of the operation include name, sensitivity level, and function type. The operation type is one of viewing, exporting, drilling down, requesting permissions, or triggering desensitization. The operation result is one of success or failure. The scenario association information includes details of the access terminal, network environment, business scenario, and approval status. The access terminal details include device model, MAC address, and operating system. The network environment is one of intranet, public network, or VPN. The business scenario is one of daily office work, cross-departmental collaboration, external auditing, or remote operation and maintenance. The approval status is one of approval or no approval.

3. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps to obtain the full-process operation trajectory chain of a single subject and the full access trajectory chain of a single element are as follows: Using "login account + operation timestamp" as the core association key, scattered individual operation records are integrated into structured data units: each data unit contains 10 categories of complete information, including operator identity, login account, details of the operation's visual elements, operation type, operation timestamp, operation result, access terminal details, network environment, business scenario, and approval status. Using the login account as the unique identifier, all data units of the account are sorted in ascending order by the operation timestamp to form a single entity's full-process operation trajectory chain; Using the name of the visualized element being operated on as a unique identifier, all data units accessing that visualized element are sorted in ascending order by the operation timestamp, and the access frequency is counted to form a single-element full access trajectory chain.

4. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps to obtain the behavioral trajectory chain are as follows: Using "login account + operation timestamp + operation visual element name" as the joint unique association key, all data units of the single subject full-process operation trajectory chain and the single element full access trajectory chain are matched: the visual element name of the operation corresponding to the same login account under the same operation timestamp of the two chains is identified. If the two names are the same, it indicates that it is a duplicate operation record, and only one complete data unit needs to be retained. For independent records that are not matched, they are all retained as independent data units. Using the single-subject full-process operation trajectory chain as the main line, the unmatched independent records in the single-element full access trajectory chain are regarded as visual element association branches and embedded under the corresponding visual element operation node of the main line. That is, the main line node retains the complete information of the subject's own operation, and the branch nodes mark the access information of other subjects, thus obtaining the behavior trajectory chain.

5. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps for identifying abnormal nodes based on behavioral trajectory chains are as follows: Two core data categories are extracted from the behavioral trajectory chain: one is the timestamp sequence, which is organized into a set of continuous time nodes according to the order of operations; the other is the node attribute set, which matches the five types of labeled attributes of each node according to the corresponding timestamp, forming a structured dataset corresponding to timestamps and attributes. The five types of labeled attributes include operation type, sensitivity level of visual elements, terminal device model, network environment, and approval status. Based on the obtained structured dataset, time continuity and logical correlation checks are performed on each node, including: Time continuity check: If the timestamp interval between the node and the previous adjacent operation node is within the normal industrial operation time range, it indicates that the time continuity is normal; otherwise, it indicates that the time continuity is abnormal. The first node is considered to have normal time continuity by default. Logical correlation verification is performed only if both access scenario compliance and operation-sensitivity level adaptation requirements are met; otherwise, it is judged as logical correlation abnormal. If a node exhibits any anomaly in either the time continuity check or the logical correlation check, it is marked as an abnormal node, and a structured label corresponding to that abnormal node is generated.

6. The industrial big data visualization management system based on big data analysis according to claim 5, characterized in that, The compliance of the access scenario refers to meeting one of the following conditions: ① The terminal device model is an internal terminal and the network environment is an intranet; ② When the terminal device model is an external terminal, the network environment is a VPN or public network and the approval status is approved. The operation-sensitivity level adaptation refers to meeting one of the following conditions: ① When the sensitivity level of the visual element is high, the operation type is only allowed to perform viewing and desensitization triggering; ② When the sensitivity level of the visual element is medium or low, the operation type is only allowed to perform viewing, drill-down, and permission request; ③ Regardless of the sensitivity level of the visual element, as long as the operation type is export, the approval status must be approved.

7. The industrial big data visualization management system based on big data analysis according to claim 5, characterized in that, The structured tags that form the corresponding abnormal nodes specifically include: The timestamp features and core attribute features of the abnormal node are obtained. The timestamp features include the absolute time value and the timestamp interval with the previous adjacent operation node. The core attribute features include the operation type, terminal device model, network environment, and approval status. The timestamp feature, core attribute feature, and anomaly type are bound together to obtain a set of tag elements for the anomaly node: If it is a time continuity anomaly, the "timestamp interval with the previous adjacent operation node" in the timestamp feature and the "operation type" in the core attribute feature are included in the tag element set; if it is a logical correlation anomaly, the "absolute time value" in the timestamp feature and the "operation type, terminal device model, network environment, and approval status" in the core attribute features are included in the tag element set; if it is a time continuity anomaly and a logical correlation anomaly, both the timestamp feature and the core attribute feature are included in the tag element set. Using the anomaly type as a prefix, the set of tag elements is combined according to the corresponding logical order to form structured tags. The corresponding logical order specifically refers to: if it is a time continuity anomaly, it is sorted according to "operation type → timestamp interval with the previous adjacent operation node"; if it is a logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value"; if it is a time continuity anomaly + logical correlation anomaly, it is sorted according to "operation type → terminal device model → network environment → approval status → absolute time value → timestamp interval with the previous adjacent operation node".

8. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps for visualizing the data in the form of statistical layers are as follows: Using behavioral trajectory chains and structured labels of abnormal nodes as data sources, access frequency data is aggregated by the name of the visualized element, operation frequency data is aggregated by the department of the operator's identity, and usage frequency data is aggregated by the sensitivity level of the visualized element. The data on access frequency of visual elements is matched with a heatmap, with the name of the visual element on the horizontal axis and access frequency on the vertical axis, and the color intensity corresponding to the frequency. The data on department operation frequency is matched with a bar chart, with the department on the horizontal axis and operation frequency on the vertical axis. The data on the percentage of use frequency of the sensitivity level of visual elements is matched with a pie chart, with the sensitivity level of the visual element as the category and the usage frequency as the percentage. Clicking on the color block corresponding to a visualization element in a heatmap will automatically retrieve the complete behavioral trajectory chain data of that visualization element; clicking on a bar in a bar chart will automatically filter out the behavioral trajectory chain data of all operators in that department; clicking on a sector of the sensitivity level of a visualization element in a pie chart will automatically summarize all visualization elements corresponding to that sensitivity level.

9. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps for visualizing risk layers are as follows: If it is a time continuity anomaly label, then extract the timestamp interval with the previous adjacent operation node from the label element set, and calculate the difference t between the timestamp interval with the previous adjacent operation node and the benchmark value of the normal operation interval in the industrial scenario: if |t|∈[0,tmax], then it is judged as a potential risk, and if |t|>tmax, then it is judged as a high risk, where tmax is the difference threshold. If the tag is a logically related abnormal tag, the operation type, terminal device model, network environment, and approval status are extracted from the tag element set in sequence and combined. If the combination is consistent with the combination of "view or export + external terminal + public network + no approval", it is judged as high risk; if the combination is consistent with the combination of "view or export + internal terminal + intranet + no approval", it is judged as potential risk. If the labels are for both time continuity anomaly and logical correlation anomaly, it is directly judged as high risk; High-risk abnormal nodes are displayed in reverse chronological order and marked with a red background; potentially risky abnormal nodes are marked with a yellow background; all abnormal nodes need to be associated with a corresponding behavioral trajectory chain code. When a new structured tag is added to an abnormal node in the system, a real-time alert is automatically triggered: a red or yellow alert pop-up appears in the risk layer of the dashboard, and the structured tag and the associated behavioral trajectory chain code are pushed to the administrator via system message or SMS. The administrator can directly jump to the corresponding statistics layer to view the details by clicking the alert pop-up.

10. The industrial big data visualization management system based on big data analysis according to claim 1, characterized in that, The specific steps for strategy optimization are as follows: Based on the heatmap and pie chart of the statistical layer, extract the top 3 most frequently accessed highly sensitive visual elements and the set of visual elements whose corresponding sensitivity level usage accounts for more than 40%, and mark them as the set of high-frequency and high-sensitivity visual elements. Based on the bar chart of the statistical layer and the abnormal node data of the risk layer, the top 5 departments with the highest operation frequency in the bar chart are first selected. Then, from all abnormal nodes in the risk layer, nodes belonging to the top 5 departments and whose structured labels contain "view or export + no approval" are extracted to obtain the set of departments to which these nodes belong and are marked as the set of high-frequency operation departments. For each department in the set of high-frequency operation departments or the set of low-frequency operation departments, match each visualization element in the set of high-frequency and high-sensitivity visualization elements one by one, and count the access frequency of each visualization element. If the access frequency of a visualization element is greater than or equal to 1.5 times the average access frequency of all visualization elements in that department, then include it in the high-frequency visualization element set of that department. At the same time, find the intersection of the high-frequency visualization element sets corresponding to all departments in the set of high-frequency operation departments or the set of low-frequency operation departments to obtain high-frequency visualization element set one and high-frequency visualization element set two. Strategy optimization is performed based on two sets of high-frequency visualization elements, specifically including: After obtaining the first set of high-frequency visualization elements, retain the viewing permissions of each department in the high-frequency operation department set for the visualization elements in the high-frequency visualization element set, cancel the export permission without approval, and export requires approval from the direct administrator. At the same time, when viewing the target visualization elements, the default is medium anonymization, and when exporting, it is automatically upgraded to high anonymization. After obtaining the second set of high-frequency visualization elements, directly cancel the unapproved access permissions of each department in the non-high-frequency operation department set to the visualization elements in the high-frequency visualization element set. It is necessary to initiate a cross-departmental collaboration application and obtain approval from the head of the department to which the target visualization element belongs. At the same time, after approval, only basic anonymized viewing permissions are granted, and export is prohibited.

Images