A network security situation awareness method, device and electronic equipment for an open-pit mine scene

Abstract

The present application provides an open-pit mine network security situation awareness method, device and electronic equipment, relating to the technical field of network security. In view of the particularity of the open-pit mine network, combined with its characteristics such as multiple mobile nodes, complex industrial protocols and harsh physical environment, through multi-dimensional data fusion, dynamic clustering optimization, cross-modal large model reasoning and industrial honeypot trapping, etc. The present application realizes accurate perception and prediction of the open-pit mine network security situation. The present application reduces the dimension of open-pit mine network security situation awareness, improves the perception efficiency and accuracy in complex environment, and provides a strong guarantee for the safety of open-pit mine key infrastructure.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more particularly to a network security situation awareness method, device, and electronic device for open-pit mine scenarios. Background Technology

[0002] As a crucial energy and mineral resource production base, open-pit mines employ a multi-domain network system encompassing industrial control networks, wireless networks, and office networks. This system connects various equipment such as excavators, dump trucks, crushers, PLC controllers, and sensors, undertaking critical tasks including production control, data acquisition, and scheduling management. With the digital and intelligent transformation, the openness and complexity of open-pit mine networks have significantly increased, leading to increasingly severe security threats. These threats include tampering with control commands, theft of production data, and malicious interference with equipment physical conditions, which could result in production interruptions, equipment damage, and even personnel casualties.

[0003] Existing network security situational awareness technologies have the following limitations, making them unsuitable for open-pit mining scenarios:

[0004] 1. Insufficient adaptation to node characteristics: Existing methods do not consider the mobility of open-pit mining equipment (such as trucks and excavators), the correlation with the physical environment (such as the anti-interference requirements of equipment in blasting areas), and the dependence on production processes (such as the chain reaction of key equipment) when classifying and calculating the weights of nodes, resulting in low accuracy of situation assessment.

[0005] 2. Poor adaptability to dynamic networks: Open-pit mine wireless networks are affected by terrain and equipment movement, resulting in dynamic changes in topology. Traditional static clustering algorithms struggle to capture the time-varying characteristics of traffic data, leading to large deviations in clustering results.

[0006] 3. Weak multimodal data fusion: Industrial control flow, equipment logs, and physical status data (such as vibration and temperature) generated in open-pit mines are heterogeneous. Existing technologies lack targeted cross-modal fusion mechanisms, making it difficult to uncover potential correlations between data.

[0007] 4. Insufficient foresight in attack prediction: Existing methods mostly focus on post-event alerts and have weak predictive capabilities for stages of attack chains unique to open-pit mines (such as from wireless intrusion to control command tampering), thus failing to support proactive defense.

[0008] 5. Lack of physical layer defense: Open-pit mining equipment is vulnerable to physical contact attacks (such as PLC programmer tampering and sensor damage), and existing situational awareness technologies are insufficient in monitoring and integrating physical layer threats.

[0009] Therefore, there is an urgent need for a security situation awareness method that adapts to the characteristics of open-pit mine networks, integrates multi-source data, and has dynamic perception and forward-looking prediction capabilities, in order to improve the security protection level of open-pit mine networks. Summary of the Invention

[0010] To address the aforementioned technical problems such as poor adaptability, low perception accuracy, and weak prediction capabilities in open-pit mine scenarios, this paper provides a network security situational awareness method, device, and electronic equipment for open-pit mine scenarios.

[0011] The technical means employed in this invention are as follows: A method for network security situation awareness in open-pit mines includes the following steps: Acquire multi-source data from each node in the open-pit mine network; the multi-source data includes: industrial control flow data, equipment operation logs, physical status monitoring data, and location information; Based on the open-pit mine network topology and node attributes, a node classification system is constructed and the dynamic security weight of each node is calculated; the node attributes include: equipment type, physical area, movement status and associated production process; For each node, an improved dynamic clustering algorithm is used to cluster the industrial control flow data to obtain the clustering results corresponding to each node; the improved dynamic clustering algorithm includes: a center data element update mechanism based on the movement trajectory and an anti-interference correlation calculation model; The device operation logs are structured and modal characterized to obtain log event modal semantic feature encoding vectors; The industrial control flow data is subjected to time series modeling to obtain the network flow modal time series pattern feature encoding vector; A cross-modal semantic alignment technique is used to map the log event modal semantic feature encoding vector and the network traffic modal temporal pattern feature encoding vector to a unified semantic space, and to perform fine-grained feature transfer interactive reasoning to obtain a cross-modal interactive response reasoning encoding vector. The cross-modal interactive response inference encoding vector is input into a multimodal large model fine-tuned for the open-pit mine scenario to obtain the attack phase prediction results. By combining the clustering results, dynamic security weights, physical state monitoring data, and attack phase prediction results, the security situation awareness value of the open-pit mine network is calculated. If the security situation awareness value is greater than the threshold or the attack phase prediction result is a high-risk phase, the open-pit mine industrial honeypot system will be activated to capture threats and trigger security alarms and defense strategies.

[0012] Furthermore, the construction of a node classification system and calculation of the dynamic security weight of each node based on the open-pit mine network topology and node attributes includes: classifying open-pit mine network nodes into core control nodes, production equipment nodes, sensor monitoring nodes, office network nodes, and mobile access nodes; determining the degree value of each node based on the network topology, wherein the degree value calculation includes a weighted sum of the number of physical connections and the number of wireless communication links; assigning regional weights according to the risk level of the physical area where the node is located; and adjusting the dynamic coefficients according to the movement speed of the node. Calculate the dynamic security weight: Dynamic security weight = (node ​​predefined security level × degree value) × region weight × dynamic coefficient.

[0013] Furthermore, the improved dynamic clustering algorithm includes: The process is repeated until all industrial control flow data elements are classified. This process includes: selecting an initial central data element from unclassified data elements; prioritizing flow data from core control nodes during stable periods; for mobile node data elements, predicting the communication range for the next moment based on their location information and movement trajectory, and delineating potential association areas for the data elements; calculating the anti-interference correlation between the target data element and the central data element, where anti-interference correlation = security weight × time association probability × data volume matching degree × address similarity × signal strength factor, and the signal strength factor is used to correct deviations caused by wireless network interference; determining the maximum and minimum values ​​from each anti-interference correlation value, classifying the target data element corresponding to the maximum value into the data class of the central data element, and using the target data element corresponding to the minimum value as the new central data element, adjusting the lifecycle of the central data element according to the mobile node's location update mechanism. The calculation of the time correlation probability includes: sorting the industrial control flow data by arrival time to obtain a time series; calculating the first time difference between the central data element and the preceding data element, and the second time difference between the target data element and the preceding data element; introducing the open-pit mine production cycle coefficient to correct the mean of the time interval attribute: corrected mean = original mean × (1 + production cycle coefficient × time period factor), where the time period factor is dynamically adjusted according to the mining shift (e.g., day shift / night shift); and calculating the time correlation probability based on the first time difference, the second time difference, and the corrected mean. The calculation of address similarity includes: for fixed nodes, the IP address four-segment decimal number comparison method is used; for mobile nodes, the address similarity is calculated by combining MAC address and geographical location information, and the result is: address similarity = (MAC address matching degree × 0.6) + (geographical location overlap degree × 0.4), where the geographical location overlap degree is determined according to the distance error range of GPS coordinates.

[0014] Furthermore, the structured processing and modal characterization of equipment operation logs includes: extracting key fields from the logs, including equipment ID, operation instructions, fault codes, timestamps, operator information, and physical status labels; constructing an open-pit mine-specific dictionary containing vocabulary in areas such as equipment terminology, operation instructions, and fault types; and performing domain fine-tuning based on the BERT model to convert the structured log event stream into log event modal semantic feature encoding vectors, wherein the fine-tuning process incorporates an open-pit mine production process knowledge graph as external knowledge.

[0015] Furthermore, the time-series modeling of industrial control traffic data includes: adopting an improved Bi-LSTM model to address the jitter characteristics of open-pit mine wireless networks, and incorporating signal attenuation factors and retransmission mechanism features into the time-series feature extraction; extracting multi-dimensional time-series features of the traffic data, including packet interval, traffic peak, protocol type ratio, retransmission rate, and correlation with physical status monitoring data; and mapping the multi-dimensional time-series features into a network traffic modal time-series pattern feature encoding vector.

[0016] Furthermore, the cross-modal semantic alignment technique includes: calculating a cross-modal correlation matrix between the log event modal semantic feature encoding vector and the network traffic modal temporal pattern feature encoding vector, wherein the weights of the matrix elements are adjusted according to the causal relationship between open-pit mine production events and traffic changes; using a multi-scale convolutional neural network to filter the correlation matrix and retain cross-modal features strongly related to the production process; and mapping the two types of feature vectors to a unified semantic space to obtain aligned feature vectors.

[0017] Furthermore, the multimodal large model fine-tuned for open-pit mine scenarios includes: based on a general multimodal large model, using historical attack samples, equipment failure cases, and production anomaly data from open-pit mines for domain adaptation; introducing an attack phase labeling system, including "physical layer probing," "wireless link intrusion," "control command tampering," "production data theft," and "equipment paralysis attack"; and optimizing model parameters through comparative learning to enable the model to identify the unique attack chains in open-pit mines.

[0018] Furthermore, the calculation of the security situation awareness value of the open-pit mine network includes: for each node, calculating the product of the number of elements in the data class and the dynamic security weight, and the product of the average correlation and the node contribution in the clustering results, and summing them to obtain a first sum; calculating the time parameter variance of uplink and downlink data with the same identifier, and introducing a network jitter coefficient to correct the variance value; calculating the ratio of the first sum to the corrected variance, and superimposing them to obtain the situation awareness value of each node; combining the threat coefficient of the attack phase prediction results and the risk value of the physical state monitoring data, and weighted summing the node situation awareness values ​​to obtain the overall security situation awareness value of the network.

[0019] The present invention also includes a network security situation awareness device for open-pit mines, comprising: The multi-source data acquisition module is used to acquire industrial control flow data, equipment operation logs, physical status monitoring data and location information of each node in the open-pit mine network; The node weight calculation module is used to construct a classification system based on network topology and node attributes and calculate dynamic security weights. The dynamic clustering module is used to cluster industrial control flow data using an improved dynamic clustering algorithm; The feature extraction module is used to perform modal characterization on device operation logs and time-series modeling on traffic data to obtain two types of feature encoding vectors. The cross-modal fusion module is used to achieve feature fusion through cross-modal semantic alignment technology to obtain cross-modal interactive response inference encoding vectors; The attack prediction module is used to input the cross-modal interactive response inference encoding vector into a multimodal large model that is fine-tuned in the domain, and obtain the prediction results for the attack phase. The situation assessment module is used to calculate the network security situation awareness value by combining clustering results, dynamic security weights, physical state data, and attack prediction results; the response linkage module is used to link the industrial honeypot system to capture threats and trigger security alarms when the situation awareness value exceeds the threshold.

[0020] The present invention also provides an electronic device, characterized in that it includes a processor, a communication interface, a memory, and a communication bus; the processor, the communication interface, and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs on the memory to implement the steps of the open-pit mine network security situation awareness method.

[0021] Compared with the prior art, the present invention has the following advantages: This invention constructs a dedicated classification system for open-pit mine equipment, combining physical area and mobile status configuration with dynamic security weights to effectively improve the targeting of situation assessment; it introduces mobile trajectory updates and anti-interference model optimization of dynamic clustering algorithms, making the clustering results more consistent with the time-varying characteristics of open-pit mine wireless networks; by fusing multi-source data such as traffic, logs, and physical status, and relying on cross-modal alignment and large model inference technology, it significantly improves the accuracy of attack detection and prediction; it conducts stage prediction for attack chains unique to open-pit mines, providing strong support for the formulation of proactive defense strategies; and it integrates physical status monitoring data to achieve effective perception of physical layer threats, successfully filling the gap in existing technologies in this field. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is an overall flowchart of the method of the present invention.

[0024] Figure 2 The logic diagram for calculating dynamic security weights.

[0025] Figure 3 Flowchart of the improved dynamic clustering algorithm.

[0026] Figure 4 This is a schematic diagram of cross-modal fusion inference.

[0027] Figure 5 Flowchart for training the prediction model during the attack phase.

[0028] Figure 6 This is a schematic diagram illustrating the linkage between situation value calculation and response. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] like Figure 1-6 As shown, this invention provides a method for network security situation awareness in open-pit mines, comprising the following steps: Acquire multi-source data from each node in the open-pit mine network. This multi-source data includes: industrial control traffic data (including uplink and downlink traffic), equipment operation logs, physical status monitoring data, and location information. In a preferred embodiment, the industrial control traffic data includes uplink traffic (such as sensor data uploads and equipment status feedback) and downlink traffic (such as control commands and scheduling information) from each node, covering data packet identifiers, sizes, timestamps, source / destination addresses, and protocol types (Modbus TCP / IP, WirelessHART, etc.). This data is acquired through traffic collectors deployed on core switches and wireless base stations. Equipment operation logs, from PLC controllers, SCADA systems, and equipment terminals, include operation commands (such as "excavator start" and "truck speed adjustment"), fault codes (such as "E101: communication interruption"), parameter modification records, and operator IDs. Physical status monitoring data, collected through built-in sensors or external monitoring devices, includes vibration amplitude, temperature, humidity, GPS location, and battery level, reflecting the physical operating status of the equipment. Location information: For mobile nodes (such as trucks and excavators), real-time location coordinates are obtained through GPS or BeiDou positioning systems to analyze movement trajectories and network topology changes.

[0032] The acquired data requires preprocessing, including: Cleaning: Removing duplicate packets from traffic data, invalid fields (such as garbled characters) from logs, and outliers (such as jump values ​​caused by sensor malfunctions) from physical status data. Format standardization: Converting traffic data to a standardized format (such as PCAP), log data to JSON format, and aligning physical status data by timestamp. Time synchronization: Synchronizing the timestamps of all data based on the NTP protocol, with an error controlled within 10ms, ensuring time correlation across data sources.

[0033] Based on the open-pit mine network topology and node attributes, a node classification system is constructed and the dynamic security weight of each node is calculated; the node attributes include: equipment type, physical area, movement status and associated production process; The open-pit mine network nodes are divided into 5 categories, as shown in the table below:

[0034] Dynamic security weights W The calculation formula is:

[0035] in: L Predefined security levels (core control nodes = 5, production equipment nodes = 4, sensor monitoring nodes = 3, office network nodes = 2, mobile access nodes = 1). D The node degree value is calculated as follows: , This refers to the number of physical connections (such as the number of wired connected devices). Where α is the number of wireless links, and α is the weighting coefficient (fixed nodes = 0.7, mobile nodes = 0.3). R The regional risk coefficient is assigned based on the physical area where the node is located (blasting area = 1.5, mining area = 1.2, storage area = 1.0, office area = 0.8). M The moving state coefficient is (stationary node = 1.0, moving node = 1.2 + 0.01 × 10 ... v , v (This represents the mobile speed in km / h, reflecting the risk of communication instability for the mobile node).

[0036] For each node, an improved dynamic clustering algorithm is used to cluster the industrial control flow data to obtain the clustering results corresponding to each node; the improved dynamic clustering algorithm includes: a center data element update mechanism based on the movement trajectory and an anti-interference correlation calculation model.

[0037] Initial center selection: Prioritize the selection of traffic data from core control nodes during stable production periods (such as non-explosive or non-equipment switching periods) as initial center data elements to ensure the representativeness of the center.

[0038] Mobile node association area delineation: For mobile nodes (such as trucks), based on their GPS location ( x , y and movement speed v Predicting the future Δt The range of movement within a time period is defined with the current position as the center and a radius of... Related regions ( The error compensation value is set to 5m, and the target data element is searched only within this area to reduce the amount of computation.

[0039] Anti-interference correlation calculation: correlation S ij The calculation formula is:

[0040] in: W Dynamic security weights; P t For time-related probabilities; P p For data volume matching degree; A Address similarity; S The signal strength factor has a value of [0.5, 1] ​​and is mapped based on the RSSI value of the wireless signal strength (the higher the strength, the closer the factor is to 1).

[0041] Among them, time-related probability P tSort the traffic data by arrival time from earliest to latest to obtain a sequence. S =[ s 1, s 2,..., s n ].

[0042] Time difference calculation: central data element s j First time difference Target data element s i Second time difference (The time difference of the first element is 0).

[0043] Corrected mean calculation: Original mean The production cycle coefficient β (day shift = 1.2, night shift = 0.8, reflecting differences in production intensity) and the time period factor γ (blasting period = 1.5, normal period = 1.0) are introduced to correct the mean. .

[0044] Probability calculation: ( To find the minimum value, avoid a denominator of 0).

[0045] Data volume matching degree ： ; in size i , size j These are the data packet sizes for the target data element and the central data element, respectively.

[0046] Central update mechanism: For data types of mobile nodes, each time... T Time (dynamically adjusted according to the speed of equipment movement, such as trucks) T =30s), excavator (T=60s)), recalculate the center data element. If the original center is outside the associated area, select the most representative data element in the area as the new center.

[0047] Fixed nodes: The weights are adjusted by comparing the four segments of the IP address as described in claim 5, in conjunction with the open-pit mine subnet planning (e.g., the core control node is located in the 192.168.1.x network segment, and the sensor node is located in the 192.168.2.x network segment).

[0048] Mobile Node: ,in MAC_ Matching digits Match the number of bits for the MAC address. d Distance based on GPS coordinates. d0 represents the maximum communication distance (e.g., 500m).

[0049] The device operation logs are structured and modal characterized to obtain log event modal semantic feature encoding vectors; Extract key fields from the device's operation logs and construct a structured log event stream, as shown in the example below:

[0050] Domain-specific fine-tuning of the BERT model: Constructing a dictionary specific to open-pit mines (including terms such as "blasting warning" and "full load signal"), fine-tuning the BERT model using historical log data, and converting structured log event streams into 768-dimensional log event modal semantic feature encoding vectors. V log .

[0051] The industrial control traffic data is time-series modeled to obtain the network traffic modal time-series feature encoding vector; based on the traditional Bi-LSTM, a signal attenuation factor (dynamically adjusted according to the wireless link quality) and retransmission mechanism features (such as the number of retransmissions and the retransmission interval) are added to improve the adaptability to wireless network jitter.

[0052] Multidimensional time-series features: Extract 8-dimensional features of traffic data, including: mean / variance of packet interval, peak traffic, proportion of Modbus protocol, proportion of WirelessHART protocol, retransmission rate, and Pearson correlation coefficient with physical status data (such as the correlation between traffic anomalies and excessive vibration).

[0053] Feature Encoding: Multi-dimensional temporal features are mapped into a 512-dimensional network traffic modal temporal pattern feature encoding vector using an improved Bi-LSTM model. V flow .

[0054] A cross-modal semantic alignment technique is employed to map the log event modal semantic feature encoding vector and the network traffic modal temporal pattern feature encoding vector to a unified semantic space. Fine-grained feature transfer and interactive reasoning are then performed to obtain the cross-modal interactive response reasoning encoding vector. (Calculation...) V log and V flow Correlation matrix Matrix element Mi,j represents V log The i-th dimension and V flowThe correlation strength of the j-th dimension is weighted according to the open-pit mine production rules (e.g., the correlation weight between the "emergency stop instruction" log and the "sudden drop in traffic" feature is increased by 20%). Convolution operations are performed on the correlation matrix M using 3×3 and 5×5 kernels to extract cross-modal correlation features of different granularities (e.g., local correlation between a single log entry and short-term traffic fluctuations, and global correlation between log sequences and long-term traffic trends). The nonlinear expression is enhanced using the ReLU activation function to obtain the cross-modal co-space semantic alignment encoding matrix M'. V log and V flow Mapping to the M' space respectively yields aligned feature vectors. V' log V and V' flow The aligned features are finely segmented (each 64 dimensions constitutes a local feature), and the local interaction matrix is ​​calculated through the transition response inference unit. This matrix is ​​then weighted and aggregated using an attention mechanism to obtain the cross-modal interaction response inference encoding vector V. cross .

[0055] The cross-modal interactive response inference encoding vector is input into a multimodal large model fine-tuned for the open-pit mine scenario to obtain the attack phase prediction results. Historical attack cases in open-pit mines (such as the 2019 XXX mine truck control command tampering incident), equipment failure simulation data, and production anomaly records are collected and labeled with attack phase tags.

[0056] Attack Phase Tagging System:

[0057] Fine-tuning strategy: Employ a contrastive learning loss function to narrow the Vcross feature distance at the same attack stage and widen the feature distance at different stages. Iterate through 100 rounds of training to adapt the model to the open-pit mine attack mode.

[0058] Combining the clustering results, dynamic security weights, physical state monitoring data, and attack phase prediction results, the security situation awareness value of the open-pit mine network is calculated. Node situation value calculation. First sum S 1. For each data class of a node, calculate (number of elements × dynamic security weight) + (average relevance × node contribution), and sum them up to obtain... S 1 (Node contribution = Correlation between node and core control node / Average correlation of similar nodes).

[0059] Corrected variance σ 2 Calculate the variance of uplink / downlink data time parameters for the same identifier, and introduce a network jitter coefficient. (Wireless link = 1.5, wired link = 1.0), corrected variance .

[0060] Node status value .

[0061] Calculation of overall network status

[0062] in: Node weights (core control node = 0.3, production equipment node = 0.25, sensor monitoring node = 0.2, office network node = 0.15, mobile access node = 0.1). P threat Threat coefficients for the attack phase (physical layer probing = 0.2, wireless link intrusion = 0.4, control command tampering = 0.8, production data theft = 0.5, equipment paralysis attack = 1.0). R phys This is the physical state risk value, calculated based on the degree to which parameters such as vibration and temperature deviate from a threshold (e.g., if the temperature exceeds the threshold by 20%). R phys =0.6; λ and γ are weighting coefficients (taken as 0.3 and 0.2 respectively).

[0063] If the security situation awareness value exceeds the threshold or the attack phase prediction indicates a high-risk phase, the open-pit mine industrial honeypot system will be activated to trap threats and trigger security alarms and defense strategies. Based on the open-pit mine's production safety level, the following settings will be implemented: S total Thresholds (e.g., Level 1 alert = 80, Level 2 alert = 60, Level 3 alert = 40). S tota When the threshold is exceeded or a high-risk attack phase is predicted (such as control command tampering), trigger the following linkage: Industrial honeypot system: Deploy simulated PLC devices and sensor honeypots in wireless links to lure attackers and record attack characteristics.

[0064] Physical layer defense: Initiate physical isolation of the equipment (such as disconnecting the physical connection of the abnormal PLC) and trigger on-site audible and visual alarms.

[0065] Network defense: Work with firewalls to block attack source IPs and restrict communication on abnormal ports.

[0066] Alarm push notification: Push alarm information to the mine dispatch center and safety management personnel, including the attack phase, affected equipment, and suggested measures.

[0067] Furthermore, the construction of a node classification system and calculation of the dynamic security weight of each node based on the open-pit mine network topology and node attributes includes: classifying open-pit mine network nodes into core control nodes, production equipment nodes, sensor monitoring nodes, office network nodes, and mobile access nodes; determining the degree value of each node based on the network topology, wherein the degree value calculation includes a weighted sum of the number of physical connections and the number of wireless communication links; assigning regional weights according to the risk level of the physical area where the node is located; and adjusting the dynamic coefficients according to the movement speed of the node. Calculate the dynamic security weight: Dynamic security weight = (node ​​predefined security level × degree value) × region weight × dynamic coefficient.

[0068] Furthermore, the improved dynamic clustering algorithm includes: The process is repeated until all industrial control flow data elements are classified. This process includes: selecting an initial central data element from unclassified data elements; prioritizing flow data from core control nodes during stable periods; for mobile node data elements, predicting the communication range for the next moment based on their location information and movement trajectory, and delineating potential association areas for the data elements; calculating the anti-interference correlation between the target data element and the central data element, where anti-interference correlation = security weight × time association probability × data volume matching degree × address similarity × signal strength factor, and the signal strength factor is used to correct deviations caused by wireless network interference; determining the maximum and minimum values ​​from each anti-interference correlation value, classifying the target data element corresponding to the maximum value into the data class of the central data element, and using the target data element corresponding to the minimum value as the new central data element, adjusting the lifecycle of the central data element according to the mobile node's location update mechanism. The calculation of the time correlation probability includes: sorting the industrial control flow data by arrival time to obtain a time series; calculating the first time difference between the central data element and the preceding data element, and the second time difference between the target data element and the preceding data element; introducing the open-pit mine production cycle coefficient to correct the mean of the time interval attribute: corrected mean = original mean × (1 + production cycle coefficient × time period factor), where the time period factor is dynamically adjusted according to the mining shift (e.g., day shift / night shift); and calculating the time correlation probability based on the first time difference, the second time difference, and the corrected mean. The calculation of address similarity includes: for fixed nodes, the IP address four-segment decimal number comparison method is used; for mobile nodes, the address similarity is calculated by combining MAC address and geographical location information, and the result is: address similarity = (MAC address matching degree × 0.6) + (geographical location overlap degree × 0.4), where the geographical location overlap degree is determined according to the distance error range of GPS coordinates.

[0069] Furthermore, the structured processing and modal characterization of equipment operation logs includes: extracting key fields from the logs, including equipment ID, operation instructions, fault codes, timestamps, operator information, and physical status labels; constructing an open-pit mine-specific dictionary containing vocabulary in areas such as equipment terminology, operation instructions, and fault types; and performing domain fine-tuning based on the BERT model to convert the structured log event stream into log event modal semantic feature encoding vectors, wherein the fine-tuning process incorporates an open-pit mine production process knowledge graph as external knowledge.

[0070] Furthermore, the time-series modeling of industrial control traffic data includes: adopting an improved Bi-LSTM model to address the jitter characteristics of open-pit mine wireless networks, and incorporating signal attenuation factors and retransmission mechanism features into the time-series feature extraction; extracting multi-dimensional time-series features of the traffic data, including packet interval, traffic peak, protocol type ratio, retransmission rate, and correlation with physical status monitoring data; and mapping the multi-dimensional time-series features into a network traffic modal time-series pattern feature encoding vector.

[0071] Furthermore, the cross-modal semantic alignment technique includes: calculating a cross-modal correlation matrix between the log event modal semantic feature encoding vector and the network traffic modal temporal pattern feature encoding vector, wherein the weights of the matrix elements are adjusted according to the causal relationship between open-pit mine production events and traffic changes; using a multi-scale convolutional neural network to filter the correlation matrix and retain cross-modal features strongly related to the production process; and mapping the two types of feature vectors to a unified semantic space to obtain aligned feature vectors.

[0072] Furthermore, the multimodal large model fine-tuned for open-pit mine scenarios includes: based on a general multimodal large model, using historical attack samples, equipment failure cases, and production anomaly data from open-pit mines for domain adaptation; introducing an attack phase labeling system, including "physical layer probing," "wireless link intrusion," "control command tampering," "production data theft," and "equipment paralysis attack"; and optimizing model parameters through comparative learning to enable the model to identify the unique attack chains in open-pit mines.

[0073] Furthermore, the calculation of the security situation awareness value of the open-pit mine network includes: for each node, calculating the product of the number of elements in the data class and the dynamic security weight, and the product of the average correlation and the node contribution in the clustering results, and summing them to obtain a first sum; calculating the time parameter variance of uplink and downlink data with the same identifier, and introducing a network jitter coefficient to correct the variance value; calculating the ratio of the first sum to the corrected variance, and superimposing them to obtain the situation awareness value of each node; combining the threat coefficient of the attack phase prediction results and the risk value of the physical state monitoring data, and weighted summing the node situation awareness values ​​to obtain the overall security situation awareness value of the network.

[0074] The present invention also includes a network security situation awareness device for open-pit mines, comprising: The multi-source data acquisition module is used to acquire industrial control flow data, equipment operation logs, physical status monitoring data and location information of each node in the open-pit mine network; The node weight calculation module is used to construct a classification system based on network topology and node attributes and calculate dynamic security weights. The dynamic clustering module is used to cluster industrial control flow data using an improved dynamic clustering algorithm; The feature extraction module is used to perform modal characterization on device operation logs and time-series modeling on traffic data to obtain two types of feature encoding vectors. The cross-modal fusion module is used to achieve feature fusion through cross-modal semantic alignment technology to obtain cross-modal interactive response inference encoding vectors; The attack prediction module is used to input the cross-modal interactive response inference encoding vector into a multimodal large model that is fine-tuned in the domain, and obtain the prediction results for the attack phase. The situation assessment module is used to calculate the network security situation awareness value by combining clustering results, dynamic security weights, physical state data, and attack prediction results; the response linkage module is used to link the industrial honeypot system to capture threats and trigger security alarms when the situation awareness value exceeds the threshold.

[0075] The present invention also provides an electronic device, characterized in that it includes a processor, a communication interface, a memory, and a communication bus; the processor, the communication interface, and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs on the memory to implement the steps of the open-pit mine network security situation awareness method.

[0076] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. In the above embodiments of the present invention, the descriptions of each embodiment have their own emphasis; parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. It should be understood that the disclosed technical content in the several embodiments provided in this application can be implemented in other ways.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for network security situation awareness in open-pit mines, characterized in that, Includes the following steps: Acquire multi-source data from each node in the open-pit mine network; the multi-source data includes: industrial control flow data, equipment operation logs, physical status monitoring data, and location information; Based on the open-pit mine network topology and node attributes, a node classification system is constructed and the dynamic security weight of each node is calculated; the node attributes include: equipment type, physical area, movement status and associated production process; For each node, an improved dynamic clustering algorithm is used to cluster the industrial control flow data to obtain the clustering results corresponding to each node; the improved dynamic clustering algorithm includes: a center data element update mechanism based on the movement trajectory and an anti-interference correlation calculation model; The device operation logs are structured and modal characterized to obtain log event modal semantic feature encoding vectors; The industrial control flow data is subjected to time series modeling to obtain the network flow modal time series pattern feature encoding vector; A cross-modal semantic alignment technique is used to map the log event modal semantic feature encoding vector and the network traffic modal temporal pattern feature encoding vector to a unified semantic space, and to perform fine-grained feature transfer interactive reasoning to obtain a cross-modal interactive response reasoning encoding vector. The cross-modal interactive response inference encoding vector is input into a multimodal large model fine-tuned for the open-pit mine scenario to obtain the attack phase prediction results. By combining the clustering results, dynamic security weights, physical state monitoring data, and attack phase prediction results, the security situation awareness value of the open-pit mine network is calculated. If the security situation awareness value is greater than the threshold or the attack phase prediction result is a high-risk phase, the open-pit mine industrial honeypot system will be activated to capture threats and trigger security alarms and defense strategies.

2. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The process of constructing a node classification system and calculating the dynamic security weight of each node based on the open-pit mine network topology and node attributes includes: classifying open-pit mine network nodes into core control nodes, production equipment nodes, sensor monitoring nodes, office network nodes, and mobile access nodes; determining the degree value of each node based on the network topology, wherein the degree value calculation includes a weighted sum of the number of physical connections and the number of wireless communication links; assigning regional weights according to the risk level of the physical area where the node is located; and adjusting the dynamic coefficients according to the node's movement status and movement speed. Calculate the dynamic security weight: Dynamic security weight = (node ​​predefined security level × degree value) × region weight × dynamic coefficient.

3. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The improved dynamic clustering algorithm includes: The process is repeated until all industrial control flow data elements are classified. This process includes: selecting an initial central data element from unclassified data elements; prioritizing flow data from core control nodes during stable periods; for mobile node data elements, predicting the communication range for the next moment based on their location information and movement trajectory, and delineating potential association areas for the data elements; calculating the anti-interference correlation between the target data element and the central data element, where anti-interference correlation = security weight × time association probability × data volume matching degree × address similarity × signal strength factor, and the signal strength factor is used to correct deviations caused by wireless network interference; determining the maximum and minimum values ​​from each anti-interference correlation value, classifying the target data element corresponding to the maximum value into the data class of the central data element, and using the target data element corresponding to the minimum value as the new central data element, adjusting the lifecycle of the central data element according to the mobile node's location update mechanism. The calculation of the time correlation probability includes: sorting the industrial control flow data by arrival time to obtain a time series; calculating the first time difference between the central data element and the preceding data element, and the second time difference between the target data element and the preceding data element; introducing the open-pit mine production cycle coefficient to correct the mean of the time interval attribute: corrected mean = original mean × (1 + production cycle coefficient × time period factor), where the time period factor is dynamically adjusted according to the mining shift (e.g., day shift / night shift); and calculating the time correlation probability based on the first time difference, the second time difference, and the corrected mean. The calculation of address similarity includes: for fixed nodes, the IP address four-segment decimal number comparison method is used; for mobile nodes, the address similarity is calculated by combining MAC address and geographical location information, and the result is: address similarity = (MAC address matching degree × 0.6) + (geographical location overlap degree × 0.4), where the geographical location overlap degree is determined according to the distance error range of GPS coordinates.

4. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The structured processing and modal characterization of equipment operation logs include: extracting key fields from the logs, including equipment ID, operation instructions, fault codes, timestamps, operator information, and physical status labels; constructing an open-pit mine-specific dictionary containing vocabulary related to equipment terminology, operation instructions, and fault types; and performing domain fine-tuning based on the BERT model to convert the structured log event stream into log event modal semantic feature encoding vectors. The fine-tuning process incorporates an open-pit mine production process knowledge graph as external knowledge.

5. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The time-series modeling of industrial control traffic data includes: adopting an improved Bi-LSTM model to address the jitter characteristics of open-pit mine wireless networks, and incorporating signal attenuation factors and retransmission mechanism features into the time-series feature extraction; extracting multi-dimensional time-series features of traffic data, including packet interval, traffic peak, protocol type ratio, retransmission rate, and correlation with physical status monitoring data; and mapping the multi-dimensional time-series features into a network traffic modal time-series pattern feature encoding vector.

6. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The cross-modal semantic alignment technique includes: calculating a cross-modal correlation matrix between log event modal semantic feature encoding vectors and network traffic modal temporal pattern feature encoding vectors, wherein the weights of the matrix elements are adjusted according to the causal relationship between open-pit mine production events and traffic changes; using a multi-scale convolutional neural network to filter the correlation matrix and retain cross-modal features strongly related to the production process; and mapping the two types of feature vectors to a unified semantic space to obtain aligned feature vectors.

7. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The multimodal large model fine-tuned for open-pit mine scenarios includes: based on a general multimodal large model, domain adaptation is performed using historical attack samples, equipment failure cases, and production anomaly data from open-pit mines; an attack phase labeling system is introduced, including "physical layer probing," "wireless link intrusion," "control command tampering," "production data theft," and "equipment paralysis attack"; and the model parameters are optimized through comparative learning, enabling the model to identify the unique attack chains in open-pit mines.

8. The method for network security situation awareness in open-pit mines according to claim 1, characterized in that, The calculation of the security situation awareness value of the open-pit mine network includes: for each node, calculating the product of the number of elements in the data class and the dynamic security weight, and the product of the average correlation and the node contribution in the clustering results, and summing them to obtain the first sum; calculating the time parameter variance of uplink and downlink data with the same identifier, and introducing a network jitter coefficient to correct the variance value; calculating the ratio of the first sum to the corrected variance, and superimposing them to obtain the situation awareness value of each node; combining the threat coefficient of the attack phase prediction results and the risk value of the physical state monitoring data, and weighted summing the node situation awareness values ​​to obtain the overall security situation awareness value of the network.

9. A network security situational awareness device for open-pit mines, characterized in that, include: The multi-source data acquisition module is used to acquire industrial control flow data, equipment operation logs, physical status monitoring data and location information of each node in the open-pit mine network; The node weight calculation module is used to construct a classification system based on network topology and node attributes and calculate dynamic security weights. The dynamic clustering module is used to cluster industrial control flow data using an improved dynamic clustering algorithm; The feature extraction module is used to perform modal characterization on device operation logs and time-series modeling on traffic data to obtain two types of feature encoding vectors. The cross-modal fusion module is used to achieve feature fusion through cross-modal semantic alignment technology to obtain cross-modal interactive response inference encoding vectors; The attack prediction module is used to input the cross-modal interactive response inference encoding vector into a multimodal large model that is fine-tuned in the domain, and obtain the prediction results for the attack phase. The situation assessment module is used to calculate the network security situation awareness value by combining clustering results, dynamic security weights, physical state data, and attack prediction results; the response linkage module is used to link the industrial honeypot system to capture threats and trigger security alarms when the situation awareness value exceeds the threshold.

10. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus; the processor, communication interface, and memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs in the memory to implement the steps of the open-pit mine network security situation awareness method as described in any one of claims 1-8.

Images