Unified access and intelligent analysis system and method for multi-source heterogeneous data

Abstract

The application discloses a unified access and intelligent analysis system and method for multi-source heterogeneous data, relates to the technical field of monitoring and analysis, and comprises the following steps: constructing a composite intention baseline based on equipment state monitoring data and production operation data, wherein the composite intention baseline comprises a planned intention submodel and a cooperative intention submodel; inputting a target control instruction into a digital twin simulation engine in response to receiving the target control instruction, and deducing physical impact prediction data; comparing the physical impact prediction data with the planned intention submodel and the cooperative intention submodel respectively, and generating a multi-dimensional conflict vector; when each deviation degree data in the multi-dimensional conflict vector does not exceed a preset safety threshold, starting a deep verification cycle to update threat confidence; and performing a differentiated response operation on the target control instruction based on the threat confidence. The application has the effect of improving data access and analysis efficiency.

Description

Technical Field

[0001] This application relates to the field of monitoring and analysis technology, and in particular to a unified access and intelligent analysis system and method for multi-source heterogeneous data. Background Technology

[0002] In the fields of Industrial Internet and intelligent manufacturing, with the continuous improvement of the networking level of industrial control systems, various programmable logic controllers, distributed control systems, and intelligent sensors are interconnected through standard industrial protocols, forming a large-scale, multi-source, heterogeneous data network. To ensure the continuity and security of industrial production, traditional industrial control systems typically deploy security measures such as firewalls, intrusion detection systems, and protocol whitelists. These protective measures are mainly based on technical principles such as network layer access control, protocol format compliance verification, and matching with known attack signature databases. They identify and block potential threats by setting static access rules and predefined abnormal patterns.

[0003] However, with the evolution of cyberattack techniques, attacks targeting industrial control systems are becoming increasingly sophisticated and sophisticated. Attackers, by infiltrating outdated or poorly protected programmable logic controllers (PLCs), hijack control of legitimate devices and issue commands that perfectly conform to industry standards at the protocol syntax level, with command values ​​within preset normal ranges. Such attacks are indistinguishable from normal operations in terms of data format and network traffic characteristics, thus easily bypassing traditional detection mechanisms based on syntax verification and signature matching. More seriously, these commands disguised as legitimate operations, once executed, can have cumulative adverse effects or sudden disruptions to the physical production process. For example, issuing shutdown commands during non-maintenance periods or making small but continuous deviations in equipment parameters can ultimately lead to equipment damage, decreased product quality, or even production safety accidents. Traditional security solutions are powerless against such high-level semantic layer attacks because they cannot understand the operational intent behind the commands or perceive the destructive impact on upstream and downstream equipment collaboration and production plans after command execution.

[0004] Furthermore, existing industrial safety systems often fragment data from different sources when processing multi-source heterogeneous data. Equipment status monitoring data is used only for equipment health management, production operation data is used only for production scheduling, and command flow data is used only for control execution, lacking effective correlation and fusion analysis between the data. This data silo phenomenon prevents safety analysis models from establishing dynamic correlations between equipment behavior and production plans and system coordination, making it impossible to accurately determine whether a seemingly compliant control command truly meets current production intentions and system coordination requirements. When equipment's normal behavior range drifts due to aging, environmental changes, or production plan adjustments, static rule models cannot adaptively adjust, leading to increased false alarm rates or frequent missed alarms.

[0005] To address the aforementioned issues, there is an urgent need in this field for an industrial data access and intelligent analysis method that can deeply integrate multi-source heterogeneous data, understand the semantic intent of instructions, perceive the impact of physical processes, and possess dynamic adaptive capabilities. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this application provides a unified access and intelligent analysis system and method for multi-source heterogeneous data.

[0007] Firstly, this application provides a unified access and intelligent analysis method for multi-source heterogeneous data, including the following steps: Access to multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data; Based on the equipment status monitoring data and the production operation data, a composite intent baseline is constructed for the target controlled unit. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. In response to receiving a target control command, the target control command is input into a digital twin simulation engine, which infers physical impact prediction data based on the target control command and equipment status monitoring data. The physical impact prediction data is compared with the planned intent sub-model and the collaborative intent sub-model to generate a multi-dimensional conflict vector, which includes at least first deviation data and second deviation data. When none of the deviation data in the multidimensional conflict vector exceeds the preset safety threshold, a deep verification loop is started. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. Based on the threat confidence level, a differentiated response operation is performed on the target control command.

[0008] Secondly, this application provides a unified access and intelligent analysis system for multi-source heterogeneous data, including: The data access module is used to access multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data. The construction module is used to construct a composite intent baseline for the target controlled unit based on the equipment status monitoring data and the production operation data. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. The deduction module is used to respond to the received target control command by inputting the target control command into the digital twin simulation engine, and the digital twin simulation engine deduces physical impact prediction data based on the target control command and equipment status monitoring data. The comparison module is used to compare the physical impact prediction data with the planning intention sub-model and the collaborative intention sub-model respectively, and generate a multi-dimensional conflict vector, wherein the multi-dimensional conflict vector includes at least a first deviation data and a second deviation data. The verification module is used to start a deep verification loop when none of the deviation data in the multidimensional conflict vector exceeds a preset safety threshold. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. The response module is used to perform differentiated response operations to the target control commands based on the threat confidence level.

[0009] In summary, this application includes at least one of the following beneficial technical effects: 1. This application provides a unified access and intelligent analysis method for multi-source heterogeneous data. By accessing instruction stream data, equipment status monitoring data, and production operation data, it constructs a composite intent baseline for the target controlled unit, which includes a planning intent sub-model and a collaborative intent sub-model. This elevates the security analysis capability from the traditional syntax layer to the semantic-intent layer, enabling the system to perceive the profound impact of instruction execution on production planning and system collaboration. This fundamentally solves the problem of the difficulty in identifying unknown attacks disguised as legitimate operations, and significantly improves the defense capability of industrial control systems against advanced persistent threats. 2. By introducing a digital twin simulation engine and a multi-dimensional conflict vector generation mechanism, quantitative evaluation of the physical consequences of control commands and multi-dimensional intention deviation detection are achieved. Upon receiving a target control command, the digital twin simulation engine derives physical impact prediction data based on the target control command and real-time status data. This physical impact prediction data is then compared with the planned intention sub-model and the collaborative intention sub-model to generate a multi-dimensional conflict vector containing first and second deviation data. This achieves a comprehensive quantification of the degree to which commands interfere with production plan execution and disrupt system collaboration. When the initial detection does not exceed the safety threshold, a deep verification loop is further initiated. Through iterative optimization, the optimal compromise path is explored, and the threat confidence is dynamically updated. Within the negotiable range, alternative command sequences that meet operational requirements while minimizing conflict are proactively sought. This overcomes the binary decision-making limitations of traditional safety solutions that either block or allow, achieving a dynamic balance between flexible protection of industrial production and production continuity. 3. An integrated environmental adaptive baseline update, prediction confidence assessment, and multi-objective conflict resolution enhancement mechanisms form a complete dynamic protection system. The introduction of environmental context data enables the collaborative intent sub-model to adjust network weights in real time based on time characteristics, shift characteristics, and maintenance event data, ensuring the baseline model always adapts to the current operating conditions. The prediction confidence assessment network quantifies the reliability of the current inference results using prior knowledge of historical error distribution, automatically expanding the search range of the deep verification loop when confidence is insufficient, enhancing the system's robustness under uncertain model prediction conditions. The multi-objective conflict resolution step, targeting concurrent command scenarios, generates dynamically adjusted command execution sequences through composite influence inference, priority ranking, and state iterative updates, effectively avoiding equipment risks caused by multiple command conflicts. This constructs a complete technology chain from intent understanding, conflict detection, deep verification to adaptive response, providing industrial control systems with an active defense solution possessing dynamic perception, intelligent decision-making, and closed-loop optimization capabilities. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of a method for unified access and intelligent analysis of multi-source heterogeneous data according to an embodiment of this application.

[0012] Figure 2 This is a schematic diagram of a system for unified access and intelligent analysis of multi-source heterogeneous data according to an embodiment of this application. Detailed Implementation

[0013] The following description, in conjunction with the implementation of this invention, is merely an example and illustration of the concept of this invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the inventive concept or exceed the scope defined in these claims, all of which should fall within the protection scope of this invention.

[0014] Example 1: This application discloses a unified access and intelligent analysis method for multi-source heterogeneous data.

[0015] Reference Figure 1 A unified access and intelligent analysis method for multi-source heterogeneous data includes the following steps: Access to multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data; Based on the equipment status monitoring data and the production operation data, a composite intent baseline is constructed for the target controlled unit. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. In response to receiving a target control command, the target control command is input into a digital twin simulation engine, which infers physical impact prediction data based on the target control command and equipment status monitoring data. The physical impact prediction data is compared with the planned intent sub-model and the collaborative intent sub-model to generate a multi-dimensional conflict vector, which includes at least first deviation data and second deviation data. When none of the deviation data in the multidimensional conflict vector exceeds the preset safety threshold, a deep verification loop is started. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. Based on the threat confidence level, a differentiated response operation is performed on the target control command.

[0016] Specifically, command stream data refers to control command messages transmitted in industrial control networks. This can be achieved through industrial Ethernet switch port mirroring or industrial firewall log collection. It is used to parse control intent elements such as operation objects, operation types, and operation values. Equipment status monitoring data refers to continuous time-series data reflecting the operating status of equipment collected through sensor networks. This can be achieved through PLC register reading or SCADA system historical database query. It is used to obtain real-time operating frequency, load rate, temperature, and other status parameters of the equipment. Production operation data refers to production management information stored in manufacturing execution systems or enterprise resource planning systems. This can be achieved through API interface calls or database view access. It is used to extract planning intent information such as production work orders, production scheduling plans, and standard operating procedures.

[0017] Among them, the planning intent sub-model refers to the expected state prediction model built based on production and operation data. Specifically, it can be implemented through time series analysis or production plan parsing algorithms. It is used to define the state sequence that the controlled unit should present within the current time window. The collaborative intent sub-model refers to the system collaborative relationship model learned through graph neural networks based on equipment status monitoring data. Specifically, it can be implemented using graph convolutional networks or graph attention networks. It is used to characterize the normal temporal correlation characteristics between upstream and downstream equipment.

[0018] Among them, the target control instruction refers to the industrial control instruction currently to be processed, which can be captured and parsed in real time from the instruction stream data and used as the input object for intention deviation detection.

[0019] Among them, the digital twin simulation engine refers to a virtual simulation system built based on the device mechanism model. Specifically, it can be implemented using physical equations such as first-order inertial links and thermal network models or data-driven neural network models. It is used to deduce the physical impact on the controlled unit and its associated equipment after the execution of control commands. The physical impact prediction data refers to the state change trajectory output by the digital twin simulation engine, which specifically includes the frequency, current, and temperature change sequence of the controlled unit itself over time, as well as the state offset estimate of the associated equipment, and is used to quantify the physical consequences after the execution of commands.

[0020] The deep verification loop refers to the iterative verification process initiated when the initial conflict detection has not exceeded the threshold. Specifically, it includes exploring alternative instruction sequences based on multi-dimensional conflict vectors, generating alternative impact prediction data, and iteratively comparing and updating threat confidence. This is used to find the optimal compromise solution within the negotiable range. The alternative instruction sequence refers to one or more candidate operation sequences obtained through the search space exploration in the deep verification loop. Specifically, it can be generated by perturbing the operation values ​​of the original instructions. This is used to evaluate whether there are alternative solutions that can both meet operational requirements and reduce conflict. Threat confidence is a quantitative assessment value of the maliciousness of the target control instruction based on the results of the deep verification loop. Specifically, it can be calculated by weighting the deviation between the norm of the initial conflict vector and the optimal compromise path. This is used as the decision basis for differentiated response operations. Differentiated response operations refer to different actions taken to handle the target control instruction according to the threat confidence. Specifically, these include allowing trusted instructions, intercepting and replacing them with alternative instructions, blocking malicious data sources and generating attack evidence packages, which are used to achieve precise security protection.

[0021] The working process and principle of this application are as follows: First, multi-source heterogeneous data is accessed, including command stream data, equipment status monitoring data, and production operation data. Based on the equipment status monitoring data and the production operation data, a composite intent baseline is constructed for the target controlled unit. This baseline includes a planned intent sub-model generated based on the production operation data and a collaborative intent sub-model dynamically generated based on the equipment status monitoring data through graph neural network learning of the temporal correlation between upstream and downstream equipment. Then, in response to receiving the target control command, the target control command is input into the digital twin simulation engine. This engine derives physical impact prediction data based on the target control command and the equipment status monitoring data. Subsequently, the physical impact prediction data is compared with the planned intent sub-model and the collaborative intent sub-model, respectively. The graph model is compared to generate a multidimensional conflict vector. This vector includes at least first deviation data and second deviation data. When none of the deviation data in the multidimensional conflict vector exceeds a preset safety threshold, a deep verification loop is started. This loop includes exploring at least one alternative instruction sequence based on the multidimensional conflict vector and re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data. The alternative impact prediction data is iteratively compared with the multidimensional conflict vector to update the threat confidence. Finally, based on the threat confidence, a differentiated response operation is performed on the target control instruction. In this way, deep security detection and dynamic protection of industrial control instructions from the semantic layer to the intent layer are achieved, ensuring the safe and continuous operation of the industrial production process.

[0022] Furthermore, the target control commands are input into the digital twin simulation engine to deduce physical impact prediction data, specifically including: The target control command is parsed to extract the operation object code, operation type code, and operation value; Based on the operation object code, the corresponding current status parameter set is retrieved from the equipment status monitoring data. The current status parameter set includes at least the current operating frequency, current load rate, and current temperature value. The operation type code, the operation value, and the current state parameter set are input into the digital twin simulation engine. The digital twin simulation engine has an embedded device mechanism model. The device mechanism model calculates the state change trajectory data based on the operation value and the current state parameter set. The state change trajectory data is time-series aligned with the historical state data of the upstream and downstream devices to generate physical impact prediction data.

[0023] In one specific embodiment, the process of inputting target control commands into a digital twin simulation engine to deduce physical impact prediction data begins by performing deep packet inspection on real-time captured industrial Ethernet packets. Application layer data units are extracted from the packets according to protocol specifications, from which the operation object code, operation type code, and operation value are parsed. Subsequently, based on the operation object code, the latest record of the device at the current moment is retrieved from the device status monitoring database to obtain the current status parameter set: current operating frequency. Current load rate Current temperature The above operation type codes, operation values, and current state parameter sets are input into the digital twin simulation engine, which has a pre-built device mechanism model for specific device types. Taking a variable frequency motor as an example, its dynamic response model uses a first-order inertial element to describe frequency changes: in, For the target frequency, The frequency response time constant (preset based on motor power and load inertia) is used to calculate the frequency variation over time. Simultaneously, based on the motor's electromagnetic torque equation, the relationship between current, frequency, and load rate can be simplified as follows: in, Rated current, The rated frequency is used to obtain the current variation trajectory. Further considering the motor temperature rise, a thermal network model is adopted: in, Equivalent resistance For heat dissipation coefficient, For heat capacity, Let the ambient temperature be the solution. This differential equation can be solved by numerical integration to obtain the temperature. Curves showing changes over time. The above sequences of frequency, current, and temperature changes over time together constitute the trajectory data of state change.

[0024] Then, the generated state change trajectory data is time-aligned with the historical state data of upstream and downstream equipment to assess the impact of the operation on the system's collaborative relationship. Specifically, the inlet pressure and flow response patterns of downstream equipment under the same historical operating conditions, as well as the opening change records of upstream equipment, are extracted from the equipment status monitoring database. A dynamic time warping algorithm is used to match the currently predicted motor frequency trajectory with the inlet flow fluctuation sequence of downstream equipment in historical data, identifying the most similar response segments to predict the potential flow change and its time delay after this operation. Simultaneously, a graph neural network model is used to input the currently predicted motor frequency and current trajectories into the collaborative intent sub-model, outputting the expected state range of downstream equipment under the current collaborative relationship. The two are combined to generate physical impact prediction data. This prediction data includes the state change trajectory of the controlled unit itself and the state offset estimate of associated equipment, providing a quantitative basis for subsequent multi-dimensional conflict vector calculations.

[0025] Furthermore, generating multidimensional conflict vectors specifically includes: The physical impact prediction data is input into the planning intention sub-model, and the time axis offset and numerical axis offset between the physical impact prediction data and the expected state sequence within the preset production plan window are calculated. The time axis offset and numerical axis offset are weighted and summed to obtain the first deviation data. The physical impact prediction data is input into the collaborative intent sub-model, the hidden layer representation of the physical impact prediction data is extracted in the graph neural network, and the Mahalanobis distance between the hidden layer representation and the preset collaborative state cluster center is calculated to obtain the second deviation data. The first deviation data and the second deviation data are concatenated into a multi-dimensional vector, and each dimension of the multi-dimensional vector corresponds to a preset intention dimension; The multidimensional vector is labeled as a multidimensional conflict vector.

[0026] In one specific embodiment, generating a multidimensional conflict vector specifically includes: firstly, inputting physical impact prediction data into the planning intent sub-model, which contains the controlled unit and its associated equipment within a future time window. The sequence of state changes within, denoted as , where each state vector It includes multiple physical quantities such as frequency, current, and temperature. The planned intent sub-model extracts the desired state sequence within a preset production plan window from the production and operation data. This sequence, generated based on production work orders, standard operating procedures, and bills of materials, reflects the state that the equipment should be in during the current time period. To quantify the deviation between the predicted physical impact data and the expected state sequence, a dynamic time warping algorithm is used to calculate the time axis offset between the two. This offset reflects the degree to which the actual state change leads or lags behind the planned state change in the time dimension, and its calculation formula is as follows: in, To predict the state in the sequence The actual time point, The average time offset is obtained by subtracting the two time points from the planned time sequence, taking the absolute values ​​of the subtractions, and then summing and averaging the sums. Simultaneously, the numerical axis offset is calculated. This offset reflects the degree of deviation in the state amplitude and is calculated using the root mean square error: in, The Euclidean norm is used to calculate the spatial distance between multidimensional state vectors, and the result has the same composite dimensions as the original physical quantity. Considering the varying importance of time precision and numerical precision in different production scenarios, a preset time weighting coefficient is introduced. Sum of weighting coefficients And satisfy The first deviation data is obtained by weighted summation of the time axis offset and the value axis offset: in, For time normalization factor, Both are numerical normalization factors, used to normalize offsets of different dimensions to the same scale. and The pre-set logic is based on the characteristics of the production process: for production lines with strict cycle times, timing accuracy is even more critical, and can be... Set to 0.7 Set to 0.3; for quality-sensitive processes, numerical accuracy is more critical, and can be set to 0.3. Set to 0.3 Set to 0.7; a value of 7 is recommended for balanced scenarios. .

[0027] The physical impact prediction data is then input into the collaborative intent sub-model, which is built on a graph neural network. Its input consists of the current state prediction data of the controlled unit and its upstream and downstream devices. After multiple layers of graph convolution operations, a fixed-dimensional hidden layer representation vector is output at the penultimate layer of the network. ,in, The hidden layer dimension (preset to 128 dimensions) comprehensively encodes the semantic information of the current predicted state within the overall system's collaborative relationships. During the training phase, the collaborative intent sub-model, based on a large amount of historical normal operation data, uses a clustering algorithm (such as K-Means) to cluster the hidden layer representations under normal operating conditions, obtaining... Pre-defined collaborative state clustering centers Each cluster center This represents the baseline characteristics of the system under a certain typical cooperative mode. To quantify the deviation between the current predicted state and the normal cooperative mode, the hidden layer representation is calculated. Mahalanobis distances between cluster centers: in, The covariance matrix (dimension) of the hidden layer representation of the training data. Mahalanobis distance is used to eliminate the correlation effects between different feature dimensions and to perform scale normalization. Compared to Euclidean distance, Mahalanobis distance has the advantage of considering the correlation and scale differences between feature dimensions, thus more accurately reflecting the true degree of deviation in high-dimensional feature spaces. The minimum distance among all cluster centers is taken as the second bias metric. This value is a dimensionless number that represents the degree of anomaly between the current predicted state and the closest normal cooperative pattern.

[0028] Finally, the first deviation degree is... Second deviation data Concatenate into a multidimensional vector Each dimension in this vector corresponds to the planning intent dimension and the collaboration intent dimension, respectively. The concatenated multidimensional vector is labeled as a multidimensional conflict vector. This multidimensional conflict vector is used for subsequent threat confidence assessment. It simultaneously includes the degree to which command execution interferes with plan execution and the degree to which it disrupts system coordination, providing a quantitative basis for comprehensively assessing the maliciousness of commands.

[0029] Furthermore, the deep verification loop also includes an iterative optimization process, which specifically includes: The search space is initialized using the multidimensional conflict vector as the initial state, and the search space contains at least one candidate operation sequence. The candidate operation sequences are sequentially input into the digital twin simulation engine to generate corresponding candidate impact prediction data; Calculate the candidate deviation data between each candidate impact prediction data and the planned intent sub-model and the collaborative intent sub-model; The candidate deviation data is compared element by element with the multidimensional conflict vector. If any candidate deviation data is smaller than the multidimensional conflict vector in all dimensions, the candidate operation sequence corresponding to the candidate deviation data is marked as a better solution. The improved solution is used as a new benchmark for iterative calculation. The improved solution is marked as the optimal compromise path. The candidate operation sequence corresponding to the optimal compromise path is used as the alternative instruction sequence. The degree of deviation between the optimal compromise path and the target control instruction is mapped as the threat confidence level.

[0030] In a specific embodiment, the iterative optimization process in the deep verification loop specifically includes: firstly, using the generated multidimensional conflict vector... As the initial state, where the superscript (0) indicates the 0th iteration. Initialize the search space. The search space contains at least one candidate operation sequence. The search space is constructed based on the original operation parameters of the target control instruction, and a series of mutated instructions are generated by perturbing its operation values. Let the operation values ​​of the original instruction be... Then a set of candidate operation values ​​is generated. ,in, The preset perturbation step size sequence is discretized within the range of -20% to +20% of the original value. It is recommended that the step size increment be set to 2% of the original value. There are a total of 11 candidate values. For each candidate operation value, the operation object code and operation type code of the original instruction are combined to form a candidate operation sequence. To avoid generating physically infeasible operation instructions, all candidate operation sequences are input into the physical constraint rule engine for filtering. Candidate values ​​that exceed the device's rated range or violate safety procedures are eliminated, and the remaining candidate operation sequences constitute the initial search space. .

[0031] Then search space Each candidate operation sequence in The data is sequentially input into the digital twin simulation engine to generate corresponding candidate impact prediction data. This data contains the state change trajectories of the controlled unit and its associated equipment after the execution of the candidate operation. Next, the candidate deviation data between each candidate impact prediction data and the planned intent sub-model and the collaborative intent sub-model is calculated. Specifically, for the candidate impact prediction data generated by the i-th candidate operation sequence... Following the same method used to generate the multidimensional conflict vector, the first deviation degree between it and the planned intent sub-model is calculated respectively. and the second deviation from the collaborative intent sub-model The candidate bias vector is obtained. .

[0032] Candidate deviation vector Conflict vector with current benchmark Perform element-wise comparisons, where t represents the current iteration number. The rule for element-wise comparisons is: if there exists a candidate bias vector corresponding to a certain candidate operation sequence... The following conditions must be met: If a candidate deviation vector is strictly smaller than the current benchmark conflict vector in both dimensions, then the candidate operation sequence is marked as a better solution, and the deviation vector corresponding to the better solution is updated to the new benchmark conflict vector. At the same time, the candidate operation sequence corresponding to the better solution is marked as the current best candidate sequence. .

[0033] The search space is reconstructed using the updated, better solution as the new benchmark. Proceed to the next iteration. The search space update strategy employs an adaptive shrinking mechanism: using the operation values ​​of the current best candidate sequence... Centered on the previous round's range, the perturbation range is reduced to 50% of the previous range, which is the new perturbation step size. ,in, Let be the perturbation magnitude in the t-th round of search. A new set of candidate operation sequences is generated within the new search space, and the process of calculating candidate impact prediction data, calculating candidate bias vectors, comparing elements, and updating the better solution is repeated. This iteration continues until the preset maximum number of iterations is reached. The process terminates if (set to 5 attempts) or if no better solution is found in two consecutive rounds. The final better solution is marked as the optimal compromise path. The candidate operation sequence corresponding to this path is the alternative instruction sequence.

[0034] Finally, the degree of deviation between the optimal compromise path and the target control command is mapped to threat confidence. The degree of deviation is defined. Operational values ​​for the optimal compromise path Operands of the original instruction The relative differences between them: in, For the rated range of operating values ​​(e.g., the rated range of motor frequency 0-50Hz, then...) )), Threat confidence is a dimensionless number, ranging from [0,1]. The calculation formula is: in, Let Euclidean norm be the initial multidimensional conflict vector. This is the baseline norm of the conflict vector under pre-defined normal operating conditions (obtained from historical normal operating data, for example, 0.5). The fusion weighting coefficient (default 0.6, range 0.4-0.8) is used to balance the contribution of the initial conflict severity and the required compromise magnitude to the threat assessment. Threat confidence level. The value range is [0,1], and the larger the value, the higher the degree of malice of the instruction.

[0035] Furthermore, based on the threat confidence level, differentiated response operations are performed, specifically including: When the threat confidence level is lower than the first preset threshold, the target control command is marked as a trusted command, and the target control command is allowed to be sent to the execution unit; When the threat confidence level is between the first preset threshold and the second preset threshold, the target control instruction is marked as a negotiable instruction, the target control instruction is intercepted, and the alternative instruction sequence corresponding to the optimal compromise path is sent to the execution unit, while negotiating log data is generated. When the threat confidence level is higher than the second preset threshold, the target control command is marked as a malicious command, the data source port of the target control command is blocked, and the target control command, the multidimensional conflict vector, and the iterative optimization process of the deep verification loop are encapsulated into an attack evidence package.

[0036] Furthermore, after encapsulating the target control command, the multidimensional conflict vector, and the iterative optimization process of the deep verification loop into an attack evidence package, it also includes attack pattern matching: The similarity between the multidimensional conflict vector and each attack feature vector in the preset attack mode library is calculated to obtain a similarity score sequence. The optimization process is input into the attack behavior classifier, and the attack behavior classifier outputs the attack type identifier and the attack stage identifier. The attack pattern corresponding to the highest score in the similarity score sequence, the attack type identifier, and the attack stage identifier are associated and stored in the attack evidence package, and the attack evidence package is uploaded to the security management platform.

[0037] In one specific embodiment, performing differentiated response operations based on threat confidence specifically includes: firstly, processing the generated threat confidence... With the preset first threshold Second threshold The comparison is made, where the first threshold is... Second threshold The settings are based on statistical analysis of historical normal operation data and known attack samples. The first threshold is determined according to the protection level requirements of the actual scenario. The value ranges from 0.3 to 0.5, the second threshold. The value ranges from 0.6 to 0.8, and is taken as [value] in a balanced protection scenario. .

[0038] When threat confidence When the target control command is marked as a trusted command, the system sends a release command to the execution unit. Simultaneously, relevant information about the command (including timestamp, target, operation value, and threat confidence level) is written to the trusted log database for subsequent normal behavior baseline updates. When the threat confidence level... When a target control instruction is marked as a negotiable instruction, the system immediately intercepts it to prevent its direct issuance. Simultaneously, the generated sequence of alternative instructions (i.e., the candidate operation sequence corresponding to the optimal compromise path) is sent to the execution unit through a separate negotiation channel. To ensure production continuity, the issuance priority of the alternative instruction sequence is set higher than that of ordinary instructions, and a special negotiation identifier field is attached to inform the execution unit that the instruction is the optimized result after intent negotiation. At the same time, the system generates negotiation log data, which includes the complete content of the original instruction, the sequence of alternative instructions, and a multi-dimensional conflict vector. Threat confidence The negotiation log data, along with timestamps, is stored in a dedicated audit database and pushed to the human-machine interface of the industrial safety management platform in real time, alerting maintenance personnel with a yellow warning.

[0039] When threat confidence Upon receiving the malicious control command, the system immediately blocks it, severing the physical port or logical connection of the command's data source to prevent further data transmission. Simultaneously, the system encapsulates the target control command, multidimensional conflict vectors, and the iterative optimization process data from the deep verification loop into an attack evidence package. The attack evidence package uses a standard JSON structure and includes the following fields: command identifier (containing the operation object code, operation type code, and operation value), a hexadecimal dump of the original message, a multidimensional conflict vector array (containing the conflict vector values ​​for each iteration), an iterative optimization trajectory array (containing the candidate operation sequence and its corresponding candidate deviation vector for each iteration), the final threat confidence value, and a timestamp. This evidence package is immediately encrypted and stored in a tamper-proof forensic database after generation and uploaded to the security management platform's event response center via a dedicated alarm channel, triggering an audible and visual alarm with a red emergency alert to notify security analysts to intervene.

[0040] Furthermore, after encapsulating the target control instructions, multi-dimensional conflict vectors, and the iterative optimization process of the deep verification loop into an attack evidence package, an attack pattern matching step is also included: first, the similarity between the multi-dimensional conflict vectors and each attack feature vector in the preset attack pattern library is calculated. The preset attack pattern library is constructed based on historical attack events and red-blue team adversarial exercise data. Each attack pattern record contains an attack type identifier (such as denial-of-service attack, parameter tampering attack, timing disruption attack, etc.) and a corresponding attack feature vector. This feature vector shares the same dimension as the multidimensional conflict vector, representing typical deviation features of this attack type in the planned intent dimension and the cooperative intent dimension, respectively. Similarity is calculated using cosine similarity: in, The multidimensional conflict vector of the current instruction. Let be the feature vector of the j-th attack mode, the numerator be the dot product of the two vectors, and the denominator be the product of the magnitudes of the two vectors. The result is calculated as follows. The value ranges from [-1, 1], with values ​​closer to 1 indicating greater similarity between the current attack and the j-th attack mode. After calculating similarity scores for all attack modes, a sequence of similarity scores is obtained. The attack pattern corresponding to the highest score is taken as the matching result, and the identifier of that attack pattern is recorded. .

[0041] Simultaneously, the iterative optimization process data of the deep validation loop is input into the attack behavior classifier. This classifier employs a multilayer perceptron neural network structure, and the iterative optimization process data received by the input layer undergoes feature engineering processing: statistical features, including the number of iterations, are extracted from the iterative optimization trajectory. Initial conflict vector magnitude , final conflict vector magnitude Conflict vector decay rate The relative offset of the optimal compromise path A total of 8-dimensional feature vectors are generated. These feature vectors are then input into a pre-trained attack behavior classifier. This classifier employs a three-layer fully connected network (8 nodes in the input layer, 16 nodes in the hidden layer, 8 nodes in the hidden layer, and 6 nodes in the output layer corresponding to 6 preset attack types). After normalization using the Softmax function, the output outputs an attack type probability distribution. The attack type identifier corresponding to the maximum probability is then selected. and attack phase identifiers (Including the reconnaissance phase, intrusion phase, execution phase, persistence phase, etc.).

[0042] Finally, the attack pattern corresponding to the highest score in the similarity score sequence is selected. Attack type identifier output by the attack behavior classifier and attack phase markers The attack evidence package is associated with and its content is improved. The updated attack evidence package structure adds the following fields: attack pattern matching result (including the name of the matched attack pattern and similarity score), attack type classification result (including attack type and confidence level), and attack stage classification result. The complete attack evidence package is uploaded to the security management platform via an encrypted channel. Upon receiving the evidence package, the security management platform automatically associates it with same-origin alerts, updates the attacker profile, adjusts firewall policies, and adds the attack sample to the training dataset for incremental updates of the attack behavior classifier and optimization of feature vectors in the attack pattern library. The entire differentiated response and attack pattern matching process achieves a complete closed loop from threat assessment to response and handling to knowledge accumulation.

[0043] Furthermore, the access to multi-source heterogeneous data also includes access environment context data; the construction of the composite intent baseline also includes: Extract time feature data, shift feature data, and maintenance event data from the environmental context data; The time feature data, the shift feature data, and the maintenance event data are fused into an environmental feature tensor. The environmental feature tensor is input into a preset environmental adaptive network to generate model parameter adjustment values; The model parameter adjustment is applied to the network weights of the collaborative intent sub-model to obtain a dynamically updated collaborative intent sub-model. The dynamically updated collaborative intent sub-model is coupled with the planned intent sub-model to generate the composite intent baseline at the current moment.

[0044] Furthermore, after generating the composite intent baseline for the current moment, a baseline consistency verification step is also included: Obtain the composite intent baseline at historical moments as a reference baseline; Calculate the degree of difference between the output of each sub-model in the composite intent baseline at the current moment and the output of each sub-model in the reference baseline; If the difference exceeds a preset change threshold, a baseline drift alarm is triggered, and the composite intent baseline at the current moment is marked as pending review. In the pending review state, the use of the composite intent baseline at the current moment for deviation calculation is suspended.

[0045] In one specific embodiment, the access to multi-source heterogeneous data also includes access to environmental context data. This environmental context data comes from multiple auxiliary data sources in the industrial control system, specifically including: obtaining the current timestamp from the factory clock synchronization server and parsing it into time feature data; obtaining the current shift scheduling information from the production execution system and parsing it into shift feature data; and obtaining the most recent maintenance record and the next planned maintenance time from the equipment maintenance management system and parsing it into maintenance event data. When constructing the composite intent baseline, the environmental context data is first characterized: the time feature data adopts a periodic encoding method, mapping 24 hours of a day into two continuous components. and The values ​​are all within the range of [-1, 1], which avoids abrupt changes in hourly values ​​(e.g., 23:00 and 0:00 are close in actual time but have large numerical differences); shift feature data uses one-hot encoding, encoding the morning shift, afternoon shift, and night shift separately. Maintenance event data extraction: number of hours since the last maintenance. and hours until the next maintenance And calculate the maintenance proximity index. ,in, The mean time between failures (MTBF) is a parameter with a value range of (0,1], where a value closer to 1 indicates that maintenance is imminent. These features are then concatenated and fused to obtain the environmental feature tensor. Among them, feature dimension dimension.

[0046] Environmental feature tensor The input is a pre-defined environment-adaptive network, which employs a lightweight multilayer perceptron architecture, comprising an input layer (7 nodes), two hidden layers (16 nodes and 8 nodes respectively), and an output layer. The output layer generates the model parameter adjustments. This adjustment amount has the same data structure as the network weights of the collaborative intent sub-model, that is, for each layer weight matrix in the graph neural network. Generate the corresponding adjustment matrix The environment adaptive network is trained using a self-supervised learning approach. The differences in parameters of the collaborative intent sub-model under different environmental conditions within historical normal operation data are used as supervision signals. Optimization is achieved by minimizing the mean squared error between the predicted adjustment and the actual difference. The formula for generating the parameter adjustment is: in, For the mapping function of the environment adaptive network, These are the trainable parameters of the network. After training, for any input environment feature tensor, the network directly outputs the corresponding model parameter adjustments. .

[0047] The model parameter adjustments are applied to the network weights of the collaborative intent sub-model to obtain a dynamically updated collaborative intent sub-model. The update method uses residual connections. in, This is the weight matrix of the original collaborative intent sub-model. The adjustment matrix is ​​the output of the environment adaptive network. To adjust the step size coefficient (default is 0.1, range is 0.05-0.2), This represents element-wise multiplication. The design of this update formula is based on the following considerations: using residual form instead of direct replacement preserves the basic features of the collaborative relationships learned by the original model, while making appropriate adjustments according to environmental changes to avoid drastic model fluctuations caused by a single environmental input. Adjusting the step size coefficient... The default logic is: take a larger value (0.2) when the device is in operation or when the environment changes drastically, take a smaller value (0.05) after the model is running stably, and take 0.1 for balanced scenarios.

[0048] The dynamically updated collaborative intent sub-model is coupled with the planned intent sub-model to generate the composite intent baseline for the current moment. The coupling method is not a simple concatenation, but rather the establishment of a correlation mapping between the outputs of the two sub-models. Specifically, for any input state data... The planned intention sub-model outputs the desired state. The cooperative intention sub-model outputs a cooperative state representation. (in, For the updated model), the composite intent baseline is defined as the joint distribution of the two: in, The joint covariance matrix is ​​used to characterize the correlation between the expected value of the plan and the collaborative representation. This matrix is ​​obtained through historical data statistics and is updated regularly.

[0049] Furthermore, after generating the composite intent baseline for the current moment, a baseline consistency verification step is included. The purpose of this step is to detect baseline drift caused by drastic environmental changes or abnormal model updates. First, the composite intent baseline from historical moments is obtained as a reference baseline. Specifically, the selection strategy is as follows: the historical baseline 24 hours prior to the current moment is used as the short-term reference baseline, and the average historical baseline 7 days prior to the current moment is used as the long-term reference baseline; both are used in combination. The difference between the output of each sub-model in the current composite intent baseline and the output of each sub-model in the reference baseline is calculated. For the planning intent sub-model, its output is a sequence of desired states, and the difference is calculated using the mean absolute percentage error. in, This is the output of the current baseline at sampling point i. The output at the corresponding sampling point serves as the reference baseline. To prevent division by zero, a very small constant (0.001) is used, and the result is calculated as a percentage. For the collaborative intent sub-model, its output is a hidden layer representation vector, and the dissimilarity is calculated using cosine distance: in, For the collaborative representation of the current baseline, As a co-representation of the reference baseline, the calculated result ranges from [0,2], with the closer to 0 indicating greater similarity.

[0050] The two differences mentioned above are weighted and fused to obtain the comprehensive difference. ,in, The fusion weighting coefficient (preset to 0.5, range 0.3-0.7) is based on the logic of balancing the importance of planning intent and collaborative intent in baseline assessment. In production scenarios with strict planning requirements, it can be appropriately increased. The value can be appropriately reduced in complex collaborative scenarios. If the overall difference is considered... Exceeding the preset change threshold (A setting of 15% is recommended, with a range of 10%-20%) will trigger a baseline drift alarm and mark the current composite intent baseline as pending review. In this pending review state, the system will suspend the use of the current composite intent baseline for deviation calculation and instead continue using the historical reference baseline as a temporary substitute. Simultaneously, the verification process for the target control command will be extended by a preset duration (recommended to be twice the normal duration, e.g., from 100ms to 200ms) to accommodate manual review. Once the manual review is successful, the current baseline status can be restored from pending review to normal use. If the manual review confirms the drift, a model rollback mechanism will be triggered, restoring the collaborative intent sub-model weights to the stable version before the drift.

[0051] Furthermore, after generating the physical impact prediction data, the process also includes a prediction confidence assessment step: Acquire historical prediction data and corresponding actual state change data of the device mechanism model for the same operation type at historical moments; Calculate the error distribution data between the historical prediction data and the actual state change data; The error distribution data is used as prior knowledge and input into the confidence evaluation network. The physical impact prediction data and the current state parameter set are simultaneously input into the confidence evaluation network, and the prediction confidence score is output. When the prediction confidence score is lower than a preset confidence threshold, the physical impact prediction data is marked as low confidence data, and the expanded search range operation in the deep validation loop is triggered. The expanded search range operation includes increasing the number of generated alternative instruction sequences.

[0052] In one specific embodiment, after generating the physical impact prediction data, a prediction confidence assessment step is also included. The purpose of this step is to quantify the credibility of the physical impact prediction data generated by the digital twin simulation engine, providing a basis for parameter adjustments in subsequent deep verification cycles. First, historical prediction data of the equipment mechanism model for the same operation type over a past period and the corresponding actual state change data are obtained from the historical database. Specifically, taking the motor frequency setting operation as an example, the historical records of all frequency setting commands within the past 30 days are retrieved. For each historical command, the initial state parameter set before its execution (including the initial frequency) is extracted. Initial load rate Initial temperature The target frequency set by the instruction and the actual state change trajectory data after the instruction is executed. Simultaneously, the same initial state parameter set and target frequency are re-input into the current version of the device mechanism model to reproduce the prediction process at historical moments, thus obtaining historical prediction data. To ensure data representativeness, the number of historical command samples retrieved must be no less than 100, covering different operating conditions.

[0053] Calculate the error distribution between historical prediction data and actual state change data. For each historical sample, calculate the prediction error at each time sampling point of the predicted trajectory and the actual trajectory. Define the error vector. ,in, Let $\frac{i}{t}$ be the prediction error for the $i$-th sample at time $t$. For frequency prediction, the absolute error is used. For current prediction, relative error is used. For temperature prediction, absolute error is used. By pooling the errors of all historical samples at the same time point, the error distribution at each time point is obtained. To simplify the calculation, the errors are further aggregated along the time dimension, and the root mean square error is used as the comprehensive error index for each sample. in, For frequency normalization factor, This is the current normalization factor. This is a temperature normalization factor, used to compare the errors of different physical quantities within the same order of magnitude. Statistical analysis was performed on the RMSE of all historical samples, and the mean was calculated. and standard deviation To obtain error distribution data This distribution data characterizes the average prediction accuracy and fluctuation range of the device mechanism model in the current version.

[0054] Error distribution data is used as prior knowledge and input into the confidence evaluation network. The confidence evaluation network employs a lightweight Bayesian neural network structure, designed to dynamically evaluate prediction confidence by combining historical error statistical characteristics with the specific circumstances of the current prediction. The network input consists of two parts: the first part is the prior error distribution data, i.e. and The second part consists of the current predicted feature data, which extracts key features from the physical impact prediction data and the current state parameter set, including: operation type encoding (one-hot encoding, assuming there are 5 operation types, then 5 dimensions), and the relative change of operation values. (1-dimensional) Load rate in current state parameters (1D), temperature (1-dimensional) and the volatility index of the predicted trajectory, totaling 9 dimensions of features. These features are concatenated to obtain the input feature vector. .

[0055] The confidence evaluation network is structured as a three-layer fully connected network: an input layer with 11 nodes, a first hidden layer with 16 nodes (ReLU activation function), a second hidden layer with 8 nodes (ReLU activation function), and an output layer with 1 node (Sigmoid activation function). The network outputs a predicted confidence score. The physical meaning of is the probability that the current prediction result is reliable. The network is trained using historical data to construct a training set: for each historical sample, if its RMSE is lower than the 30th percentile of the historical error distribution, it is marked as a high-confidence sample (label 1); if the RMSE is higher than the 70th percentile, it is marked as a low-confidence sample (label 0); intermediate samples are used for validation. The training objective is to minimize the binary cross-entropy loss function.

[0056] The physical impact prediction data and the current state parameter set are simultaneously input into the confidence evaluation network, which outputs the prediction confidence score. This score directly reflects the predictive reliability of the digital twin simulation engine under current operating conditions. When the prediction confidence score falls below a preset confidence threshold... At this point, the physical impact prediction data is marked as low-confidence data, triggering the expanded search scope operation in the deep validation loop. The preset confidence threshold is set based on statistical analysis of historical prediction errors: the minimum confidence score of all high-confidence samples (RMSE below the 30th percentile) in the historical samples is taken as the threshold. The lower limit is used as a reference, and the tolerance for false positives is adjusted according to the actual application. The suggested value range is 0.6-0.8, and 0.7 is recommended for scenarios that require high security. That is, when the model itself has less than 70% confidence in the prediction result, the prediction is considered unreliable.

[0057] Expanding the search scope specifically involves increasing the number of generated alternative instruction sequences. In a normal deep validation loop, the initial size of the search space is 11 candidate operation sequences (i.e., the number of perturbation step sequences). When expanding the search scope is triggered, the perturbation step granularity is refined from the original 2% step to 1% step, while the perturbation range is expanded from ±10% to ±15%, thus increasing the number of generated candidate operation sequences from 11 to 31 (i.e., discretized from -15% to +15% with a 1% step, resulting in 31 candidate values). Simultaneously, the maximum number of iterations during the iterative optimization process is increased. The number of searches was increased from the default of 5 to 8 to allow for finding a better compromise path within a wider search space. This adaptive adjustment mechanism ensures that when the model's prediction reliability is low, the risk of prediction errors is compensated for through a more thorough search, thus improving the system's robustness.

[0058] Furthermore, it also includes steps for resolving multi-objective conflicts: When multiple target control instructions are received simultaneously and the multiple target control instructions point to the same controlled unit, the multiple target control instructions are sorted by timestamp to generate an instruction queue. The entire instruction queue is input into the digital twin simulation engine to deduce the composite impact prediction data; The composite impact prediction data is compared with the composite intent baseline to generate a composite conflict vector; If the deviation data in the composite conflict vector exceeds the preset tolerance threshold, the instructions in the instruction queue are prioritized and the single instruction verification loop is executed sequentially in order of priority from high to low. The verification process of the next instruction is re-initialized based on the state update data after the execution of the previous instruction, generating a dynamically adjusted instruction execution sequence.

[0059] In one specific embodiment, a multi-target conflict resolution step is also included to handle complex scenarios where multiple control commands arrive at the same controlled unit or associated unit simultaneously. The system sets a concurrent detection time window. The recommended value range is 50ms to 200ms, with 100ms being preferred. When multiple target control commands are detected pointing to the same controlled unit or associated unit group within this window, these commands are first sorted in ascending order of timestamps to generate a command queue. The entire instruction queue is input into the digital twin simulation engine, and the composite impact prediction data is derived using a state iteration method: based on the current real-time state. Starting from the initial state, each instruction in the queue is executed sequentially. After each instruction is executed, the state is updated to serve as the initial state for the next instruction. Finally, the complete state change trajectory after the entire queue has been executed is obtained. Then, the composite impact prediction data is compared with the composite intent baseline to generate a composite conflict vector. ,in, This is the overall time axis offset calculated through dynamic time warping. This represents the overall offset of the numerical axes (mean root mean square error). The mean cosine distance of the cooperative representation. If any deviation exceeds a preset tolerance threshold, the instruction queue is reordered by priority. The priority scoring function is: Weighting These correspond to the degree of urgency, the degree of security criticality, and the degree of dependence, respectively. The urgency level of the instruction is determined by extracting data from production operations. Instructions corresponding to urgent work orders are assigned a value of 1.0, routine operations are assigned a value of 0.5, and planned operations are assigned a value of 0.2. The safety criticality level is set as follows (1.0 for instructions involving safety interlocks, 0.5 for general control instructions, and 0.1 for parameter query instructions). The priority level (the degree to which this instruction is depended on by subsequent instructions, calculated by analyzing data dependencies between instructions, with a value ranging from 0 to 1) is used to reorder instructions according to their priority scores from highest to lowest, resulting in a new queue. Then proceed in sequence to... Each instruction in the process executes a single-instruction verification loop, and the verification process of the next instruction must be re-initialized based on the state update data after the execution of the previous instruction (i.e., updating the current state parameter set), ultimately generating a dynamically adjusted instruction execution sequence. A typical parameter verification is used: assuming three instructions A, B, and C within the window, ordered by time as A, B, C, after composite deduction... All exceeded the threshold. Priority calculations yielded scores of 0.77 for C, 0.41 for A, and 0.27 for B. The rearranged order was C, A, B. First, C (emergency stop) was processed, and its status was updated. Then, A was processed, and verification was performed based on the stop status, which might yield different conclusions. Finally, B was processed. This process effectively avoided conflicts between concurrent instructions, ensuring equipment safety and production continuity.

[0060] Example 2: This application also discloses a unified access and intelligent analysis system for multi-source heterogeneous data.

[0061] Reference Figure 2 A unified access and intelligent analysis system for multi-source heterogeneous data, including: The data access module is used to access multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data. The construction module is used to construct a composite intent baseline for the target controlled unit based on the equipment status monitoring data and the production operation data. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. The deduction module is used to respond to the received target control command by inputting the target control command into the digital twin simulation engine, and the digital twin simulation engine deduces physical impact prediction data based on the target control command and equipment status monitoring data. The comparison module is used to compare the physical impact prediction data with the planning intention sub-model and the collaborative intention sub-model respectively, and generate a multi-dimensional conflict vector, wherein the multi-dimensional conflict vector includes at least a first deviation data and a second deviation data. The verification module is used to start a deep verification loop when none of the deviation data in the multidimensional conflict vector exceeds a preset safety threshold. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. The response module is used to perform differentiated response operations to the target control commands based on the threat confidence level.

[0062] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention, they should all fall within the protection scope of the present invention.

[0063] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0064] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A unified access and intelligent analysis method for multi-source heterogeneous data, characterized in that, Includes the following steps: Access to multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data; Based on the equipment status monitoring data and the production operation data, a composite intent baseline is constructed for the target controlled unit. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. In response to receiving a target control command, the target control command is input into a digital twin simulation engine, which infers physical impact prediction data based on the target control command and equipment status monitoring data. The physical impact prediction data is compared with the planned intent sub-model and the collaborative intent sub-model to generate a multi-dimensional conflict vector, which includes at least first deviation data and second deviation data. When none of the deviation data in the multidimensional conflict vector exceeds the preset safety threshold, a deep verification loop is started. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. Based on the threat confidence level, a differentiated response operation is performed on the target control command.

2. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 1, characterized in that, The target control commands are input into the digital twin simulation engine to deduce physical impact prediction data, specifically including: The target control command is parsed to extract the operation object code, operation type code, and operation value; Based on the operation object code, the corresponding current status parameter set is retrieved from the equipment status monitoring data. The current status parameter set includes at least the current operating frequency, current load rate, and current temperature value. The operation type code, the operation value, and the current state parameter set are input into the digital twin simulation engine. The digital twin simulation engine has an embedded device mechanism model. The device mechanism model calculates the state change trajectory data based on the operation value and the current state parameter set. The state change trajectory data is time-series aligned with the historical state data of the upstream and downstream devices to generate physical impact prediction data.

3. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 1, characterized in that, Generating multidimensional conflict vectors specifically includes: The physical impact prediction data is input into the planning intention sub-model, and the time axis offset and numerical axis offset between the physical impact prediction data and the expected state sequence within the preset production plan window are calculated. The time axis offset and numerical axis offset are weighted and summed to obtain the first deviation data. The physical impact prediction data is input into the collaborative intent sub-model, the hidden layer representation of the physical impact prediction data is extracted in the graph neural network, and the Mahalanobis distance between the hidden layer representation and the preset collaborative state cluster center is calculated to obtain the second deviation data. The first deviation data and the second deviation data are concatenated into a multi-dimensional vector, and each dimension of the multi-dimensional vector corresponds to a preset intention dimension; The multidimensional vector is labeled as a multidimensional conflict vector.

4. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 1, characterized in that, The deep verification loop also includes an iterative optimization process, which specifically includes: The search space is initialized using the multidimensional conflict vector as the initial state, and the search space contains at least one candidate operation sequence. The candidate operation sequences are sequentially input into the digital twin simulation engine to generate corresponding candidate impact prediction data; Calculate the candidate deviation data between each candidate impact prediction data and the planned intent sub-model and the collaborative intent sub-model; The candidate deviation data is compared element by element with the multidimensional conflict vector. If any candidate deviation data is smaller than the multidimensional conflict vector in all dimensions, the candidate operation sequence corresponding to the candidate deviation data is marked as a better solution. The improved solution is used as a new benchmark for iterative calculation. The improved solution is marked as the optimal compromise path. The candidate operation sequence corresponding to the optimal compromise path is used as the alternative instruction sequence. The degree of deviation between the optimal compromise path and the target control instruction is mapped as the threat confidence level.

5. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 4, characterized in that, Perform differentiated response operations based on the threat confidence level, specifically including: When the threat confidence level is lower than the first preset threshold, the target control command is marked as a trusted command, and the target control command is allowed to be sent to the execution unit; When the threat confidence level is between the first preset threshold and the second preset threshold, the target control instruction is marked as a negotiable instruction, the target control instruction is intercepted, and the alternative instruction sequence corresponding to the optimal compromise path is sent to the execution unit, while negotiating log data is generated. When the threat confidence level is higher than the second preset threshold, the target control command is marked as a malicious command, the data source port of the target control command is blocked, and the target control command, the multidimensional conflict vector, and the iterative optimization process of the deep verification loop are encapsulated into an attack evidence package.

6. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 5, characterized in that, After encapsulating the target control command, the multidimensional conflict vector, and the iterative optimization process of the deep verification loop into an attack evidence package, it also includes attack pattern matching: The similarity between the multidimensional conflict vector and each attack feature vector in the preset attack mode library is calculated to obtain a similarity score sequence. The optimization process is input into the attack behavior classifier, and the attack behavior classifier outputs the attack type identifier and the attack stage identifier. The attack pattern corresponding to the highest score in the similarity score sequence, the attack type identifier, and the attack stage identifier are associated and stored in the attack evidence package, and the attack evidence package is uploaded to the security management platform.

7. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 1, characterized in that, The access to multi-source heterogeneous data also includes access environment context data; the construction of the composite intent baseline also includes: Extract time feature data, shift feature data, and maintenance event data from the environmental context data; The time feature data, the shift feature data, and the maintenance event data are fused into an environmental feature tensor. The environmental feature tensor is input into a preset environmental adaptive network to generate model parameter adjustment values; The model parameter adjustment is applied to the network weights of the collaborative intent sub-model to obtain a dynamically updated collaborative intent sub-model. The dynamically updated collaborative intent sub-model is coupled with the planned intent sub-model to generate the composite intent baseline at the current moment.

8. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 7, characterized in that, After generating the composite intent baseline for the current moment, a baseline consistency verification step is also included: Obtain the composite intent baseline at historical moments as a reference baseline; Calculate the degree of difference between the output of each sub-model in the composite intent baseline at the current moment and the output of each sub-model in the reference baseline; If the difference exceeds a preset change threshold, a baseline drift alarm is triggered, and the composite intent baseline at the current moment is marked as pending review. In the pending review state, the use of the composite intent baseline at the current moment for deviation calculation is suspended.

9. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 2, characterized in that, After generating the physical impact prediction data, the process also includes a prediction confidence assessment step: Acquire historical prediction data and corresponding actual state change data of the device mechanism model for the same operation type at historical moments; Calculate the error distribution data between the historical prediction data and the actual state change data; The error distribution data is used as prior knowledge and input into the confidence evaluation network. The physical impact prediction data and the current state parameter set are simultaneously input into the confidence evaluation network, and the prediction confidence score is output. When the prediction confidence score is lower than a preset confidence threshold, the physical impact prediction data is marked as low confidence data, and the expanded search range operation in the deep verification loop is triggered. The expanded search range operation includes increasing the number of generated alternative instruction sequences.

10. The unified access and intelligent analysis method for multi-source heterogeneous data according to claim 1, characterized in that, It also includes steps for resolving multi-objective conflicts: When multiple target control instructions are received simultaneously and the multiple target control instructions point to the same controlled unit, the multiple target control instructions are sorted by timestamp to generate an instruction queue. The entire instruction queue is input into the digital twin simulation engine to deduce the composite impact prediction data; The composite impact prediction data is compared with the composite intent baseline to generate a composite conflict vector; If the deviation data in the composite conflict vector exceeds the preset tolerance threshold, the instructions in the instruction queue are prioritized and the single instruction verification loop is executed sequentially in order of priority from high to low. The verification process of the next instruction is re-initialized based on the state update data after the execution of the previous instruction, generating a dynamically adjusted instruction execution sequence.

11. A unified access and intelligent analysis system for multi-source heterogeneous data, applied to the unified access and intelligent analysis method for multi-source heterogeneous data as described in any one of claims 1-10, characterized in that, include: The data access module is used to access multi-source heterogeneous data, which includes at least instruction stream data, equipment status monitoring data, and production operation data. The construction module is used to construct a composite intent baseline for the target controlled unit based on the equipment status monitoring data and the production operation data. The composite intent baseline includes a planning intent sub-model and a collaborative intent sub-model. The planning intent sub-model is generated based on the production operation data, and the collaborative intent model is dynamically generated based on the equipment status monitoring data and by learning the temporal correlation between upstream and downstream equipment through a graph neural network. The deduction module is used to respond to the received target control command by inputting the target control command into the digital twin simulation engine, and the digital twin simulation engine deduces physical impact prediction data based on the target control command and equipment status monitoring data. The comparison module is used to compare the physical impact prediction data with the planning intention sub-model and the collaborative intention sub-model respectively, and generate a multi-dimensional conflict vector, wherein the multi-dimensional conflict vector includes at least a first deviation data and a second deviation data. The verification module is used to start a deep verification loop when none of the deviation data in the multidimensional conflict vector exceeds a preset safety threshold. The deep verification loop includes: exploring at least one alternative instruction sequence based on the multidimensional conflict vector, re-inputting the alternative instruction sequence into the digital twin simulation engine to generate alternative impact prediction data, and iteratively comparing the alternative impact prediction data with the multidimensional conflict vector to update the threat confidence. The response module is used to perform differentiated response operations to the target control commands based on the threat confidence level.

Images