Port industrial internet of things multi-node jump illegal external link identification method and device

Abstract

The embodiment of the disclosure provides a port industrial Internet of Things multi-node jump illegal external link identification method and device, comprising: collecting multi-modal data of equipment in the port industrial Internet of Things, and preprocessing the multi-modal data; based on the preprocessed multi-modal data, a dynamic space-time graph is constructed in combination with the communication relationship of the equipment; attention modeling is performed on the constructed dynamic space-time graph to obtain a dynamic space-time graph attention model; multi-node jump path tracing and risk assessment are performed based on the dynamic space-time graph attention model, and whether the multi-node jump path is a multi-node jump illegal external link is determined according to the risk assessment result of the multi-node jump path. In this way, the hidden multi-node jump illegal external link can be accurately identified, thereby significantly reducing the missed detection rate and improving the overall port industrial Internet of Things security protection level.

Description

Technical Field

[0001] This disclosure relates to the field of port industrial Internet of Things (IoT) security technology, and in particular to a method and device for identifying illegal external links for multi-node jumps in port industrial IoT. Background Technology

[0002] The rapid popularization and deep application of the Industrial Internet of Things (IIoT) in the port sector has significantly improved the level of operational automation, equipment collaboration efficiency, and resource management accuracy. However, it has also dramatically expanded its potential exposure to cyberattacks. Among various security threats, the unauthorized external connection behavior of IIoT devices is particularly prominent, becoming a key entry point for attackers to penetrate internal networks and carry out advanced persistent threats. Attackers typically exploit vulnerabilities or weak passwords to control a single internal device, using it as an initial springboard to gradually penetrate more critical nodes through lateral movement, ultimately building a covert communication link composed of multiple interconnected devices. These links often employ encryption, tunneling, or protocol masquerading techniques, enabling internally controlled devices to bypass security boundary controls and continuously leak sensitive information such as production data, work plans, and equipment status to external command and control servers, or receive remote malicious commands to carry out destructive operations, such as equipment shutdown, process disruption, or data tampering.

[0003] However, current technologies for detecting unauthorized external connections in port industrial IoT scenarios still have significant shortcomings, mainly in three aspects: First, they rely on single-node detection mechanisms, which can only analyze local traffic or device behavior, lacking the ability to perceive cross-node correlations across the entire attack chain, resulting in an inability to effectively identify jump paths; second, the problem of fragmented multimodal data is prominent, with traffic data, behavior logs, permission change events, and network topology information often existing in isolation in different systems, failing to achieve deep integration and collaborative analysis, thus limiting the comprehensiveness and accuracy of abnormal behavior identification; third, dynamic modeling capabilities are insufficient, with existing detection models mostly based on static rules or fixed baselines, making it difficult to adapt to the complex scenarios of dynamic device access, network topology changes, and continuously evolving attack strategies in the port industrial IoT environment. In summary, these shortcomings lead to a persistently high false negative rate for current port industrial IoT unauthorized external connection detection solutions regarding concealed multi-node jump illegal external connection links. Summary of the Invention

[0004] In a first aspect, embodiments of this disclosure provide a method and apparatus for identifying illegal external links during multi-node hopping in a port industrial Internet of Things (IoT) system. The method includes: Collect multimodal data from devices in the port's industrial Internet of Things (IIoT) and preprocess the multimodal data; A dynamic spatiotemporal graph is constructed based on the preprocessed multimodal data and the communication relationships of the devices. Attention modeling is performed on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model; Based on the dynamic spatiotemporal graph attention model, we perform source tracing and risk assessment of multi-node jump paths, and determine whether the multi-node jump path is an illegal external link based on the risk assessment results.

[0005] In some possible implementations of the first aspect, multimodal data from devices in a port industrial IoT system are collected, and the multimodal data is preprocessed, including: Multimodal data is generated by collecting traffic data, behavior logs, permission change events, and network topology information from devices in the port's industrial Internet of Things (IIoT) using distributed probes. A sliding window filtering algorithm is used to denoise the multimodal data. Then, the traffic features and behavioral sequence features of the denoised data are extracted through feature engineering. The extracted features are standardized using a standardization algorithm to construct a multidimensional feature vector containing timestamps, node IDs, and behavioral types.

[0006] In some possible implementations of the first aspect, in the dynamic spatiotemporal graph, nodes include physical devices and virtual jump nodes; edges represent communication links between devices; edge weights are dynamically calculated by weighting jump frequency and temporal correlation; and the graph structure is incrementally updated through a sliding window mechanism.

[0007] In some possible implementations of the first aspect, attention modeling is performed on the constructed dynamic spatiotemporal graph to obtain a dynamic spatiotemporal graph attention model, including: A multi-head graph attention network is used to model the attention of the constructed dynamic spatiotemporal graph, resulting in a dynamic spatiotemporal graph attention model. The node encoder maps device features into 64-dimensional vectors through a multilayer perceptron to capture the association between device type and historical behavior. The edge encoder calculates jump weights through an attention mechanism, focusing on abnormal protocols and high-frequency jump behaviors. The cross-modal attention module further integrates traffic features and behavior sequence features, and calculates feature similarity through a cross-attention mechanism to enhance semantic association.

[0008] In some possible implementations of the first aspect, multi-node jump path tracing and risk assessment are performed based on a dynamic spatiotemporal graph attention model. Based on the risk assessment results of the multi-node jump path, it is determined whether it is an illegal external link for multi-node jumps, including: Based on the dynamic spatiotemporal graph attention model, reinforcement learning is used to generate potential jump paths. On this basis, the Gumbel-Softmax algorithm is used to explore multi-node jump paths, calculate the anomaly confidence of multi-node jump paths, and use it as the risk assessment result. The risk assessment result of multi-node jump paths is compared with the dynamic threshold calculated based on the EWMA algorithm to determine whether it is an illegal external link of multi-node jump.

[0009] Among some possible implementations of the first aspect, the method also includes: Feedback optimization is performed on the dynamic spatiotemporal graph attention model.

[0010] Among the possible implementations of the first aspect, feedback optimization of the dynamic spatiotemporal graph attention model includes: Based on the misjudgment data of illegal external links in multi-node jumps, the attention head weights of the dynamic spatiotemporal graph attention model are adjusted through reinforcement learning, and the feature space of the dynamic spatiotemporal graph attention model is expanded based on graph contrastive learning.

[0011] Secondly, embodiments of this disclosure provide a port industrial Internet of Things (IIoT) multi-node hop illegal external link identification device, the device comprising: The multimodal data acquisition and preprocessing module is used to acquire multimodal data from equipment in the port industrial Internet of Things and to preprocess the multimodal data. The dynamic spatiotemporal graph construction module is used to construct a dynamic spatiotemporal graph based on preprocessed multimodal data and the communication relationships of devices. The Dynamic Spatiotemporal Graph Attention Modeling Module is used to perform attention modeling on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model. The multi-node jump path tracing and risk assessment module is used to trace and assess the risks of multi-node jump paths based on the dynamic spatiotemporal graph attention model, and to determine whether the multi-node jump path is an illegal external link based on the risk assessment results.

[0012] Thirdly, embodiments of this disclosure provide an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory storing instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0013] Fourthly, embodiments of this disclosure provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the methods described above.

[0014] In this embodiment, by collecting and preprocessing multimodal data from port industrial IoT devices, fragmented multimodal information is effectively integrated. Then, based on the preprocessed multimodal data and device communication relationships, a dynamic spatiotemporal graph is constructed, overcoming the limitations of single-node detection and achieving dynamic modeling of multi-node interaction behavior. Attention modeling of the dynamic spatiotemporal graph enhances the model's ability to focus on abnormal communication. Finally, based on the dynamic spatiotemporal graph attention model, multi-node jump path tracing and risk assessment are performed, accurately identifying hidden multi-node jump illegal external links, thereby significantly reducing the false negative rate and improving the overall security level of the port industrial IoT.

[0015] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0016] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of this disclosure. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein: Figure 1 A flowchart of a method for identifying illegal external links in a port industrial Internet of Things (IIoT) based on an embodiment of this disclosure is shown. Figure 2 This diagram illustrates the structure of a port industrial Internet of Things (IoT) multi-node hopping illegal external link identification device provided in an embodiment of this disclosure. Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0018] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0019] To address the problems in the background technology, this disclosure provides a method and apparatus for identifying illegal external links involving multiple nodes in a port industrial IoT. Specifically, multimodal data from devices in the port industrial IoT is collected and preprocessed. Based on the preprocessed multimodal data and the communication relationships of the devices, a dynamic spatiotemporal graph is constructed. Attention modeling is performed on the constructed dynamic spatiotemporal graph to obtain a dynamic spatiotemporal graph attention model. Based on the dynamic spatiotemporal graph attention model, multi-node jump path tracing and risk assessment are conducted, and based on the risk assessment results of the multi-node jump path, it is determined whether it is an illegal external link involving multiple nodes. In this way, hidden illegal external links involving multiple nodes can be accurately identified, thereby significantly reducing the false negative rate and improving the overall security level of the port industrial IoT.

[0020] The following detailed description, in conjunction with the accompanying drawings, of a method and apparatus for identifying illegal external links in a port industrial Internet of Things (IoT) system through multiple nodes, based on specific embodiments, will be provided in this disclosure.

[0021] Figure 1 The flowchart shown is a method for identifying illegal external links in a port industrial Internet of Things (IIoT) based on an embodiment of this disclosure. Figure 1 As shown, method 100 may include the following steps: S110 collects multimodal data from devices in the port's industrial IoT and preprocesses the multimodal data.

[0022] In some embodiments, distributed probes are used to collect traffic data, behavior logs, permission change events, network topology information, etc., from devices in the port industrial IoT to form multimodal data. To address the noise interference problem in port industrial data, a sliding window filtering algorithm is used to denoise the multimodal data. Then, feature engineering is used to extract traffic features and behavior sequence features from the denoised data. Simultaneously, a standardization algorithm is used to standardize the extracted features, constructing a multidimensional feature vector containing timestamps, node IDs, and behavior types, providing high-quality input for subsequent steps.

[0023] S120 constructs a dynamic spatiotemporal graph based on preprocessed multimodal data and the communication relationships of the devices.

[0024] It's important to know that in a dynamic spatiotemporal graph, nodes include physical devices and virtual jump nodes; edges represent communication links between devices; and edge weights are dynamically calculated by weighting the jump frequency and temporal correlation, with the specific calculation formula as follows: ,in, For jump frequency, For temporal correlation degree, α and βThese are the weighting coefficients for jump frequency and temporal correlation, respectively. The graph structure is incrementally updated through a sliding window mechanism to capture device topology changes in real time. For example, when a device is detected to be communicating frequently with an unfamiliar IP, a temporary jump node is automatically added to the dynamic spatiotemporal graph and the edge weights are updated to achieve dynamic network situation awareness.

[0025] S130, Attention modeling is performed on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model.

[0026] In some embodiments, a multi-head graph attention network is used to model the attention of the constructed dynamic spatiotemporal graph, resulting in a dynamic spatiotemporal graph attention model. In the dynamic spatiotemporal graph attention model, the node encoder maps device features into 64-dimensional vectors through a multilayer perceptron to capture the association between device type and historical behavior; the edge encoder calculates jump weights through an attention mechanism, focusing on abnormal protocols and high-frequency jump behaviors; the cross-modal attention module further integrates traffic features and behavior sequence features, and calculates feature similarity through a cross-attention mechanism to enhance semantic association. For example, when a device suddenly triggers high-frequency encrypted traffic in the early morning, the model captures the similarity to historical attack patterns through the cross-modal attention module, triggering an anomaly alarm.

[0027] S140 uses a dynamic spatiotemporal graph attention model to trace and assess the risks of multi-node jump paths, and determines whether a multi-node jump path is an illegal external link based on the risk assessment results.

[0028] In some embodiments, based on a dynamic spatiotemporal graph attention model, reinforcement learning is used to generate potential jump paths. On this basis, the Gumbel-Softmax algorithm is used to explore multi-node jump paths (i.e., jump paths with ≥3 hops). The abnormal confidence of the multi-node jump path is calculated and used as the risk assessment result. The risk assessment result of each multi-node jump path is compared with a dynamic threshold calculated based on the EWMA algorithm to determine whether it is an illegal external link of multi-node jump. For example, if a multi-node jump path accesses a non-production network segment IP for 3 consecutive hops, its risk assessment result exceeds the dynamic threshold and is determined to be an illegal external link of multi-node jump.

[0029] For example, the formula for calculating the above-mentioned anomaly confidence level is as follows: ; in, For abnormal confidence levels, For the first The probability of malicious jumping. For the first The path position weights for jumps are set as follows: the path position weight for the first jump is set to 0.6, and the path position weight for the last jump is set to 0.4.

[0030] Furthermore, the formula for calculating the above dynamic threshold is as follows: ; in, The dynamic threshold at the current moment. This is the dynamic threshold from the previous time step. This represents the average risk assessment result at the current moment, also known as the average anomaly confidence level.

[0031] In summary, according to the embodiments of this disclosure, at least the following technical effects are achieved: By collecting and preprocessing multimodal data from port industrial IoT devices, fragmented multimodal information is effectively integrated. Then, based on the preprocessed multimodal data and device communication relationships, a dynamic spatiotemporal graph is constructed, overcoming the limitations of single-node detection and enabling dynamic modeling of multi-node interaction behavior. Attention modeling of the dynamic spatiotemporal graph enhances the model's ability to focus on abnormal communication. Finally, based on the dynamic spatiotemporal graph attention model, multi-node jump path tracing and risk assessment are performed, accurately identifying hidden multi-node jump illegal external links, thereby significantly reducing the false negative rate and improving the overall security level of port industrial IoT.

[0032] It is worth noting that, in order to enable the model to achieve continuous optimization and iteration in port industrial scenarios, method 100 may also include: Feedback optimization is performed on the dynamic spatiotemporal graph attention model. Specifically, based on misjudgment data of illegal external links in multi-node jumps, reinforcement learning is used to adjust the attention head weights of the dynamic spatiotemporal graph attention model, optimizing the model's ability to identify novel jump patterns. Furthermore, graph contrastive learning is used to expand the feature space of the dynamic spatiotemporal graph attention model, enhancing its generalization ability to hidden jump links. Further, this optimization process supports the parsing of industrial protocols such as Modbus and OPC-UA.

[0033] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0034] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0035] Figure 2This diagram illustrates a structural diagram of a port industrial Internet of Things (IoT) multi-node hop illegal external link identification device provided in an embodiment of this disclosure, as shown below. Figure 2 As shown, the device 200 may include: The multimodal data acquisition and preprocessing module 210 is used to acquire multimodal data from equipment in the port industrial Internet of Things and to preprocess the multimodal data.

[0036] The dynamic spatiotemporal graph construction module 220 is used to construct a dynamic spatiotemporal graph based on preprocessed multimodal data and the communication relationships of the devices.

[0037] The dynamic spatiotemporal graph attention modeling module 230 is used to perform attention modeling on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model.

[0038] The multi-node jump path tracing and risk assessment module 240 is used to perform multi-node jump path tracing and risk assessment based on the dynamic spatiotemporal graph attention model, and to determine whether the multi-node jump path is an illegal external link based on the risk assessment results.

[0039] Understandable, Figure 2 Each module / unit in the illustrated device 200 has the ability to implement Figure 1 The functions of each step in method 100 shown, and their corresponding technical effects, will not be elaborated here for the sake of brevity.

[0040] Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Electronic device 300 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 300 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0041] like Figure 3As shown, the electronic device 300 may include a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. The RAM 303 may also store various programs and data required for the operation of the electronic device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0042] Multiple components in electronic device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of displays, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows electronic device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0043] The computing unit 301 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer program product, including a computer program tangibly contained in a computer-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform method 100 by any other suitable means (e.g., by means of firmware).

[0044] The various embodiments described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), payload programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0045] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0046] In the context of this disclosure, a computer-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0047] It should be noted that this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions. These computer instructions are used to cause a computer to execute method 100 and achieve the corresponding technical effects achieved by executing the method in the embodiments of this disclosure; for the sake of brevity, they will not be elaborated further here.

[0048] In addition, this disclosure also provides a computer program product including a computer program that implements method 100 when executed by a processor.

[0049] To provide interaction with a user, the embodiments described above can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0050] The embodiments described above can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with the implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0051] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0052] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0053] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying illegal external links during multi-node jumps in a port industrial Internet of Things (IoT) system, characterized in that, The method includes: Collect multimodal data from devices in the port's industrial Internet of Things (IIoT) and preprocess the multimodal data; A dynamic spatiotemporal graph is constructed based on the preprocessed multimodal data and the communication relationships of the devices. Attention modeling is performed on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model; Based on the dynamic spatiotemporal graph attention model, we perform source tracing and risk assessment of multi-node jump paths, and determine whether the multi-node jump path is an illegal external link based on the risk assessment results.

2. The method according to claim 1, characterized in that, The process of collecting multimodal data from devices in the port's industrial Internet of Things (IoT) and preprocessing the multimodal data includes: Multimodal data is generated by collecting traffic data, behavior logs, permission change events, and network topology information from devices in the port's industrial Internet of Things (IIoT) using distributed probes. A sliding window filtering algorithm is used to denoise the multimodal data. Then, the traffic features and behavioral sequence features of the denoised data are extracted through feature engineering. The extracted features are standardized using a standardization algorithm to construct a multidimensional feature vector containing timestamps, node IDs, and behavioral types.

3. The method according to claim 1, characterized in that, In the dynamic spatiotemporal graph, nodes include physical devices and virtual jump nodes; edges represent communication links between devices; edge weights are dynamically calculated by weighting jump frequency and temporal correlation; and the graph structure is incrementally updated through a sliding window mechanism.

4. The method according to claim 1, characterized in that, The process of performing attention modeling on the constructed dynamic spatiotemporal graph to obtain a dynamic spatiotemporal graph attention model includes: A multi-head graph attention network is used to model the attention of the constructed dynamic spatiotemporal graph, resulting in a dynamic spatiotemporal graph attention model. The node encoder maps device features into 64-dimensional vectors through a multilayer perceptron to capture the association between device type and historical behavior. The edge encoder calculates jump weights through an attention mechanism, focusing on abnormal protocols and high-frequency jump behaviors. The cross-modal attention module further integrates traffic features and behavior sequence features, and calculates feature similarity through a cross-attention mechanism to enhance semantic association.

5. The method according to claim 1, characterized in that, The process of tracing and assessing the source of multi-node jump paths based on a dynamic spatiotemporal graph attention model, and determining whether a multi-node jump path is an illegal external link based on the risk assessment results, includes: Based on the dynamic spatiotemporal graph attention model, reinforcement learning is used to generate potential jump paths. On this basis, the Gumbel-Softmax algorithm is used to explore multi-node jump paths, calculate the anomaly confidence of multi-node jump paths, and use it as the risk assessment result. The risk assessment result of multi-node jump paths is compared with the dynamic threshold calculated based on the EWMA algorithm to determine whether it is an illegal external link of multi-node jump.

6. The method according to claim 1, characterized in that, The method further includes: Feedback optimization is performed on the dynamic spatiotemporal graph attention model.

7. The method according to claim 6, characterized in that, The feedback optimization of the dynamic spatiotemporal graph attention model includes: Based on the misjudgment data of illegal external links in multi-node jumps, the attention head weights of the dynamic spatiotemporal graph attention model are adjusted through reinforcement learning, and the feature space of the dynamic spatiotemporal graph attention model is expanded based on graph contrastive learning.

8. A port industrial IoT multi-node illegal external link identification device, characterized in that, The device includes: The multimodal data acquisition and preprocessing module is used to acquire multimodal data from equipment in the port industrial Internet of Things and to preprocess the multimodal data. The dynamic spatiotemporal graph construction module is used to construct a dynamic spatiotemporal graph based on preprocessed multimodal data and the communication relationships of devices. The Dynamic Spatiotemporal Graph Attention Modeling Module is used to perform attention modeling on the constructed dynamic spatiotemporal graph to obtain the dynamic spatiotemporal graph attention model. The multi-node jump path tracing and risk assessment module is used to trace and assess the risks of multi-node jump paths based on the dynamic spatiotemporal graph attention model, and to determine whether the multi-node jump path is an illegal external link based on the risk assessment results.

9. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method according to any one of claims 1-7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method described in any one of claims 1-7.

Images