Node control method and apparatus based on security posture information, device, and medium

Abstract

Embodiments of the present disclosure disclose a node control method and device based on security posture information, equipment and a medium. A specific embodiment of the method comprises: collecting various multidimensional data; performing security perception processing on each security analysis data to obtain each security perception information; performing health perception processing on each node health monitoring data to obtain each health perception information; performing environment perception processing on each environment data to obtain each environment perception information; performing risk assessment processing on each health perception information to obtain each risk assessment information; obtaining each location information and each state information; performing dynamic correlation processing on each location information to obtain each security posture information and security ranking information; displaying each security posture information and security ranking information on an interactive interface, and controlling each data providing node to perform each security posture response operation. The embodiment improves the timeliness and collaboration of node control.

Description

Technical Field

[0001] The embodiments of this disclosure relate to the field of computer technology, and more specifically to node control methods, apparatus, devices, and media based on security situation information. Background Technology

[0002] With the widespread application of complex integrated systems such as smart cities, the Internet of Things, the Industrial Internet, and cloud computing, the targets of security protection have expanded from single terminals to massive, heterogeneous interconnected nodes. Security threats are exhibiting new characteristics such as cross-domain propagation, rapid evolution, and coordinated attacks. This places higher demands on the timeliness of node control in the security protection system. Once the response is delayed, attackers can easily exploit the time difference to spread threats or solidify privileges, thereby weakening the overall protection capability. Node control based on security situation information is a technology for security regulation of key nodes (such as encrypted terminals, variable message signs, etc.) in the network and physical environment. Currently, the common method for security regulation of nodes is to generate independent alarms or log events through security devices (such as firewalls, intrusion detection systems) or operating platforms. Security analysts then analyze these discrete events based on a preset static rule base and send control commands to the target nodes.

[0003] However, when using the above method to control nodes, the following technical problems often arise: Independent alarms or log events are generated by security devices (such as firewalls and intrusion detection systems) or operational platforms. Security analysts then analyze these discrete events based on a pre-defined static rule base and send control commands to the target nodes. Due to the lack of integrated perception and assessment of the overall security situation, it is impossible to accurately determine the level and evolution trend of threats, which leads to the lag and one-sidedness of control decisions, resulting in poor timeliness and coordination of node control.

[0004] The information disclosed in this background section is only intended to enhance the understanding of the background of the inventive concept, and therefore may contain information that does not form prior art known to those skilled in the art. Summary of the Invention

[0005] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0006] Some embodiments of this disclosure propose node control methods, apparatuses, electronic devices, and computer-readable media based on security situation information to solve one or more of the technical problems mentioned in the background section above.

[0007] In a first aspect, some embodiments of this disclosure provide a node control method based on security situation information. The method includes: collecting various multi-dimensional data corresponding to each data provision node, wherein each of the multi-dimensional data includes security analysis data, node health monitoring data, and environmental data; performing security awareness processing on the security analysis data included in the multi-dimensional data to obtain various security awareness information; performing health status awareness processing on the node health monitoring data included in the multi-dimensional data to obtain various health status awareness information; performing environmental awareness monitoring processing on the environmental data included in the multi-dimensional data to obtain various environmental awareness monitoring information; and performing environmental awareness monitoring processing on the security awareness information and the environmental awareness information. Knowing the monitoring information, a comprehensive risk assessment is performed on the aforementioned health status perception information to obtain comprehensive risk assessment information; the location information and status information corresponding to the aforementioned data providing nodes are acquired; based on the aforementioned comprehensive risk assessment information, the aforementioned health status perception information, the aforementioned security perception information, the aforementioned environmental perception monitoring information, and the aforementioned status information, the aforementioned location information is dynamically correlated to obtain comprehensive security situation information and security ranking information; the aforementioned comprehensive security situation information and security ranking information are displayed on a preset interactive interface, and based on the aforementioned security ranking information, the aforementioned data providing nodes are sequentially controlled to execute various security situation response operations corresponding to the aforementioned comprehensive security situation information.

[0008] Secondly, some embodiments of this disclosure provide a security situation awareness and monitoring device, comprising: a data acquisition unit configured to acquire multi-dimensional data corresponding to various data providing nodes; a security awareness processing unit configured to perform security awareness processing on the security analysis data included in the multi-dimensional data to obtain various security awareness information; a health status perception processing unit configured to perform health status perception processing on the health monitoring data of various nodes included in the multi-dimensional data to obtain various health status perception information; an environmental perception monitoring processing unit configured to perform environmental perception monitoring processing on the environmental data included in the multi-dimensional data to obtain various environmental perception monitoring information; and a comprehensive risk assessment processing unit configured to perform comprehensive risk assessment based on the security awareness information and the environmental perception monitoring information. The system performs comprehensive risk assessment processing on the aforementioned health status perception information to obtain comprehensive risk assessment information; the acquisition unit is configured to acquire location information and status information corresponding to the aforementioned data providing nodes; the dynamic association processing unit is configured to perform dynamic association processing on the aforementioned location information based on the aforementioned comprehensive risk assessment information, the aforementioned health status perception information, the aforementioned security perception information, the aforementioned environmental perception monitoring information, and the aforementioned status information to obtain comprehensive security situation information and security ranking information; the display unit is configured to display the aforementioned comprehensive security situation information and the aforementioned security ranking information on a preset interactive interface, and based on the aforementioned security ranking information, sequentially control the aforementioned data providing nodes to execute various security situation response operations corresponding to the aforementioned comprehensive security situation information.

[0009] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0010] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0011] The above-described embodiments of this disclosure have the following beneficial effects: the node control method based on security situation information in some embodiments of this disclosure improves the timeliness and coordination of node control. Specifically, the reason for the poor timeliness and coordination of node control based on security situation information is that: independent alarms or log events are generated by security devices (such as firewalls, intrusion detection systems) or operating platforms, and security analysts analyze these discrete events based on a preset static rule base and send control commands to the target node. Due to the lack of integrated perception and assessment of the overall security situation, it is impossible to accurately determine the level and evolution trend of threats, which leads to the lag and one-sidedness of control decisions, resulting in poor timeliness and coordination of node control. Based on this, the node control method based on security situation information in some embodiments of this disclosure first collects various multi-dimensional data corresponding to each data provider node, wherein each of the above multi-dimensional data includes security analysis data, node health monitoring data, and environmental data. Then, security awareness processing is performed on the security analysis data included in the above multi-dimensional data to obtain various security awareness information. Therefore, various security awareness information representing attack patterns and evolution trends can be obtained for comprehensive risk assessment. Next, health status awareness processing is performed on the node health monitoring data included in the aforementioned multi-dimensional data to obtain various health status awareness information for assessing device health status (e.g., memory, link status). This yields various health status awareness information for comprehensive risk assessment. Then, environmental awareness monitoring processing is performed on the environmental data included in the aforementioned multi-dimensional data to obtain various environmental awareness monitoring information. This provides environmental awareness monitoring information that integrates physical environment data with security events to assess the suitability of the device's ambient temperature and humidity. Subsequently, based on the aforementioned security awareness information and environmental awareness monitoring information, comprehensive risk assessment processing is performed on the aforementioned health status awareness information to obtain comprehensive risk assessment information. Thus, comprehensive risk assessment can be performed based on the various security awareness information and environmental awareness information, placing discrete alarm events in a multi-dimensional fusion real-time situation for dynamic evaluation, resulting in comprehensive risk assessment information that, after comprehensive judgment, can characterize the security risk level. Then, the location information and status information corresponding to the aforementioned data providing nodes are obtained. Next, based on the aforementioned comprehensive risk assessment information, health status perception information, security perception information, environmental perception and monitoring information, and status information, the aforementioned location information is dynamically correlated to obtain comprehensive security situation information and security ranking information.Therefore, fragmented risk, health, safety, environmental, and status information can be integrated into a unified geospatial situation view and security ranking, transforming discrete events into a holistic perception of events. After comprehensively assessing the overall security situation, various comprehensive security situation information and security ranking information are generated. Finally, these comprehensive security situation information and security ranking information are displayed on a preset interactive interface. Based on the security ranking information, the various data providing nodes are sequentially controlled to execute the corresponding security situation response operations. This allows for visualization of the integrated comprehensive security situation and security ranking information. According to the security ranking information, nodes with lower security coefficients are prioritized for response operations. While ensuring overall security, priority is given to controlling nodes with lower security coefficients, thereby improving the timeliness of node control. Global situational awareness information is transformed into actionable collaborative control commands, sequentially controlling the various data providing nodes to execute the corresponding security situation response operations. Because it incorporates physical world data (temperature) and combines it with security awareness information (attack chain analysis) and health status traces (device performance) to conduct a comprehensive risk assessment and determine the threat level, it integrates multi-source information to generate comprehensive security situation information. Based on the security ranking information, it prioritizes security coefficients and prioritizes controlling data providing nodes with lower security coefficients to perform situational response operations. It controls each data providing node in sequence, and the response is no longer a static action for a single alarm (such as "blocking IP"), but a coordinated and ordered response to the overall situation. It prioritizes the handling of nodes with lower security coefficients, thereby improving the timeliness and coordination of node control. Attached Figure Description

[0012] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0013] Figure 1 This is a flowchart of some embodiments of the node control method based on security situation information according to this disclosure; Figure 2 This is a schematic diagram of the structure of some embodiments of the node control device based on security situation information according to the present disclosure; Figure 3 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0014] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0015] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0016] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0017] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0018] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0019] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] Figure 1 A flowchart 100 is shown, illustrating some embodiments of a node control method based on security situation information according to this disclosure. This security situation awareness and monitoring method includes the following steps: Step 101: Collect multi-dimensional data corresponding to each data providing node.

[0021] In some embodiments, the execution entity (e.g., a computing device) of the node control method based on security situation information can collect multi-dimensional data corresponding to each data providing node. Each of the aforementioned data providing nodes includes an encrypted terminal and a group of variable message signs (VMS). The encrypted terminal can be an office computer, mobile device, server, etc. The VMS group can be a collection of VMS connected to the same encrypted terminal.

[0022] In some optional implementations of certain embodiments, the aforementioned execution entity may collect various multi-dimensional data corresponding to each data providing node through the following steps: The first step is to perform the following steps for each of the above data provider nodes: The first sub-step involves acquiring the operating system information, encrypted file audit logs, and terminal permission operation records corresponding to the encrypted terminals included in the aforementioned data providing nodes. In practice, the executing entity can acquire these information via wired or wireless connections. It should be noted that the wireless connection methods can include, but are not limited to, 3G / 4G, WiFi, Bluetooth, WiMAX, Zigbee, UWB (ultra-wideband), and other currently known or future wireless connection methods. The operating system information can include system configuration details such as operating system version, kernel version, system architecture, patch update records, and a list and versions of installed software. The encrypted file audit logs can record operations such as the creation, reading, modification, deletion, and permission changes of encrypted files. The terminal permission operation records can include the user's command history (such as sudo privilege escalation), account login and switching logs, file system permission change records (such as chmod and chown commands), and privileged process startup and access records.

[0023] The second sub-step involves identifying the aforementioned operating system information, the aforementioned encrypted file audit logs, and the aforementioned terminal permission operation records as terminal security data.

[0024] The third sub-step involves acquiring security data for each variable intelligence board in the variable intelligence board group included in the aforementioned data providing nodes. This security data includes firmware version security posture information, source and content integrity information, and link security audit logs. In practice, the executing entity can acquire the security data for each variable intelligence board in the variable intelligence board group included in the aforementioned data providing nodes via wired or wireless connections. The security data can be a structured JSON data packet or database record used to comprehensively assess the overall security status of the variable intelligence board. The firmware version security posture information includes the firmware version number, release date, known vulnerability list (CVE number), patch status, and version checksum hash value. The source and content integrity information is a comprehensive assessment of the reliability of the information source and the completeness of the information content. The link security audit logs are log files recording all data communication link establishment, transmission, and disconnection events.

[0025] The fourth sub-step involves determining the security data of each intelligence board as the intelligence board security data set.

[0026] The fifth sub-step involves determining the aforementioned terminal security data and the aforementioned information board security data set as security analysis data.

[0027] The sixth sub-step involves acquiring the terminal memory information, terminal processor information, terminal disk information, and terminal link status information corresponding to the encrypted terminals included in the aforementioned data providing nodes. In practice, the executing entity can acquire these information via wired or wireless connections. Specifically, the terminal processor information includes terminal processor utilization and load information. The terminal memory information includes terminal memory utilization and remaining memory capacity information. The terminal disk information includes terminal disk monitoring status, terminal disk utilization, and remaining disk space information. The terminal link status information includes terminal network link latency, terminal network link packet loss rate, and terminal network link bandwidth information. The terminal memory information can be used to monitor the real-time memory usage of the encrypted terminal and determine if there is a risk of insufficient memory or memory leakage. The terminal processor information can be used to assess the computational load and processing capabilities of the encrypted terminal. The terminal disk information can be used to monitor the storage health and remaining space of the encrypted terminal, preventing service anomalies or log loss due to disk overload. The aforementioned terminal link status information can be used to diagnose the connection quality and stability between the terminal and the system network. The aforementioned terminal processor utilization information represents the proportion of time the encrypted terminal's CPU spends processing computational tasks (such as running programs, decompressing data, and executing instructions). The aforementioned terminal processor load information represents the average number of running and waiting processes in the encrypted terminal. The aforementioned average number of processes represents the number of running and waiting processes per unit time (e.g., 5 minutes). The aforementioned terminal memory utilization information represents the percentage of total memory used in the encrypted terminal. The aforementioned terminal remaining memory capacity information represents the size of unused physical memory in the encrypted terminal. The aforementioned terminal disk monitoring status information, obtained through Self-Monitoring Analysis and Reporting Technology (SMART), monitors the encrypted terminal's disk for issues such as bad sectors, motor failures, and aging. The aforementioned terminal disk utilization information represents the percentage of total disk capacity stored on the encrypted terminal's disk. The aforementioned terminal disk remaining space information represents the size of unused storage space on the encrypted terminal's disk. The aforementioned terminal network link latency information represents the time required for data to be transmitted from the encrypted terminal to another device. The aforementioned terminal network link packet loss rate information represents the percentage of data packets lost during data transmission by the encrypted terminal out of the total number of packets sent. The aforementioned terminal network link bandwidth information represents the maximum amount of data (e.g., Mbps, or megabits per second) that the encrypted terminal can transmit per unit time (typically per second).

[0028] The seventh sub-step involves determining the aforementioned terminal memory information, terminal processor information, terminal disk information, and terminal link status information as terminal health data.

[0029] The eighth sub-step involves acquiring health data for each variable message sign (VMS) in the aforementioned VMS group, which includes the data providing nodes. This health data includes VMS memory information, VMS processor information, VMS disk information, and VMS link status information. In practice, the executing entity can acquire the corresponding health data for each VMS in the aforementioned VMS group, which includes the data providing nodes, via wired or wireless connection. The health data includes VMS memory information, VMS processor information, VMS disk information, and VMS link status information. This health data can be a structured data object (e.g., JSON format) that comprehensively assesses the overall operational status of the VMS. The VMS memory information indicates the memory usage of the VMS's built-in computer or controller module, ensuring sufficient resources for firmware operation, content processing, and data caching. The VMS processor information indicates the workload and performance of the VMS's core processing unit (CPU). The aforementioned disk information for the variable message sign (VMS) indicates the storage status of its internal storage devices (such as solid-state drives (SSDs) or embedded storage). The aforementioned link status information indicates the network communication link status between the VMS and other devices. This network communication link status serves as a comprehensive indicator of the availability and quality of the network link between two VMS or between a VMS and an encrypted terminal.

[0030] The ninth sub-step involves determining the acquired health data of each intelligence panel into an intelligence panel health data set.

[0031] The tenth sub-step involves determining the aforementioned terminal health data and the aforementioned intelligence board health data set as node health monitoring data.

[0032] The eleventh sub-step involves acquiring the terminal temperature and humidity information corresponding to the encrypted terminals included in the aforementioned data providing nodes. In practice, the executing entity can acquire the terminal temperature and humidity information corresponding to the encrypted terminals included in the aforementioned data providing nodes through hardware interfaces (such as USB or serial interfaces) collected by humidity and temperature sensors. The terminal temperature information can represent the real-time operating temperature of key components (such as CPU or main chip) inside the encrypted terminal or the cabinet / installation location where the device is located. The terminal humidity information can represent the relative humidity of the air inside the encrypted terminal or in the vicinity of the device.

[0033] The twelfth sub-step involves determining the aforementioned terminal temperature information and terminal humidity information as terminal environmental data.

[0034] The thirteenth sub-step involves acquiring environmental data corresponding to each variable information board in the variable information board group included in the aforementioned data providing node. This environmental data includes information board temperature and humidity information. In practice, the executing entity can acquire environmental data corresponding to each variable information board in the variable information board group, collected by humidity and temperature sensors, via hardware interfaces (such as USB or serial interfaces). This environmental data represents the environmental state of the variable information board. The information board temperature information represents the real-time operating temperature of the enclosed space inside the variable information board (such as the power module, controller, or heat dissipation area on the back of the display screen). The information board humidity information represents the relative humidity of the air inside the variable information board.

[0035] The fourteenth sub-step involves determining the acquired environmental data from each intelligence board as the intelligence board environmental data set.

[0036] The fifteenth sub-step involves determining the aforementioned terminal environment data and the aforementioned information board environment data set as the environment data.

[0037] The sixteenth sub-step involves defining the aforementioned security analysis data, node health monitoring data, and environmental data as multi-dimensional data.

[0038] Step 102: Perform security awareness processing on the various security analysis data included in the multi-dimensional data to obtain various security awareness information.

[0039] In addressing the technical challenges of the aforementioned background technologies, and considering the specific application scenario—dynamic collaborative security control of Variable Message Systems (VMS) in urban expressway networks with limited edge computing resources—the generation of various security awareness information often presents the following technical issues: Dynamic collaborative security control of VMS in urban expressway networks with limited edge computing resources requires rapid response to clearly defined, high-confidence security events, rather than comprehensive, in-depth global analysis. However, conventional methods utilize edge nodes to perform deep correlation analysis, multimodal fusion, and complex modeling on massive amounts of data to obtain various security awareness information. This involves applying global, in-depth, and complex analysis logic to all data, mobilizing significant CPU and GPU resources. Furthermore, applying this same global, in-depth, and complex analysis logic to data without security anomalies leads to a waste of computing resources. Given the specific requirements of this application scenario—limited edge computing resources in urban expressway networks—we aim to reduce the waste of computing resources. Faced with these technical challenges, we have decided to adopt the following solution: In some embodiments, the aforementioned executing entity can perform security awareness processing on the various security analysis data included in the aforementioned multi-dimensional data to obtain various security awareness information. In practice, the aforementioned executing entity can perform security awareness processing on the various security analysis data included in the aforementioned multi-dimensional data to obtain various security awareness information.

[0040] In some optional implementations of certain embodiments, the aforementioned execution entity may perform security awareness processing on the various security analysis data included in the aforementioned multi-dimensional data through the following steps to obtain various security awareness information: The first step is to perform the following steps for each of the security analysis data points mentioned above: The first sub-step involves using a Field-Programmable Gate Array (FPGA) to perform abnormal permission filtering on the terminal permission operation records included in the aforementioned terminal security data, resulting in abnormal terminal permission operation records. In practice, firstly, the aforementioned executing entity can compile predefined abnormal permission behavior information into FPGA hardware logic circuits. Then, the terminal permission operation records are input into the FPGA to obtain abnormal terminal permission operation records. These abnormal terminal permission operation records can be structured log entries or event records that detail terminal permission changes, privileged command executions, or resource access behaviors deemed suspicious or violating security policies by the system (such as an FPGA). The aforementioned predefined abnormal permission behavior information can be a set of formalized security detection rules, policies, or behavioral characteristics that can be directly parsed and matched by hardware logic (such as an FPGA) or software engines. For example, the predefined abnormal permission behavior information mentioned above can be {(privilege escalation anomaly: non-administrator user attempts to obtain root / SYSTEM privileges)(sensitive operation sequence: continuous access to multiple sensitive files or critical system configurations within a short period of time)(time and frequency anomaly: performing permission operations during non-working hours or at extremely high frequency)(violation of the principle of least privilege: the permissions requested by the operation far exceed the permissions required by its role)(known malicious pattern: specific command sequences or system call patterns related to attack tools (such as Mimikatz, privilege escalation exploits)}.

[0041] The second sub-step involves closing the process corresponding to the aforementioned abnormal terminal permission operation record. In practice, the executing entity can send a forced process termination command to the encrypted terminal by calling the process management interface provided by the operating system or security management platform to close the process corresponding to the aforementioned abnormal terminal permission operation record. This process can be a running instance of the executable program that triggered the abnormal permission operation record, or a child process or malicious payload directly derived from or associated with that operation.

[0042] The third sub-step involves generating alarm count information based on the aforementioned abnormal terminal permission operation records. In practice, the executing entity can obtain alarm count information by statistically analyzing the abnormal terminal permission operation records within a predefined time window. This alarm count information can be a structured data field describing the frequency of abnormal permission operation events within a specific time range. For example, if the executing entity counts 4 abnormal terminal permission operation records for encrypted terminal A within a predefined time window (6 hours), then the obtained alarm count information is: Encrypted Terminal A: 4 times.

[0043] The fourth sub-step involves performing spatiotemporal correlation analysis on the encrypted file audit logs included in the terminal security data and the various link security audit logs included in the information board security data set, based on preset spatiotemporal correlation information, to obtain at least one spatiotemporal correlation analysis information. In practice, firstly, the executing entity, in response to determining that at least one link security audit log among the encrypted file audit logs and the various link security audit logs satisfies the preset spatiotemporal correlation information, calculates the time difference between the time included in the encrypted file audit logs and the time included in the at least one link security audit log to obtain time correlation information. Then, based on the spatial connection relationship between the encrypted terminal and the variable message signage (VMS) represented by the preset device association topology diagram, spatial correlation analysis is performed on the encrypted terminal corresponding to the encrypted file audit logs and the at least one VMS corresponding to the at least one link security audit log to obtain spatial correlation information. Finally, the encrypted file audit logs, the at least one link security audit log, the time correlation information, the spatial correlation information, and the preset spatiotemporal correlation information are determined as the spatiotemporal correlation analysis information. As an example, the encrypted file audit log mentioned above could be 10:07:15, indicating an unauthorized user's failed attempt to modify secure_config.cfg via PowerShell, a case of abnormal modification attempt. The link security audit logs mentioned above could be 10:07:20, indicating a link security authentication failure when the information board connects to the server. The aforementioned preset spatiotemporal correlation information suggests that if a terminal's encrypted configuration file or key experiences abnormal access (especially modification attempts) within a short period (e.g., within 10 minutes), and the associated information board subsequently experiences communication authentication failure, then there is a high suspicion of key / configuration leakage or tampering, and its use for illegal communication. Each of the at least one spatiotemporal correlation analysis pieces of the above can be an event where, at 10:07:15, an unauthorized user attempts to modify secure_config.cfg via PowerShell fails, indicating an abnormal modification attempt on an encrypted file; and at 10:07:20, certificate verification fails when the intelligence board connects to the server, indicating a link security authentication failure. Both events occur within the same time window (within 5 minutes), and asset SRV-DB-01 and intelligence board-Panel-05 are topologically associated (SRV-DB-01 is the configuration server for Panel-05), suggesting a suspected key / configuration leak or tampering. Each of the at least one spatiotemporal correlation analysis pieces of the above can represent a comprehensive analysis conclusion record indicating that security events are inherently correlated in time and space, and may constitute a complete attack chain or abnormal behavior pattern. The above-mentioned preset device association topology diagram can represent the spatial connection relationship between each encrypted terminal and each variable intelligence board.The spatial correlation information described above can represent the physical or network topology connection between the encrypted terminal and the variable message sign. The temporal correlation information described above can represent the temporal sequence and proximity of events recorded on the encrypted terminal and the variable message sign.

[0044] The fifth sub-step involves performing preliminary correlation analysis on the at least one spatiotemporal correlation analysis information based on the aforementioned encrypted file audit logs and the security audit logs of each link, to obtain at least one preliminary event correlation information. Each of the at least one preliminary event correlation information includes an encrypted terminal identifier and a variable message sign (VMS) identifier. In practice, firstly, for each of the at least one spatiotemporal correlation analysis information, the executing entity can identify the link security audit log corresponding to the aforementioned spatiotemporal correlation analysis information in the aforementioned link security audit logs as the target link security audit log. Then, the encrypted file audit logs, the target link security audit logs, and the aforementioned spatiotemporal correlation analysis information are combined to obtain the preliminary event correlation information. Each of the at least one preliminary event correlation information can be a comprehensive analysis conclusion of a complete attack chain or abnormal behavior pattern that may be constituted by a series of related security events of the encrypted terminal and the VMS. The encrypted terminal identifier can be a string used to uniquely represent the encrypted terminal. The VMS identifier can be a string used to uniquely represent the VMS. For example, each of the above-mentioned primary event association details could be: around 10:07, an abnormal modification attempt to the security configuration file occurred on the encrypted terminal SRV-DB-01, subsequently causing the associated intelligence panel Panel-05 to fail certificate verification when connecting to the server. A suspected attacker attempted to tamper with the configuration or steal credentials, and could potentially use this to disrupt secure communication between the intelligence panel and the server.

[0045] The sixth sub-step involves performing the following steps for each of the at least one primary event association information mentioned above: Sub-step one: Determine the operating system information of the encrypted terminal corresponding to the encrypted terminal identifier included in the primary association information of the aforementioned event as the target operating system information.

[0046] Sub-step two involves identifying the firmware version security posture information and source and content integrity information of the variable message sign corresponding to the variable message sign identifier, which is included in the primary association information of the aforementioned event, as the target firmware version security posture information and target source and content integrity information.

[0047] Sub-step three involves performing vulnerability matching analysis on the target operating system information and the target firmware version security posture information based on a pre-defined known vulnerability database to obtain vulnerability matching information. In practice, the executing entity can compare the target operating system information and the target firmware version security posture information with known vulnerability information in the pre-defined known vulnerability database to obtain vulnerability matching information. As an example, the executing entity queries the knowledge base and finds that the firmware version information (v2.1.5) matches the known vulnerability information (CVE-2023-12345). Then, the variable message sign corresponding to the target firmware version security posture information is identified as the target sign. Finally, the vulnerability matching information is obtained: the target variable message sign Panel-05 has a known high-risk vulnerability CVE-2023-12345, which can lead to remote content injection. The pre-defined known vulnerability database can be a structured, continuously updated vulnerability information database (e.g., the U.S. National Vulnerability Database (NVD)). The vulnerability matching information can be the identified known vulnerabilities.

[0048] Sub-step four involves performing attack pattern analysis and intent inference on the primary event correlation information based on a pre-defined attack pattern information database and the aforementioned vulnerability matching information, yielding attack pattern analysis information. In practice, the executing entity can first use filter plugins from Apache NiFi or Logstash to convert the input primary event correlation information and vulnerability matching information into a unified JSON format and extract key fields (such as vulnerability CVE_ID). Then, CVE data (in JSON format) is downloaded from the National Vulnerability Database (NVD) website (nvd.nist.gov). Next, the downloaded CVE data is stored in a local database (such as Elasticsearch or PostgreSQL) or an in-memory database (such as Redis), creating a fast query index table indexed by CVE_ID. Then, the extracted key field (vulnerability CVE_ID) is matched against the fast query index table to obtain vulnerability type information. Finally, the extracted key field (vulnerability CVE_ID) is matched against the CVE_IDs of software vulnerabilities exploited by attack techniques recorded in the MITRE ATT&CK framework to obtain pattern analysis information. Then, the aforementioned vulnerability type information and pattern analysis information are identified as attack pattern analysis information. The aforementioned pre-defined attack pattern information database can be a structured attack behavior knowledge graph, which systematically describes the execution steps, logical sequence, required conditions (such as exploited vulnerabilities), and ultimate goals (e.g., the MITRE ATT&CK framework) of common attack techniques. The aforementioned attack pattern analysis information can represent the possible attack techniques and attacker intent identified after mapping the aforementioned primary event correlation information to known attack framework stages. The aforementioned vulnerability type information can represent the technical nature and causes of vulnerabilities. The aforementioned pattern analysis information can represent the tactical intent of vulnerabilities in real attack activities. For example, the aforementioned attack pattern analysis information could indicate that an attacker has suspected intrusion into an internal encrypted terminal (SRV-DB-01), attempting to steal or destroy communication credentials by tampering with security configuration files, and may plan to exploit a known remote content injection vulnerability (CVE-2023-12345) in the intelligence board (Panel-05) to carry out a man-in-the-middle attack or malicious content delivery, with the ultimate intent to compromise the integrity of the intelligence board system, steal transmitted data, or implant a backdoor.

[0049] Sub-step five involves generating security awareness information based on the aforementioned attack pattern analysis information, alarm count information, and target source and content completeness information. In practice, the executing entity can identify the aforementioned attack pattern analysis information, alarm count information, and target source and content completeness information as security awareness information. This security awareness information can represent data indicating the overall security status of the system. For example, the target source and content completeness information could be that the information panel (Panel-05) received a display update command at 10:07:30. Verification revealed that the digital signature of the central management server attached to the command was invalid, the SHA-256 hash value "a1b2c3…" in the message body did not match the expected hash value "x9y8z7…" published by the system, and the timestamp "10:05:00" in the command had an abnormal delay from the receiving time. Based on this, it was determined that the information source was untrustworthy and the content had been tampered with. The alarm count information could be that the information panel (Panel-05) experienced two "communication certificate verification failures" within the past hour. The aforementioned security awareness information indicates that the Panel-05 intelligence board received a display update command at 10:07:30. Verification revealed that the digital signature of the central management server attached to the command was invalid, the SHA-256 hash value "a1b2c3…" in the message body did not match the expected hash value "x9y8z7…" published by the system, and the timestamp "10:05:00" within the command showed an abnormal delay from the reception time. Based on these findings, the source of the information was deemed untrustworthy, and the content had been tampered with. Within the past hour, the Panel-05 intelligence board experienced two "communication certificate verification failures." Attackers are suspected of having compromised the internal encrypted terminal (SRV-DB-01), attempting to steal or destroy communication credentials by modifying security configuration files. They may also be planning to exploit the known remote content injection vulnerability (CVE-2023-12345) in the Panel-05 intelligence board to carry out man-in-the-middle attacks or malicious content delivery, ultimately aiming to compromise the integrity of the intelligence board system, steal transmitted data, or implant backdoors.

[0050] The above-mentioned technical solution and related content, as an inventive point of this disclosure, solve the technical problem of "waste of computing resources". Factors leading to wasted computing resources in node control based on security situation information are often as follows: Dynamic collaborative security control of Variable Information Management Systems (VMS) with limited edge computing resources in urban expressway networks requires rapid response to explicit, high-confidence security events, rather than comprehensive, in-depth analysis. However, conventional methods utilize edge nodes to perform deep correlation analysis, multimodal fusion, and complex modeling on large amounts of data to obtain various security perception information. This involves applying global, in-depth, and complex analysis logic to all data, mobilizing significant CPU and GPU resources. Furthermore, this global, in-depth, and complex analysis logic is applied even to data without security anomalies, resulting in wasted computing resources. Solving these factors can reduce the waste of computing resources in urban expressway networks with limited edge computing resources. To achieve this effect, firstly, the following steps are performed on each of the aforementioned security analysis data: Then, a field-programmable gate array (FPGA) is used to perform abnormal permission filtering on the terminal permission operation records included in the aforementioned terminal security data to obtain abnormal terminal permission operation records. Therefore, the parallel processing capabilities and hardware-level execution efficiency of FPGAs can be utilized to perform real-time, high-speed streaming filtering of massive amounts of terminal permission operation records, identifying abnormal terminal permission operation records and reducing the amount of data that subsequent steps need to process, thus saving significant computing resources. Next, the processes corresponding to the aforementioned abnormal terminal permission operation records are shut down. This avoids the need for subsequent, more complex attack monitoring and analysis that might result from the continued operation of malicious processes, thereby preventing a surge in security posture data and subsequent, larger, and more complex analysis and computational overhead due to attack propagation. Then, based on the aforementioned abnormal terminal permission operation records, alarm count information is generated. This provides alarm count information used to generate security awareness information. Subsequently, based on preset spatiotemporal correlation information, spatiotemporal correlation analysis is performed on the encrypted file audit logs included in the aforementioned terminal security data and the various link security audit logs included in the aforementioned intelligence board security data set, obtaining at least one spatiotemporal correlation analysis piece of information. Thus, the two types of logs can be correlated using preset spatiotemporal correlation rules, filtering out the vast majority of log entries that are not spatiotemporally related or irrelevant. Next, based on the aforementioned encrypted file audit logs and the security audit logs of each link, a preliminary correlation analysis is performed on the at least one spatiotemporal correlation analysis information to obtain at least one event preliminary correlation information. Each of the at least one event preliminary correlation information includes an encrypted terminal identifier and a variable message sign identifier. Thus, preliminary event correlation information for attack pattern analysis and intent inference processing can be obtained.Then, for each of the at least one event primary association information mentioned above, the following steps are performed: Next, the operating system information of the encrypted terminal corresponding to the encrypted terminal identifier included in the event primary association information is determined as the target operating system information. Then, the firmware version security posture information and source and content integrity information of the variable message sign (VMS) corresponding to the VMS identifier included in the event primary association information are determined as the target firmware version security posture information and target source and content integrity information. Then, based on a preset known vulnerability database, vulnerability matching analysis is performed on the target operating system information and the target firmware version security posture information to obtain vulnerability matching information. Thus, vulnerability matching information for attack pattern analysis and intent inference processing can be obtained. Next, based on a preset attack pattern information database and the vulnerability matching information, attack pattern analysis and intent inference processing are performed on the event primary association information to obtain attack pattern analysis information. Thus, attack pattern analysis information can be obtained to generate security awareness information. Finally, based on the attack pattern analysis information, the alarm count information, and the target source and content integrity information, security awareness information is generated. Thus, security awareness information for comprehensive risk assessment processing can be generated. Because FPGA hardware is used to filter massive amounts of terminal permission operation records, abnormal terminal permission operation records are selected and the processes corresponding to these abnormal terminal permission operation records are closed. Subsequently, spatiotemporal correlation analysis is performed on a large number of logs to obtain related security attack events (such as "abnormal permission operation of terminal A at 3 am" and "abnormal traffic of link B"). This reduces the amount of data that needs to be processed in subsequent steps and avoids malicious processes from running continuously and wasting computing resources, thereby reducing the waste of computing resources.

[0051] Step 103: Perform health status perception processing on the health monitoring data of each node included in the multi-dimensional data to obtain the health status perception information of each node.

[0052] In some embodiments, the aforementioned execution entity may perform health status perception processing on the health monitoring data of each node included in the aforementioned multi-dimensional data to obtain various health status perception information.

[0053] In some optional implementations of certain embodiments, the aforementioned execution entity may perform health status trace perception processing on the health monitoring data of each node included in the aforementioned multi-dimensional data through the following steps to obtain various health status trace perception information: The first step is to perform the following steps on the health monitoring data of each node in the above-mentioned node health monitoring data: The first sub-step involves performing the following steps on the terminal health data included in the node health monitoring data: Sub-step one: Based on the preset processor status determination information and the aforementioned terminal processor utilization information, the terminal processor load information is processed to determine its status, resulting in terminal processor status information. In practice, the executing entity can determine the preset normal information as terminal processor status information in response to the determination that the terminal processor utilization information and the aforementioned terminal processor load information satisfy the normal status information included in the preset processor status determination information. Then, in response to the determination that the terminal processor utilization information and the aforementioned terminal processor load information satisfy the warning status information included in the preset processor status determination information, the preset warning information is determined as terminal processor status information. Finally, in response to the determination that the terminal processor utilization information and the aforementioned terminal processor load information satisfy the abnormal status information included in the preset processor status determination information, the preset abnormal information is determined as terminal processor status information. The preset processor status determination information can be a pre-set classification standard for dividing processor operating states. The preset processor status determination information includes normal status information, warning status information, and abnormal status information. The normal status information indicates that the encrypted terminal is currently operating well. The warning status information indicates that the encrypted terminal is currently operating moderately and requires attention. The above abnormal status information indicates that the encrypted terminal is currently operating abnormally. The above preset normal information can be a label indicating that the encrypted terminal is currently operating well. The above preset warning information can be a label indicating that the encrypted terminal is currently operating moderately and requires attention. The above preset abnormal information can be a label indicating that the encrypted terminal is currently operating abnormally. The above terminal processor status information can be a conclusive label reflecting the specific operating status of the encrypted terminal's processor at the current moment. For example, the above preset normal information can be "normal". The above preset warning information can be "warning". The above preset abnormal information can be "abnormal". The above preset processor status judgment information can be: Normal state: Total CPU utilization is below 75%, and the average number of processes is consistently below (number of cores × 0.7). Warning state: Total CPU utilization is above 75% but below 90%, and the average number of processes is greater than (number of cores × 0.7) but less than (number of cores × 1.2). Abnormal state: CPU utilization exceeds 90%, and the average number of processes is greater than (number of cores × 1.2). As an example, the above terminal processor utilization information can be a CPU utilization of 60%. The above terminal processor load information can be an average number of processes of 2. The above number of cores can be 4. Therefore, if 60% < 75% and 2 < (4 × 0.7 = 2.8), the above terminal processor status information can be considered normal.

[0054] Sub-step two involves processing the remaining space information of the terminal disk based on preset disk status determination information, the aforementioned terminal disk monitoring status information, and the aforementioned terminal disk usage information to obtain terminal disk status information. It should be noted that the method used to process the remaining space information of the terminal disk based on preset disk status determination information, the aforementioned terminal disk monitoring status information, and the aforementioned terminal disk usage information to obtain terminal disk status information is the same as the method used to process the terminal processor load information based on preset processor status determination information and the aforementioned terminal processor usage information to obtain terminal processor status information. The preset disk status determination information can be a pre-defined classification standard for dividing disk status. The terminal disk status information can be a conclusive label reflecting the current status of the encrypted terminal disk. For example, the preset disk status determination information could be a normal state: usage rate ≤ 80% and remaining disk space > 30% of total capacity, current read / write latency < 20ms, SMART health status "good," and no bad sector reports. Warning Status: Usage >80% and ≤90%, remaining disk space between 15% and 30%, or current read / write latency fluctuating between 20ms and 100ms, or SMART warnings a slight increase in non-critical parameters (such as reallocation sector count). Abnormal Status: Usage >90%, remaining disk space <15%, or disk read / write latency consistently >100ms, or SMART reports a critical error (such as an unrepairable sector). The above terminal disk monitoring status information can be data collected from the terminal disk reflecting its performance and health status. As an example, the above terminal disk monitoring status information could be: current read / write latency 18ms, SMART health status "good," no bad sector reports. The above terminal disk usage information could be 75%. The above terminal disk remaining space information could be 140G. The above total capacity could be 400G. Therefore, the current read / write latency is 18ms < 20ms, usage is 75% ≤ 80%, and remaining disk space is 140G > (400G). (30% = 120G). Therefore, the above terminal disk status information can be considered normal.

[0055] Sub-step three involves processing the remaining memory capacity information of the terminal based on the preset memory status determination information and the aforementioned terminal memory usage information to obtain the terminal memory status information. It should be noted that the method used to process the remaining memory capacity information of the terminal based on the preset memory status determination information and the aforementioned terminal memory usage information to obtain the terminal memory status information is the same as the method used to process the processor load information of the terminal based on the preset processor status determination information and the aforementioned terminal processor usage information to obtain the terminal processor status information. The preset memory status determination information can be a pre-defined classification standard for dividing memory status. The terminal memory status information can be a conclusive label reflecting the current state of the encrypted terminal's memory. For example, the preset memory status determination information could be: Normal state: memory usage < 70%; Warning state: 70% ≤ memory usage < 90%; Abnormal state: memory usage ≥ 90%, and if the remaining memory capacity is < 500MB, the status is directly determined as "abnormal" regardless of the usage rate. As an example, the aforementioned terminal memory usage information could be: memory usage: 80%. The remaining memory capacity of the terminal can be 300MB. If the remaining memory capacity of the terminal is less than 500MB, then the memory status information of the terminal can be considered abnormal.

[0056] Sub-step four involves processing the terminal network link bandwidth information based on the preset link status determination information, the aforementioned terminal network link latency information, and the aforementioned terminal network link packet loss rate information to obtain terminal link status information. In practice, the executing entity can map the terminal network link bandwidth information to the corresponding status level by comparing the aforementioned terminal network link latency information, the aforementioned terminal network link packet loss rate information, the aforementioned terminal network link bandwidth information, and the aforementioned preset link status determination information with the threshold ranges in the aforementioned preset link status determination information, thereby obtaining terminal link status information. The aforementioned preset link status determination information can be a pre-defined classification standard for dividing network link states. The aforementioned terminal link status information can be a conclusive label reflecting the encrypted terminal network link state. For example, the aforementioned preset link status determination information can be: Normal state: network latency < 100ms and packet loss rate < 1% and bandwidth utilization < 80%. Warning state: 100ms ≤ network latency < 300ms and 1% ≤ packet loss rate < 5% and 80% ≤ bandwidth utilization < 95%. Abnormal state: network latency ≥ 300ms and packet loss rate ≥ 5% and bandwidth utilization ≥ 95%. As an example, the above terminal network link latency information could be: network latency: 200ms. The above terminal network link packet loss rate information could be: packet loss rate: 3%. The above terminal network link bandwidth information could be: bandwidth utilization: 90%. If 100ms ≤ network latency: 200ms < 300ms, and 1% ≤ packet loss rate: 3% < 5%, and 80% ≤ bandwidth utilization: 90% < 95%, then the above terminal link status information could be considered a warning.

[0057] Sub-step five: Based on the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, and terminal link status information, generate a terminal health score.

[0058] Sub-step six: Based on the preset health classification information, perform risk level mapping processing on the aforementioned terminal health score to obtain terminal risk level information. In practice, the executing entity can map the aforementioned terminal health score to the corresponding status level by comparing it with the threshold range in the preset health classification information to obtain terminal risk level information. The preset health classification information can be a pre-defined classification standard used to divide the health status of encrypted terminals. The terminal risk level information can be a conclusive label reflecting the health status of encrypted terminals. For example, the preset health classification information can be: Healthy state: Terminal health score ≥ 85 points; Sub-healthy state: 75 points ≤ Terminal health score < 85 points; Abnormal state: Overall health score < 75 points.

[0059] Sub-step seven: Determine the terminal health score and the terminal risk level information as the terminal health status information.

[0060] The second sub-step involves performing the following steps on each intelligence board health data in the intelligence board health data set included in the node health monitoring data: Sub-step one: Based on the above intelligence board health data, generate intelligence board health status information.

[0061] The third sub-step involves determining the aforementioned terminal health status information and the obtained health status information of each intelligence board as health status trace perception information.

[0062] In some optional implementations of certain embodiments, the execution entity may generate a terminal health score based on the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information through the following steps: The first step involves determining that the terminal processor status information, terminal disk status information, terminal memory status information, and terminal link status information meet preset normal status information, and then using a first preset score as the terminal processor status score, terminal disk status score, terminal memory status score, and terminal link status score, respectively. The preset normal status information can be any one of the terminal processor status information, terminal disk status information, terminal memory status information, or terminal link status information representing a normal state (i.e., the terminal processor status information is normal, or the terminal disk status information is normal, or the terminal memory status information is normal, or the terminal link status information is normal). The first preset score can be 100 points.

[0063] The second step involves determining that the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, and terminal link status information meet preset warning status information, and then using a second preset score as the terminal processor status score, terminal disk status score, terminal memory status score, and terminal link status score, respectively. The preset warning status information can be any one of the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, or terminal link status information representing a warning status (i.e., the terminal processor status information, terminal disk status information, terminal memory status information, or terminal link status information are all warning statuses). The second preset score can be 60 points.

[0064] Third, in response to determining that the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, and terminal link status information satisfy preset abnormal status information, a third preset score is used as the terminal processor status score, terminal disk status score, terminal memory status score, and terminal link status score, respectively. The preset abnormal status information can be any one of the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, or terminal link status information, where the state is abnormal (i.e., the terminal link status information, terminal processor status information, terminal disk status information, or terminal memory status information are abnormal). The third preset score can be 0.

[0065] The fourth step involves generating a terminal health score based on preset terminal processor weights, preset terminal disk weights, preset terminal memory weights, preset terminal link weights, and the aforementioned terminal processor status scores, disk status scores, memory status scores, and link status scores. In practice, the executing entity first multiplies the preset terminal processor weights by the terminal processor status scores to obtain a first score. Then, it multiplies the preset terminal disk weights by the disk status scores to obtain a second score. Next, it multiplies the preset terminal memory weights by the memory status scores to obtain a third score. Finally, it multiplies the preset terminal link weights by the link status scores to obtain a fourth score. The sum of the first, second, third, and fourth scores is then determined as the terminal health score. The preset terminal processor weights can be weighted coefficients assigned to the CPU status indicators when calculating the overall health score, reflecting the importance of CPU health to the overall terminal health. Similarly, the preset terminal disk weights can be weighted coefficients assigned to the disk status indicators when calculating the overall health score, reflecting the importance of storage health to the overall terminal health. The aforementioned preset terminal memory weight can be a weighting coefficient assigned to the memory status indicator when calculating the comprehensive health score, reflecting the importance of memory health to the overall health of the terminal. The aforementioned preset terminal link weight can be a weighting coefficient assigned to the network link status indicator when calculating the comprehensive health score, reflecting the importance of network connectivity and quality to the overall health of the terminal. The aforementioned terminal health score can be a single numerical value used to quantify the overall health status of the terminal, calculated by weighted aggregation of the status scores of various core components (CPU, memory, disk, link). For example, the aforementioned preset terminal disk weight can be 30%. The aforementioned preset terminal memory weight can be 30%. The aforementioned preset terminal disk weight can be 25%. The aforementioned preset terminal link weight can be 15%.

[0066] In addressing the technical challenges of the aforementioned background technologies, and considering the application scenario of attack prevention and control for an ETC (Electronic Toll Collection) gantry system, attacks on ETC gantries (such as DDoS attacks and vulnerability exploitation attacks) typically spread extremely rapidly. If the response time is slow, attackers can use this time to laterally penetrate from one gantry to multiple gantries in adjacent road sections, and even control the core settlement server. Furthermore, the generation of health status information for information boards often presents the following technical challenges: By fusing multi-source security posture information for node security control, the ETC gantry system needs to collect a large amount of information board health data simultaneously to generate health status information. Storing and analyzing this large amount of health data can lead to system lag and slow response times due to insufficient disk memory, resulting in prolonged generation of health status information and a long overall time for control command generation. Therefore, this application scenario requires the following characteristics: reducing the overall time for control command generation and improving response speed. To address these technical challenges, we have decided to adopt the following solution: In some optional implementations of certain embodiments, the aforementioned execution entity may generate intelligence board health status information based on the aforementioned intelligence board health data through the following steps: The first step involves processing the processor load information of the information board based on preset processor status determination information and the aforementioned information board processor utilization information to obtain information board processor status information. This information board processor status information serves as a conclusive label reflecting the current operating status of the variable message sign's processor. It should be noted that the method used to process the processor load information of the information board based on preset processor status determination information and the aforementioned information board processor utilization information to obtain information board processor status information is the same as the method used to process the terminal processor load information of the terminal based on preset processor status determination information and the aforementioned terminal processor utilization information to obtain terminal processor status information.

[0067] The second step involves processing the remaining disk space information of the intelligence board based on preset disk status determination information, the aforementioned intelligence board disk monitoring status information, and the aforementioned intelligence board disk usage rate information to obtain intelligence board disk status information. This intelligence board disk status information can serve as a conclusive label reflecting the current status of the variable intelligence board disk. It should be noted that the method used to process the remaining disk space information of the intelligence board based on preset disk status determination information, the aforementioned intelligence board disk monitoring status information, and the aforementioned intelligence board disk usage rate information to obtain intelligence board disk status information is the same as the method used to process the remaining disk space information of the terminal disk based on preset disk status determination information, the aforementioned terminal disk monitoring status information, and the aforementioned terminal disk usage rate information to obtain terminal disk status information.

[0068] The third step involves performing space cleanup on the variable information board corresponding to the aforementioned information board disk status information, in response to the determination that the aforementioned information board disk status information does not meet the preset disk health status information. In practice, the executing entity may use a disk cleanup tool to perform space cleanup on the variable information board corresponding to the aforementioned information board disk status information, in response to the determination that the aforementioned information board disk status information does not meet the preset disk health status information. The preset disk health status information can be that the disk status represented by the aforementioned information board disk status information is normal.

[0069] The fourth step involves processing the remaining memory capacity information of the intelligence board based on the preset memory status determination information and the aforementioned intelligence board memory usage information to obtain the intelligence board memory status information. This intelligence board memory status information can serve as a conclusive label reflecting the current state of the variable intelligence board memory. It should be noted that the method used to process the remaining memory capacity information of the intelligence board based on the preset memory status determination information and the aforementioned intelligence board memory usage information to obtain the intelligence board memory status information is the same as the method used to process the remaining terminal memory capacity information based on the preset memory status determination information and the aforementioned terminal memory usage information to obtain the terminal memory status information.

[0070] Fifth, based on the preset link status determination information, the aforementioned information board network link delay information, and the aforementioned information board network link packet loss rate information, link status determination processing is performed on the aforementioned information board network link bandwidth information to obtain information board link status information. The aforementioned information board link status information can serve as a conclusive label reflecting the variable information board network link status. It should be noted that the method used to perform link status determination processing on the aforementioned information board network link bandwidth information based on the preset link status determination information, the aforementioned information board network link delay information, and the aforementioned information board network link packet loss rate information to obtain information board link status information is the same as the method used to perform link status determination processing on the aforementioned terminal network link bandwidth information based on the preset link status determination information, the aforementioned terminal network link delay information, and the aforementioned terminal network link packet loss rate information to obtain terminal link status information.

[0071] Step 6: Based on the aforementioned information board processor status information, information board disk status information, information board memory status information, and information board link status information, generate an information board health score. This information board health score can be a single numerical value used to quantify the overall health status of the variable information board. It should be noted that the method used to generate the information board health score based on the aforementioned information board processor status information, information board disk status information, information board memory status information, and information board link status information is the same as the method used to generate the terminal health score based on the aforementioned terminal processor status information, terminal disk status information, terminal memory status information, and terminal link status information.

[0072] Step 7: Based on the preset health classification information, perform risk level mapping processing on the health scores of the aforementioned information boards to obtain information board risk level information. This information board risk level information can serve as a conclusive label reflecting the health status of the variable information boards. It should be noted that the method used to perform risk level mapping processing on the health scores of the aforementioned information boards based on the preset health classification information to obtain information board risk level information is the same as the method used to perform risk level mapping processing on the health scores of the aforementioned terminals based on the preset health classification information to obtain terminal risk level information.

[0073] Step 8: Determine the health score and risk level information of the aforementioned intelligence board as the health status information of the intelligence board. In practice, the implementing entity may determine the health score and risk level information of the aforementioned intelligence board as the health status information of the intelligence board.

[0074] The above-described technical solution and its related content, as an inventive point of this disclosure, solve the technical problem of "slow response speed and long total time for generating control commands." Factors leading to slow response speed and long total time for generating control commands in node control methods based on security situation information are often as follows: By fusing multi-source security situation information for node security control, the ETC (Electronic Toll Collection) gantry system needs to collect a large amount of information board health data simultaneously to generate information board health status information. Storing and analyzing this large amount of information board health data can cause system lag and slow response speed due to insufficient disk memory, resulting in a long time for generating information board health status information and a long total time for generating control commands. Solving these factors can reduce the total time for generating control commands and improve response speed. To achieve this effect, firstly, based on preset processor status determination information and the aforementioned information board processor utilization information, processor status determination processing is performed on the aforementioned information board processor load information to obtain information board processor status information. Thus, information board processor status information used to generate information board health scores can be obtained. Then, based on the preset disk status determination information, the aforementioned intelligence board disk monitoring status information, and the aforementioned intelligence board disk utilization rate information, disk status determination processing is performed on the remaining disk space information of the aforementioned intelligence board to obtain intelligence board disk status information. This provides intelligence board disk status information used to generate an intelligence board health score. Next, in response to determining that the aforementioned intelligence board disk status information does not meet the preset disk health status information, a space cleanup operation is performed on the variable intelligence board corresponding to the aforementioned intelligence board disk status information. This allows for disk cleanup and space release when the disk is determined to be unhealthy (insufficient space), avoiding increased response latency due to storage I / O waiting. Then, based on the preset memory status determination information and the aforementioned intelligence board memory utilization rate information, memory status determination processing is performed on the remaining memory capacity information of the aforementioned intelligence board to obtain intelligence board memory status information. This provides intelligence board memory status information used to generate an intelligence board health score. Afterwards, based on the preset link status determination information, the aforementioned intelligence board network link latency information, and the aforementioned intelligence board network link packet loss rate information, link status determination processing is performed on the aforementioned intelligence board network link bandwidth information to obtain intelligence board link status information. This allows us to obtain the information board link status information for dynamically assessing the quality of network communication channels. Next, based on the aforementioned information board processor status information, disk status information, memory status information, and link status information, an information board health score is generated. This aggregates the dispersed, multi-dimensional resource status into a unified, measurable, comprehensive health indicator. Subsequently, based on preset health classification information, the aforementioned information board health score undergoes risk level mapping processing to obtain information board risk level information.Therefore, the health status information of the intelligence board can be determined based on the risk level information. Finally, the aforementioned intelligence board health score and risk level information are used to define the intelligence board health status information. This yields intelligence board health status information that characterizes the variable health status of the intelligence board. Furthermore, because real-time health monitoring of four key resources—processor, disk, memory, and link—is implemented, disk cleanup is performed when disk space is insufficient, thus preventing system lag caused by insufficient disk and memory. Consequently, the total time spent generating control commands can be reduced, improving response speed.

[0075] Step 104: Perform environmental perception and monitoring processing on the various environmental data included in the multi-dimensional data to obtain various environmental perception and monitoring information.

[0076] In some embodiments, the aforementioned execution entity may perform environmental perception and monitoring processing on the various environmental data included in the aforementioned multi-dimensional data to obtain various environmental perception and monitoring information.

[0077] In some optional implementations of certain embodiments, the aforementioned execution entity may perform environmental perception and monitoring processing on the various environmental data included in the aforementioned multi-dimensional data through the following steps to obtain various environmental perception and monitoring information: The first step is to perform the following steps for each of the environmental data sets mentioned above: The first sub-step involves performing the following steps on the terminal environment data included in the aforementioned environmental data: In the first sub-step, in response to determining that the terminal temperature information included in the aforementioned terminal environment data is greater than a preset first temperature threshold, a first temperature warning is generated as terminal environment perception information. In practice, firstly, the executing entity may, in response to determining that the terminal temperature information included in the aforementioned terminal environment data is greater than the preset first temperature threshold, determine the difference between the terminal temperature information and the preset first temperature threshold as the temperature difference. Then, in response to determining that the temperature is less than or equal to 5°C, the temperature risk level is set to the "Caution" level. Next, in response to determining that the temperature difference is greater than 5°C and less than or equal to 15°C, the temperature risk level is set to the "Warning" level. Then, in response to determining that the temperature difference is greater than 15°C, the temperature risk level is set to the "Severe" level. Afterwards, a handling suggestion corresponding to the aforementioned temperature risk level is determined from the contingency plan database. Finally, the aforementioned terminal temperature information and the aforementioned handling suggestion are determined as the first temperature warning information. The aforementioned preset first temperature threshold can be an upper limit value used to determine whether the temperature of the encrypted terminal device is within the safe operating range. The aforementioned first temperature warning information can be a structured alarm record representing that the temperature of the encrypted terminal exceeds the limit. For example, the preset first temperature threshold can be 35°C.

[0078] Sub-step two: In response to determining that the terminal temperature information included in the aforementioned terminal environment data is less than a preset first temperature threshold, a preset normal temperature perception identifier and the aforementioned terminal temperature information are identified as terminal environment perception information. The preset normal temperature perception identifier can be a status flag, code, or descriptive text used to indicate that the encrypted terminal temperature is within a safe range. For example, the preset normal temperature perception identifier can be "temperature normal".

[0079] Sub-step three: In response to determining that the terminal humidity information included in the aforementioned terminal environmental data is greater than a preset first humidity threshold, a first humidity warning is generated as terminal environmental perception information. In practice, firstly, the executing entity may, in response to determining that the terminal humidity information included in the aforementioned terminal environmental data is greater than the preset first humidity threshold, determine the difference between the aforementioned terminal humidity information and the aforementioned preset first humidity threshold as the humidity difference. Then, in response to determining that the aforementioned humidity difference is less than or equal to 5%RH, the humidity risk level is set to the "Caution" level. Next, in response to determining that the aforementioned humidity difference is greater than 5% and less than or equal to 15%RH, the humidity risk level is set to the "Warning" level. Then, in response to determining that the aforementioned humidity difference is greater than 15%RH, the humidity risk level is set to the "Severe" level. Afterwards, a handling suggestion corresponding to the aforementioned humidity risk level is determined from the contingency plan database. Finally, the aforementioned terminal humidity information and the aforementioned handling suggestion are determined as the first humidity warning information. The aforementioned preset first humidity threshold can be a relative humidity percentage critical value used to determine that excessively high ambient humidity may cause condensation, corrosion, or malfunction risks in encrypted terminal equipment. The aforementioned first humidity warning information can be a structured alarm record indicating that the humidity of the encrypted terminal exceeds the standard. For example, the aforementioned preset first humidity threshold can be 70%RH. The aforementioned contingency plan library can be a structured, hierarchical database that predefines different operating procedures corresponding to different severity levels. The aforementioned handling suggestions can be specific actions that need to be taken for a specific humidity risk level. For example, the above contingency plan library could be: {(Humidity Risk Level: Caution, Handling Recommendation: Record the anomaly in the monitoring log, continuously observe the humidity trend for 15 minutes, and remotely check whether the humidity setpoint and operating status of the data center air conditioning system (CRAC) are normal.), (Humidity Risk Level: Warning, Handling Recommendation: Confirm the reading is correct, issue a yellow warning sign, and notify the on-duty engineer for remote diagnosis. The engineer remotely restarts or adjusts the dehumidification / humidification module of the air conditioner.), (Humidity Risk Level: Severe, Handling Recommendation: Trigger an alarm and send an emergency alarm via SMS to the operations supervisor and safety manager. If the humidity is too high, immediately start the dehumidifier (if deployed) or shut down the fresh air system in non-core areas. If the humidity is too low, immediately start the backup humidifier and check for leaks that could cause humidification failure. Dispatch an engineer to the site within 1 hour for handling.) Sub-step four: In response to determining that the terminal humidity information included in the aforementioned terminal environment data is less than a preset first humidity threshold, a preset humidity perception normal identifier and the aforementioned terminal humidity information are determined as terminal environment perception information. The preset humidity perception normal identifier can be a status flag, code, or descriptive text used to indicate that the humidity of the encrypted terminal is within a secure range. For example, the preset humidity perception normal identifier can be "humidity normal".

[0080] Sub-step five: The above-mentioned terminal environment perception information is identified as terminal environment perception monitoring information.

[0081] The second sub-step involves performing the following steps for each piece of information board environmental data in the information board environmental data set included above: In sub-step one, in response to determining that the temperature information of the information board included in the aforementioned information board environmental data is greater than a preset second temperature threshold, a second temperature warning message is generated as information board environmental perception information. The preset second temperature threshold can be the "maximum operating temperature" or "upper limit of recommended operating temperature range" specified in the technical specifications of the equipment manufacturer for the variable message sign corresponding to the aforementioned information board environmental data. The second temperature warning message can be a structured alarm record indicating that the variable message sign temperature exceeds the limit. It should be noted that the method used to generate the second temperature warning message as information board environmental perception information in response to determining that the temperature information of the information board included in the aforementioned information board environmental data is greater than the preset second temperature threshold is the same as the method used to generate the first temperature warning message as terminal environmental perception information in response to determining that the terminal temperature information included in the aforementioned terminal environmental data is greater than a preset first temperature threshold.

[0082] Sub-step two: In response to determining that the information board temperature information included in the above information board environmental data is less than a preset second temperature threshold, the preset temperature perception normal indicator and the above information board temperature information are determined as information board environmental perception information.

[0083] Step three: In response to determining that the humidity information of the information board included in the aforementioned environmental data is greater than a preset second humidity threshold, a second humidity warning is generated as environmental perception information for the information board. The preset second humidity threshold can be a relative humidity percentage threshold used to determine that excessively high ambient humidity may cause condensation, corrosion, or malfunction of the variable message sign (VMS) equipment. The second humidity warning can be a structured alarm record representing excessive humidity on the VMS. In practice, firstly, the executing entity can, in response to determining that the humidity information of the information board included in the aforementioned environmental data is greater than the preset second humidity threshold, determine the difference between the humidity information of the information board and the preset second humidity threshold as the humidity difference. Then, in response to determining that the humidity difference is less than or equal to 5%RH, the humidity risk level is set to "Caution". Next, in response to determining that the humidity difference is greater than 5% and less than or equal to 15%RH, the humidity risk level is set to "Warning". Then, in response to determining that the humidity difference is greater than 15%RH, the humidity risk level is set to "Severe". Finally, a handling recommendation corresponding to the aforementioned humidity risk level is determined from the contingency plan database. Finally, the humidity information on the aforementioned information board and the aforementioned handling recommendations were identified as the first humidity warning information.

[0084] Sub-step four: In response to determining that the humidity information of the information board included in the above-mentioned information board environmental data is less than a preset second humidity threshold, the preset humidity perception normal indicator and the above-mentioned information board humidity information are determined as information board environmental perception information.

[0085] Sub-step five: The environmental perception information of the above-mentioned information board is identified as the environmental perception monitoring information of the information board.

[0086] The second step is to identify the aforementioned terminal environmental perception monitoring information and the environmental perception monitoring information obtained from each intelligence board as environmental perception monitoring information.

[0087] Step 105: Based on the various safety perception information and various environmental perception and monitoring information, perform comprehensive risk assessment processing on the various health status perception information to obtain various comprehensive risk assessment information.

[0088] In some embodiments, the aforementioned executing entity may perform comprehensive risk assessment processing on the aforementioned health status perception information based on the aforementioned security perception information and the aforementioned environmental perception and monitoring information to obtain various comprehensive risk assessment information.

[0089] In some optional implementations of certain embodiments, the aforementioned executing entity may perform a comprehensive risk assessment on the aforementioned health status perception information based on the aforementioned security perception information and the aforementioned environmental perception and monitoring information through the following steps to obtain the aforementioned comprehensive risk assessment information: The first step is to perform the following steps for each of the above-mentioned health status sensing information: The first sub-step is to determine the security perception information corresponding to the health status perception information as the target security perception information.

[0090] The second sub-step involves identifying the environmental sensing and monitoring information corresponding to the health status trace sensing information as the target environmental sensing and monitoring information.

[0091] The second step involves generating comprehensive risk assessment information based on preset security risk weights, preset environmental risk weights, preset health risk weights, the aforementioned target security perception information, the aforementioned target environmental perception monitoring information, and health status perception information. In practice, firstly, the executing entity can determine the first risk score by multiplying the preset security risk weights by the aforementioned target security perception information. Then, the second risk score is determined by multiplying the preset environmental risk weights by the aforementioned target environmental perception monitoring information. Next, the third risk score is determined by multiplying the preset health risk weights by the aforementioned health status perception information. Finally, the sum of the first, second, and third risk scores is determined as the comprehensive risk assessment information. The preset security risk weights represent the importance of the target security perception information in generating the comprehensive risk assessment information. The preset environmental risk weights represent the importance of the target environmental perception monitoring information in generating the comprehensive risk assessment information. The preset health risk weights represent the importance of the health status perception information in generating the comprehensive risk assessment information. The comprehensive risk assessment information represents the security risk level of the data providing node.

[0092] Step 106: Obtain the location information and status information corresponding to each data providing node.

[0093] In some embodiments, the execution entity may obtain the location information and status information corresponding to the data providing nodes that are stored in advance in the storage device.

[0094] In some optional implementations of certain embodiments, the executing entity can obtain pre-stored location information and status information corresponding to the various data providing nodes via wired or wireless connection. Each location information corresponds to one of the data providing nodes. Each status information corresponds to one of the data providing nodes. Each location information includes encrypted terminal location information and information on various intelligence boards. The encrypted terminal location information corresponds to an encrypted terminal within one of the data providing nodes. Each intelligence board location information corresponds to a variable intelligence board within a variable intelligence board group included in one of the data providing nodes. The encrypted terminal location information may include an encrypted terminal identifier. The encrypted terminal location information may indicate the geographical location of the encrypted terminal. Each intelligence board location information may include a variable intelligence board identifier. Each intelligence board location information may indicate the geographical location of the variable intelligence board. Each of the aforementioned status information entries includes encrypted terminal status information and information about each intelligence board. The encrypted terminal status information corresponds to an encrypted terminal within one of the data providing nodes. Each intelligence board status information corresponds to a variable intelligence board within a variable intelligence board group included in one of the data providing nodes. The encrypted terminal status information can indicate whether the encrypted terminal is online or offline. Each intelligence board status information can indicate whether a variable intelligence board is online or offline. Each of the aforementioned status information entries can indicate whether one of the data providing nodes is online or offline.

[0095] Step 107: Based on the comprehensive risk assessment information, health status perception information, safety perception information, environmental perception monitoring information, and status information, the location information is dynamically correlated to obtain comprehensive safety situation information and safety ranking information.

[0096] In some embodiments, the aforementioned executing entity can dynamically correlate the aforementioned location information based on the aforementioned comprehensive risk assessment information, the aforementioned health status perception information, the aforementioned security perception information, the aforementioned environmental perception and monitoring information, and the aforementioned status information to obtain various comprehensive security situation information and security ranking information. Each status information corresponds to one of the aforementioned comprehensive risk assessment information, and each location information corresponds to one of the aforementioned comprehensive risk assessment information.

[0097] In addressing the aforementioned technical challenges by employing technical solutions, the application scenario involves the collaborative control of data-providing nodes (encrypted terminals and variable message signs) at critical transportation infrastructure sites (such as highways, tunnels, and railways). On-site security inspectors or emergency responders need to review the execution of commands to ensure accurate control actions and expected equipment responses. However, obtaining comprehensive security situation information and security ranking information often presents the following technical problems: traditional methods for generating comprehensive security situation information lack integration with location information and real-time equipment status. On-site security inspectors or emergency responders cannot quickly locate target equipment based on location information or check whether control commands have been executed to verify the execution of commands and ensure accurate control actions and expected equipment responses. Furthermore, the large number and wide distribution of encrypted terminals and variable message signs across the extensive road network, coupled with the lack of correlation between location and status information, leads on-site security inspectors or emergency responders to blindly review all equipment (including unattacked equipment that has not executed control commands), resulting in slow and inefficient review processes during the control of data-providing nodes (encrypted terminals and variable message signs). To address the following requirements for this application scenario: improving the speed and efficiency of data delivery node control review, and to resolve the aforementioned technical challenges, we have decided to adopt the following solution: In some optional implementations of certain embodiments, the aforementioned executing entity may perform dynamic correlation processing on the aforementioned location information based on the aforementioned comprehensive risk assessment information, the aforementioned health status perception information, the aforementioned security perception information, the aforementioned environmental perception and monitoring information, and the aforementioned status information, to obtain the aforementioned comprehensive security situation information and security ranking information: The first step is to acquire the virtual layout video streams corresponding to the aforementioned data providing nodes. In practice, the executing entity can acquire these virtual layout video streams via wired or wireless connections. Each virtual layout video stream corresponds to one of the aforementioned data providing nodes. Each virtual layout video stream includes an encrypted terminal video stream and various information board video streams. The encrypted terminal video stream corresponds to an encrypted terminal within one of the aforementioned data providing nodes. Each information board video stream corresponds to a variable information board within a group of variable information boards included in one of the aforementioned data providing nodes. Each virtual layout video stream can be a video captured in real-time by multiple cameras deployed in the actual geographic space, displaying real-time images of multiple key monitoring points (such as the actual physical installation locations of encrypted terminals and variable information boards). The aforementioned encrypted terminal video stream can be surveillance video captured by cameras in the physical space where the encrypted terminal device is located (such as a computer room, secure cabinet, or workstation), truthfully recording the terminal's physical appearance, physical interface status, surrounding personnel's operational behavior, and the on-site physical security environment (such as access control or spatial isolation). Each of the aforementioned information board video streams can be surveillance video captured by cameras in the physical space where the variable message sign is located, truthfully recording whether the information board's screen display content is accurate and valid, the device's physical status (such as screen damage or abnormal brightness), the on-site environment (such as whether it is obstructed or affected by weather), and the surrounding security situation.

[0098] The second step is to obtain the virtual location information corresponding to each data providing node in each of the aforementioned virtual layout video streams. Each virtual layout video stream corresponds to one virtual location information in the aforementioned virtual location information, and each virtual location information includes encrypted terminal virtual location information and variable message sign (VMS) virtual location information. The encrypted terminal virtual location information corresponds to an encrypted terminal included in one of the data providing nodes. Each VMS virtual location information corresponds to a VMS in a VMS group included in one of the data providing nodes. The encrypted terminal virtual location information includes an encrypted terminal identifier. Each VMS virtual location information includes a VMS identifier. In practice, firstly, the executing entity can perform the following steps on each of the aforementioned virtual layout video streams: then, obtain the encrypted terminal virtual location information of the encrypted terminal video streams included in the aforementioned virtual layout video streams, which is pre-stored in the storage device. Next, the virtual location information of each information board in the aforementioned virtual layout video stream, which is pre-stored in the storage device, is obtained. Each information board virtual location information corresponds to one information board video stream in the aforementioned information board video streams. Then, the aforementioned encrypted terminal virtual location information and the aforementioned information board virtual location information are determined as virtual location information. The encrypted terminal virtual location information can be coordinate information and an encrypted terminal identifier used to locate the encrypted terminal on an electronic map. Each information board virtual location information can be coordinate information and a variable information board identifier used to locate a variable information board on an electronic map. The encrypted terminal identifier can be a string used to uniquely identify the encrypted terminal. Each variable information board identifier can be a string used to uniquely identify a variable information board. The storage device can be a hard disk drive, solid-state drive, etc., connected to the aforementioned execution entity.

[0099] The third step involves generating a spatial mapping table based on the aforementioned virtual location information and location information. This table includes encrypted terminal identifiers and variable message sign (VMS) identifier groups. Each encrypted terminal identifier corresponds to an encrypted terminal within one of the data providing nodes. Similarly, each VMS identifier group corresponds to a VMS group within one of the data providing nodes. In practice, firstly, for each virtual location information, the executing entity can associate the encrypted terminal location information corresponding to the encrypted terminal identifier within the encrypted terminal virtual location information, and associate the encrypted terminal location information corresponding to the VMS identifier within one of the VMS virtual location information, thus obtaining the spatial mapping table. This spatial mapping table represents the mapping relationship between virtual location information and location information.

[0100] Fourth, based on the above spatial mapping table, the above-mentioned health status perception information, the above-mentioned safety perception information, the above-mentioned environmental perception and monitoring information, the above-mentioned location information, and the above-mentioned status information, perform the following steps for each of the above-mentioned comprehensive risk assessment information: The first sub-step involves identifying the health status perception information corresponding to the aforementioned comprehensive risk assessment information as the target health status perception information. In practice, the implementing entity can identify the health status perception information corresponding to the aforementioned comprehensive risk assessment information as the target health status perception information.

[0101] The second sub-step involves identifying the security perception information corresponding to the aforementioned comprehensive risk assessment information as the target security perception information.

[0102] The third sub-step involves identifying the environmental perception and monitoring information corresponding to the aforementioned comprehensive risk assessment information as the target environmental perception and monitoring information.

[0103] The fourth sub-step involves determining the location information corresponding to the aforementioned comprehensive risk assessment information as the target location information.

[0104] The fifth sub-step involves determining the status information corresponding to the aforementioned comprehensive risk assessment information as the target status information.

[0105] The sixth sub-step involves defining the aforementioned target health status perception information, target security perception information, target environment perception and monitoring information, target location information, and target status information as comprehensive perception information. In practice, firstly, the executing entity can define the terminal health status information, target security perception information, terminal environment perception and monitoring information (including the terminal environment perception and monitoring information), encrypted terminal location information (including the encrypted terminal location information), and encrypted terminal status information (including the encrypted terminal status information) included in the target health status perception information as encrypted terminal comprehensive perception information. Then, one intelligence board health status information, one intelligence board environment perception and monitoring information (including the intelligence board environment perception and monitoring information), one intelligence board location information (including the intelligence board location information), and one intelligence board status information (including the intelligence board status information) included in the target health status perception information are defined as intelligence board comprehensive perception information. Finally, the defined encrypted terminal comprehensive perception information and the comprehensive perception information of each intelligence board are defined as comprehensive perception information. The aforementioned integrated sensing information includes integrated sensing information from encrypted terminals and integrated sensing information from various variable message signs.

[0106] Fifth, based on the aforementioned spatial mapping relationship table and the determined integrated perception information, spatial mapping processing is performed on each of the aforementioned virtual layout video streams to obtain each integrated perception information video stream. Each of the determined integrated perception information corresponds to one of the aforementioned virtual layout video streams. In practice, firstly, for each of the aforementioned virtual layout video streams, the executing entity can determine the integrated perception information corresponding to the aforementioned virtual layout video stream as the target integrated perception information. Next, for the encrypted terminal integrated perception information included in the target integrated perception information, according to the mapping relationship between virtual location information and location information represented by the aforementioned spatial mapping relationship table, FFmpeg is used to map the encrypted terminal integrated perception information onto the encrypted terminal video stream corresponding to the encrypted terminal integrated perception information, obtaining the encrypted terminal perception video stream. Then, for each piece of information board comprehensive perception information included in the aforementioned target comprehensive perception information, based on the mapping relationship between virtual location information and location information represented by the aforementioned spatial mapping relationship table, FFmpeg is used to map the aforementioned information board comprehensive perception information onto the corresponding information board video stream, resulting in an information board perception video stream. Finally, the aforementioned encrypted terminal perception video stream and the obtained information board perception video streams are determined as the comprehensive perception information video stream. The aforementioned encrypted terminal perception video stream can be the encrypted terminal video stream after adding encrypted terminal comprehensive perception information. The aforementioned information board perception video stream can be the information board video stream after adding information board comprehensive perception information.

[0107] The sixth step involves inputting the determined integrated perception information into a pre-trained integrated security situation control information generation model to obtain the integrated security situation control information. In practice, firstly, for each of the determined integrated perception information, the aforementioned executing entity can input the encrypted terminal integrated perception information included in the integrated perception information into the pre-trained integrated security situation control information generation model to obtain encrypted terminal control information. Then, the integrated perception information of each intelligence board included in the integrated perception information is input into the pre-trained integrated security situation control information generation model to obtain intelligence board control information. Finally, the encrypted terminal control information and the intelligence board control information are determined as the integrated security situation control information. Each intelligence board control information corresponds to one intelligence board integrated perception information among the intelligence board integrated perception information. Each intelligence board control information corresponds to one variable intelligence board in a variable intelligence board group included in one of the data providing nodes. Each integrated security situation control information can be an instruction for controlling the data providing node. The aforementioned encrypted terminal control information can be instructions for controlling the encrypted terminal. Each of the aforementioned intelligence board control information can be an instruction for controlling a variable intelligence board. The aforementioned pre-trained integrated security situation control information generation model can be a neural network model that takes various integrated perception information sets as input data and various integrated security situation control information sets as output data. For example, the aforementioned neural network model can be Meta Llama. As an example, at least one sample integrated perception information set and at least one sample integrated security situation control information set can be obtained first. Then, each sample integrated perception information set in the at least one sample integrated perception information set is used as input, and each sample integrated security situation control information set in the at least one sample integrated security situation control information set is used as the desired output to train the integrated security situation control information generation model.

[0108] Step 7: For each piece of integrated security situation control information obtained, perform the following steps: The first sub-step involves determining the integrated perception information video stream corresponding to the aforementioned integrated security situation control information and the aforementioned integrated security situation control information as integrated security situation information. In practice, firstly, for the encrypted terminal control information included in the aforementioned integrated security situation control information, the executing entity can determine the encrypted terminal control information and the encrypted terminal perception video stream in the integrated perception information video stream corresponding to the aforementioned encrypted terminal control information as terminal integrated security situation information. Next, for each intelligence board control information included in the aforementioned integrated security situation control information, the intelligence board control information and the intelligence board perception video stream in the integrated perception information video stream corresponding to the aforementioned intelligence board control information can be determined as intelligence board integrated security situation information. Finally, the aforementioned terminal integrated security situation information and the determined integrated security situation information of each intelligence board are determined as integrated security situation information.

[0109] The second sub-step involves sorting the terminal health scores within the various terminal health status information from the aforementioned health status trace sensing information to obtain a terminal health information sequence. In practice, the executing entity can use a quicksort algorithm to sort the terminal health scores within the various terminal health status information from the aforementioned health status trace sensing information to obtain a terminal health information sequence. This terminal health information sequence can be a sequence obtained by arranging the terminal health scores in ascending order.

[0110] The third sub-step involves sorting the health scores of each intelligence board within the aforementioned health status information from each intelligence board's health status information, resulting in a sequence of intelligence board health information. In practice, the executing entity can use a quicksort algorithm to sort the health scores of each intelligence board within the aforementioned health status information from each intelligence board's health status information, obtaining a sequence of intelligence board health information. This sequence can be obtained by arranging the health scores of each intelligence board in ascending order.

[0111] Fourth sub-step: Determine the above terminal health information sequence and the above information board health information sequence as the security ranking information.

[0112] The above-mentioned technical solution and its related content, combined with step 108, serve as an inventive point in the embodiment of this disclosure, solving the technical problem of "slow and inefficient review speed during the control process of data providing nodes (encrypted terminals and variable message signs)". Factors leading to slow and inefficient review speed during the control process of data providing nodes (encrypted terminals and variable message signs) are often as follows: Traditional methods for generating comprehensive security situation information do not incorporate location information and lack correlation with the real-time status of devices. On-site security inspectors or emergency response personnel cannot quickly locate target devices based on location information or check whether the devices have executed corresponding operations according to control commands. This hinders the verification of command execution effectiveness to ensure accurate control actions and that device responses meet expectations. Because encrypted terminals and variable message signs are distributed across a vast road network and are numerous, the lack of correlation between location and status information leads on-site security inspectors or emergency response personnel to blindly review all devices (including those not attacked and not executing control commands), resulting in slow and inefficient review speed during the control process of data providing nodes (encrypted terminals and variable message signs). Solving these factors can improve the review speed and efficiency of data providing node control. To achieve this effect, firstly, the video streams of each virtual layout corresponding to the aforementioned data-providing nodes are acquired. Then, the virtual location information corresponding to the aforementioned data-providing nodes in each virtual layout video stream is acquired. Next, a spatial mapping table is generated based on the aforementioned virtual location information and the aforementioned location information. This allows for matching and calibrating the actual physical location of a node with its corresponding node's location in the video, enabling the differentiation of multiple similar devices and ensuring that each physical device has a unique and accurate corresponding point in the video stream. This helps on-site safety inspection or emergency response personnel quickly locate devices, resolving the command mismatch problem caused by spatial misalignment. Then, based on the aforementioned spatial mapping table, the aforementioned health status perception information, the aforementioned safety perception information, the aforementioned environmental perception monitoring information, the aforementioned location information, and the aforementioned status information, the following steps are performed on each of the aforementioned comprehensive risk assessment information: Afterwards, the health status perception information corresponding to the aforementioned comprehensive risk assessment information is determined as the target health status perception information. This allows for the association of comprehensive risk assessment information and health status perception information to obtain the target health status perception information for determining comprehensive perception information. Subsequently, the security awareness information corresponding to the aforementioned comprehensive risk assessment information is identified as the target security awareness information. This allows the comprehensive risk assessment information and security awareness information to be correlated to obtain target health status awareness information, thereby determining the comprehensive awareness information and associating it with specific network attacks or abnormal behaviors suffered by the device. This enables the review process to focus on confirmed security threats, rather than conducting indiscriminate checks on all devices, thus improving review efficiency.Then, the environmental sensing and monitoring information corresponding to the aforementioned comprehensive risk assessment information is determined as the target environmental sensing and monitoring information. This allows the comprehensive risk assessment information and environmental sensing and monitoring information to be correlated to obtain target health status sensing information for determining the comprehensive sensing information. Next, the location information corresponding to the aforementioned comprehensive risk assessment information is determined as the target location information. This allows the comprehensive risk assessment information and location information to be correlated, providing precise geographic coordinates for on-site safety inspections or emergency response personnel, enabling accurate positioning of the target equipment, avoiding the significant time spent searching for the target equipment in a vast road network, and improving the speed of follow-up inspections. Then, the status information corresponding to the aforementioned comprehensive risk assessment information is determined as the target status information. This allows the comprehensive risk assessment information and status information to be correlated to obtain target health status sensing information for determining the comprehensive sensing information. Finally, the aforementioned target health status sensing information, target safety sensing information, target environmental sensing and monitoring information, target location information, and target status information are determined as the comprehensive sensing information. This integrates the originally scattered and isolated multi-dimensional information into a unified safety sensing information system centered around a specific device, providing a foundation for the generation and visualization of subsequent control commands. Subsequently, based on the aforementioned spatial mapping relationship table and the determined integrated perception information, spatial mapping processing is performed on the aforementioned virtual layout video streams to obtain the respective integrated perception information video streams. Thus, integrated security situation information can be generated from the integrated perception information video streams, mapping each integrated perception information to the corresponding node position in the virtual layout video stream, achieving situation visualization. Then, the determined integrated perception information is input into a pre-trained integrated security situation control information generation model to obtain the respective integrated security situation control information. Thus, specific and actionable control suggestions or instructions can be generated for each node. Next, for each of the obtained integrated security situation control information, the following steps are performed: the integrated perception information video stream corresponding to the aforementioned integrated security situation control information and the aforementioned integrated security situation control information are identified as the integrated security situation information. This enables the visualization of instructions and information; on-site safety inspectors or emergency response personnel can check whether the equipment has performed the corresponding operation based on the control instructions. Each device has a unique corresponding instruction marked in the video, avoiding the need for on-site safety inspectors or emergency response personnel to search for the corresponding control instruction among multiple control instructions, thus improving review efficiency. Next, the terminal health status information, including the health scores of each terminal in the aforementioned health status trace perception information, is sorted by health status to obtain a terminal health information sequence. This allows for global sorting and priority allocation of encrypted terminal resource availability. Furthermore, the intelligence board health status information, including the health scores of each intelligence board in the aforementioned health status trace perception information, is sorted by health status to obtain an intelligence board health information sequence.This allows for global ranking and prioritization of the reliability of fixed nodes (variable information boards). Finally, the aforementioned terminal health information sequence and the aforementioned information board health information sequence are determined as security ranking information. This yields global, unified security ranking information. Furthermore, by employing a spatial mapping table to match and calibrate the actual physical location of a node with its corresponding node in the video, it is possible to distinguish between multiple similar devices, ensuring that each physical device has a unique and accurate corresponding point in the video stream. This helps on-site security inspectors or emergency responders quickly locate devices, avoiding the significant time spent searching for target devices in a vast road network, thus improving review speed. Simultaneously, the precise fusion of multi-dimensional information (e.g., location information, status information, and video stream) enables visualization of the global situation, allowing for precise matching of control commands with the specific location and real-time status of devices. It also allows for association of specific network attacks or abnormal behaviors suffered by devices based on target health status perception information, enabling reviews to focus on confirmed security threats rather than indiscriminately checking all devices, thereby improving review efficiency. In step 108, the aforementioned comprehensive security situation information and security ranking information are displayed on a preset interactive interface. Based on the security ranking information, the aforementioned data providing nodes are sequentially controlled to execute the corresponding security situation response operations. Each security situation response operation is executed in sequence according to the security ranking information. This avoids inefficient and repetitive reviews of all equipment (including unattacked and healthy equipment) by on-site security inspectors or emergency responders. The location information included in the comprehensive security situation information enables accurate and rapid positioning and status visualization of target equipment, avoiding the significant time spent by on-site security inspectors or emergency responders searching for target equipment in a vast road network. The target health status awareness information allows the review work to focus on confirmed security threats, rather than indiscriminately checking all equipment, thereby improving the review speed and efficiency controlled by the data providing nodes.

[0113] Step 108: Display the various comprehensive security situation information and security ranking information on the preset interactive interface, and based on the security ranking information, control the above data providing nodes to execute the various security situation response operations corresponding to each comprehensive security situation information in sequence.

[0114] In some embodiments, the executing entity can display the aforementioned comprehensive security situation information and security ranking information on a preset interactive interface, and based on the security ranking information, sequentially control the aforementioned data providing nodes to execute the corresponding security situation response operations. In practice, firstly, the executing entity can display the aforementioned comprehensive security situation information (various comprehensive sensing information video streams and various comprehensive security situation control information) and security ranking information on a preset interactive interface to show relevant security personnel the execution effect of instructions, ensuring accurate control actions and that device responses meet expectations, thus achieving visualization of the comprehensive security situation. Then, for the terminal health information sequence included in the security ranking information, according to the order of each terminal health information in the sequence, the encrypted terminal control information in the various comprehensive security situation control information included in the comprehensive security situation information is arranged in the corresponding order to obtain an encrypted terminal control information sequence. Then, based on the encrypted terminal control information sequence, the encrypted terminals in the aforementioned data providing nodes are sequentially controlled to execute the corresponding security situation response operations. Next, for the intelligence board health information sequence included in the aforementioned security ranking information, based on the order of each intelligence board health information in the aforementioned intelligence board health information sequence, the intelligence board control information in the aforementioned comprehensive security situation control information is arranged in the corresponding order to obtain the intelligence board control information sequence. Then, according to the intelligence board control information sequence, each variable intelligence board in the aforementioned data providing nodes is sequentially controlled to execute each security situation response operation corresponding to the aforementioned intelligence board control information. The aforementioned preset interactive interface can be a pre-designed and developed software graphical interface for comprehensive information display and human-computer interaction. Each security situation response operation can be a specific action instruction generated for a specific security risk or state described by the comprehensive security situation information, which can be directly understood and executed by the data providing nodes (encrypted terminals, variable intelligence boards). As an example, the aforementioned comprehensive security situation information could be intelligence boards frequently experiencing abnormal restarts or displaying garbled characters. The aforementioned security response operation can be `RebootWithIntegrityCheck`: This involves rebooting after integrity verification, performing a secure shutdown, and conducting integrity verification of the firmware and configuration during the reboot process to remove malicious code from memory or restore the system from an erroneous state. The relevant security personnel mentioned above can be the staff responsible for security incidents at each data provider node.

[0115] The above-described embodiments of this disclosure have the following beneficial effects: the node control method based on security situation information in some embodiments of this disclosure improves the timeliness and coordination of node control. Specifically, the reason for the poor timeliness and coordination of node control based on security situation information is that: independent alarms or log events are generated by security devices (such as firewalls, intrusion detection systems) or operating platforms, and security analysts analyze these discrete events based on a preset static rule base and send control commands to the target node. Due to the lack of integrated perception and assessment of the overall security situation, it is impossible to accurately determine the level and evolution trend of threats, which leads to the lag and one-sidedness of control decisions, resulting in poor timeliness and coordination of node control. Based on this, the node control method based on security situation information in some embodiments of this disclosure first collects various multi-dimensional data corresponding to each data provider node, wherein each of the above multi-dimensional data includes security analysis data, node health monitoring data, and environmental data. Then, security awareness processing is performed on the security analysis data included in the above multi-dimensional data to obtain various security awareness information. Therefore, various security awareness information representing attack patterns and evolution trends can be obtained for comprehensive risk assessment. Next, health status awareness processing is performed on the node health monitoring data included in the aforementioned multi-dimensional data to obtain various health status awareness information for assessing device health status (e.g., memory, link status). This yields various health status awareness information for comprehensive risk assessment. Then, environmental awareness monitoring processing is performed on the environmental data included in the aforementioned multi-dimensional data to obtain various environmental awareness monitoring information. This provides environmental awareness monitoring information that integrates physical environment data with security events to assess the suitability of the device's ambient temperature and humidity. Subsequently, based on the aforementioned security awareness information and environmental awareness monitoring information, comprehensive risk assessment processing is performed on the aforementioned health status awareness information to obtain comprehensive risk assessment information. Thus, comprehensive risk assessment can be performed based on the various security awareness information and environmental awareness information, placing discrete alarm events in a multi-dimensional fusion real-time situation for dynamic evaluation, resulting in comprehensive risk assessment information that, after comprehensive judgment, can characterize the security risk level. Then, the location information and status information corresponding to the aforementioned data providing nodes are obtained. Next, based on the aforementioned comprehensive risk assessment information, health status perception information, security perception information, environmental perception and monitoring information, and status information, the aforementioned location information is dynamically correlated to obtain comprehensive security situation information and security ranking information.Therefore, fragmented risk, health, safety, environmental, and status information can be integrated into a unified geospatial situation view and security ranking, transforming discrete events into a holistic perception of events. After comprehensively assessing the overall security situation, various comprehensive security situation information and security ranking information are generated. Finally, these comprehensive security situation information and security ranking information are displayed on a preset interactive interface. Based on the security ranking information, the various data providing nodes are sequentially controlled to execute the corresponding security situation response operations. This allows for visualization of the integrated comprehensive security situation and security ranking information. According to the security ranking information, nodes with lower security coefficients are prioritized for response operations. While ensuring overall security, priority is given to controlling nodes with lower security coefficients, thereby improving the timeliness of node control. Global situational awareness information is transformed into actionable collaborative control commands, sequentially controlling the various data providing nodes to execute the corresponding security situation response operations. Because it incorporates physical world data (temperature) and combines it with security awareness information (attack chain analysis) and health status traces (device performance) to conduct a comprehensive risk assessment and determine the threat level, it integrates multi-source information to generate comprehensive security situation information. Based on the security ranking information, it prioritizes security coefficients and prioritizes controlling data providing nodes with lower security coefficients to perform situational response operations. It controls each data providing node in sequence, and the response is no longer a static action for a single alarm (such as "blocking IP"), but a coordinated and ordered response to the overall situation. It prioritizes the handling of nodes with lower security coefficients, thereby improving the timeliness and coordination of node control.

[0116] Further reference Figure 2 As an implementation of the methods shown in the figures, this disclosure provides some embodiments of a node control device based on security situation information. These device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0117] like Figure 2As shown, some embodiments of the node control device 200 based on security situation information include: a data acquisition unit 201, a security awareness processing unit 202, a health status tracking processing unit 203, an environmental awareness monitoring processing unit 204, a comprehensive risk assessment processing unit 205, an acquisition unit 206, a dynamic correlation processing unit 207, and a display unit 208. The data acquisition unit 201 is configured to acquire multi-dimensional data corresponding to each data providing node; the safety awareness processing unit 202 is configured to perform safety awareness processing on the safety analysis data included in the multi-dimensional data to obtain various safety awareness information; the health status perception processing unit 203 is configured to perform health status perception processing on the health monitoring data of each node included in the multi-dimensional data to obtain various health status perception information; the environmental perception monitoring processing unit 204 is configured to perform environmental perception monitoring processing on the environmental data included in the multi-dimensional data to obtain various environmental perception monitoring information; and the comprehensive risk assessment processing unit 205 is configured to process the health status perception information based on the safety awareness information and the environmental perception monitoring information. A comprehensive risk assessment is performed to obtain various comprehensive risk assessment information. The acquisition unit 206 is configured to acquire various location information and various status information corresponding to the aforementioned data providing nodes. The dynamic association processing unit 207 is configured to perform dynamic association processing on the aforementioned location information based on the aforementioned comprehensive risk assessment information, the aforementioned health status perception information, the aforementioned security perception information, the aforementioned environmental perception monitoring information, and the aforementioned status information to obtain various comprehensive security situation information and security ranking information. The display unit 208 is configured to display the aforementioned comprehensive security situation information and the aforementioned security ranking information on a preset interactive interface, and based on the aforementioned security ranking information, to sequentially control the aforementioned data providing nodes to execute various security situation response operations corresponding to the aforementioned comprehensive security situation information.

[0118] It is understandable that the units described in the device 200 are related to the reference. Figure 1 The steps in the method described above correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the device 200 and the units contained therein, and will not be repeated here.

[0119] The following is for reference. Figure 3 It shows a schematic diagram of the structure of an electronic device 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0120] like Figure 3As shown, the electronic device 300 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0121] Typically, the following devices can be connected to I / O interface 305: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 3 Each box shown can represent a device or multiple devices as needed.

[0122] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 309, or installed from storage device 308, or installed from ROM 302. When the computer program is executed by processing device 301, it performs the functions defined in the methods of some embodiments of this disclosure.

[0123] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0124] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0125] The computer-readable medium may be contained within an electronic device or may exist independently, not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: collect multi-dimensional data corresponding to various data nodes, wherein each of the multi-dimensional data includes security analysis data, node health monitoring data, and environmental data; perform security awareness processing on the security analysis data included in the multi-dimensional data to obtain security awareness information; perform health status awareness processing on the node health monitoring data included in the multi-dimensional data to obtain health status awareness information; perform environmental awareness monitoring processing on the environmental data included in the multi-dimensional data to obtain environmental awareness monitoring information; and perform environmental awareness monitoring processing on the security awareness information and the environmental awareness monitoring information; and, based on the security awareness information and the environmental awareness monitoring information, perform environmental awareness monitoring processing on the security analysis data included in the multi-dimensional data to obtain ... The system uses environmental awareness monitoring information to perform comprehensive risk assessment processing on the aforementioned health status awareness information to obtain comprehensive risk assessment information; it acquires location information and status information corresponding to the aforementioned data providing nodes; based on the aforementioned comprehensive risk assessment information, the aforementioned health status awareness information, the aforementioned security awareness information, the aforementioned environmental awareness monitoring information, and the aforementioned status information, it performs dynamic correlation processing on the aforementioned location information to obtain comprehensive security situation information and security ranking information; it displays the aforementioned comprehensive security situation information and security ranking information on a preset interactive interface, and based on the aforementioned security ranking information, it sequentially controls the aforementioned data providing nodes to execute various security situation response operations corresponding to the aforementioned comprehensive security situation information. Computer program code for performing the operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a data acquisition unit, a safety awareness processing unit, a health status awareness processing unit, an environmental awareness monitoring processing unit, a comprehensive risk assessment processing unit, an acquisition unit, a dynamic correlation processing unit, and a display unit. The names of these units do not necessarily limit the specific unit; for example, the acquisition unit may also be described as "a unit that acquires location information and status information corresponding to the aforementioned data providing nodes."

[0128] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0129] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of technical features, but should also cover other technical solutions formed by arbitrary combinations of technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A node control method based on security situation information, comprising: Collect multi-dimensional data corresponding to each data providing node. Each data providing node includes an encrypted terminal and a variable message sign group. Each multi-dimensional data includes security analysis data, node health monitoring data, and environmental data. The security analysis data includes terminal security data and a set of message sign security data. The terminal security data includes operating system information, encrypted file audit logs, and terminal permission operation records. The message sign security data set includes security data from each message sign. The message sign security data includes firmware version security status information, source and content integrity information, and link security audit logs. The various security analysis data, including the multi-dimensional data, undergo security awareness processing to obtain various security awareness information, including: Perform the following steps for each of the security analysis data: An abnormal permission filtering process is performed on the terminal permission operation records included in the terminal security data using a field-programmable gate array (FPGA) to obtain abnormal terminal permission operation records. Close the process corresponding to the abnormal terminal permission operation record; Based on the abnormal terminal permission operation records, alarm count information is generated, wherein the alarm count information is a structured data field used to describe the frequency of abnormal permission operation events within a specific time range; Based on preset spatiotemporal correlation information, spatiotemporal correlation analysis is performed on the encrypted file audit logs included in the terminal security data and the security audit logs of each link included in the intelligence board security data set to obtain at least one spatiotemporal correlation analysis information. Based on the encrypted file audit log and the security audit log of each link, a primary correlation analysis is performed on the at least one spatiotemporal correlation analysis information to obtain at least one event primary correlation information, wherein each event primary correlation information in the at least one event primary correlation information includes an encrypted terminal identifier and a variable message sign identifier. Perform the following steps for each of the at least one event primary association information: The operating system information of the encrypted terminal corresponding to the encrypted terminal identifier included in the primary association information of the event is determined as the target operating system information; the firmware version security status information and source and content integrity information of the variable message sign corresponding to the variable message sign identifier included in the primary association information of the event are determined as the target firmware version security status information and target source and content integrity information. Based on a pre-defined known vulnerability database, vulnerability matching analysis is performed on the target operating system information and the target firmware version security status information to obtain vulnerability matching information. Based on the preset attack pattern information database and the vulnerability matching information, attack pattern analysis and intent inference processing are performed on the primary correlation information of the event to obtain attack pattern analysis information. Based on the attack pattern analysis information, the alarm count information, and the target information source and content completeness information, security awareness information is generated. The health monitoring data of each node included in the multi-dimensional data are processed for health status perception to obtain health status perception information. Environmental perception and monitoring processing is performed on the various environmental data included in the multi-dimensional data to obtain various environmental perception and monitoring information. Based on the various security perception information and the various environmental perception and monitoring information, a comprehensive risk assessment is performed on the various health status perception information to obtain various comprehensive risk assessment information. Obtain location information and status information corresponding to each data providing node. Each location information includes encrypted terminal location information and intelligence board location information. The encrypted terminal location information includes an encrypted terminal identifier, which indicates the geographical location of the encrypted terminal. Each intelligence board location information includes a variable intelligence board identifier, which indicates the geographical location of the variable intelligence board. Based on the comprehensive risk assessment information, the health status perception information, the safety perception information, the environmental perception and monitoring information, and the status information, the location information is dynamically correlated to obtain comprehensive security situation information and security ranking information. The comprehensive security situation information and the security ranking information are displayed on a preset interactive interface, and based on the security ranking information, the data providing nodes are sequentially controlled to perform various security situation response operations corresponding to the comprehensive security situation information.

2. The method according to claim 1, wherein the collection of multi-dimensional data corresponding to each data provider node includes: Perform the following steps for each of the data provider nodes: Obtain operating system information, encrypted file audit logs, and terminal permission operation records corresponding to the encrypted terminals included in the data providing nodes; The operating system information, the encrypted file audit log, and the terminal permission operation record are identified as terminal security data. For each variable intelligence board in the variable intelligence board group included in the data providing node, the intelligence board security data corresponding to the variable intelligence board is obtained, wherein the intelligence board security data includes firmware version security status information, information source and content integrity information and link security audit log; The security data of each intelligence board obtained is defined as the intelligence board security data set; The terminal security data and the information board security data set are identified as security analysis data; Obtain terminal memory information, terminal processor information, terminal disk information, and terminal link status information corresponding to the encrypted terminals included in the data providing nodes; The terminal memory information, the terminal processor information, the terminal disk information, and the terminal link status information are determined as terminal health data; For each variable intelligence board in the variable intelligence board group included in the data providing node, obtain intelligence board health data corresponding to the variable intelligence board, wherein the intelligence board health data includes intelligence board memory information, intelligence board processor information, intelligence board disk information and intelligence board link status information; The acquired health data of each intelligence board is defined as the intelligence board health data set; The set of terminal health data and information board health data is determined as node health monitoring data; Obtain terminal temperature information and terminal humidity information corresponding to the encrypted terminals included in the data providing node; The terminal temperature information and the terminal humidity information are determined as terminal environmental data; For each variable information board in the variable information board group included in the data providing node, information board environmental data corresponding to the variable information board is obtained, wherein the information board environmental data includes information board temperature information and information board humidity information; The acquired environmental data from each intelligence board is defined as the intelligence board environmental data set. The set of terminal environment data and information board environment data is defined as environment data; The security analysis data, the node health monitoring data, and the environmental data are defined as multi-dimensional data.

3. The method according to claim 1, wherein, Each node health monitoring data set includes terminal health data and intelligence board health data sets. The terminal health data includes terminal memory information, terminal processor information, terminal disk information, and terminal link status information. The terminal processor information includes terminal processor utilization information and terminal processor load information. The terminal memory information includes terminal memory utilization information and terminal remaining memory capacity information. The terminal disk information includes terminal disk monitoring status information, terminal disk utilization information, and terminal disk remaining space information. The terminal link status information includes terminal network link latency information, terminal network link packet loss rate information, and terminal network link bandwidth information. Furthermore, the health status perception processing of each node health monitoring data included in the multi-dimensional data sets yields various health status perception information, including: Perform the following steps on each node health monitoring data in the aforementioned node health monitoring data: Perform the following steps on the terminal health data included in the node health monitoring data: Based on the preset processor status determination information and the terminal processor utilization information, the terminal processor load information is processed to determine the processor status, thereby obtaining the terminal processor status information. Based on the preset disk status determination information, the terminal disk monitoring status information, and the terminal disk usage information, the remaining space information of the terminal disk is processed to determine the disk status information, thereby obtaining the terminal disk status information. Based on the preset memory status determination information and the terminal memory usage information, the remaining memory capacity information of the terminal is processed to determine the memory status, thereby obtaining the terminal memory status information. Based on the preset link status determination information, the terminal network link delay information, and the terminal network link packet loss rate information, the terminal network link bandwidth information is processed to determine the link status information to obtain the terminal link status information. A terminal health score is generated based on the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information. Based on preset health classification information, the terminal health score is subjected to risk level mapping processing to obtain terminal risk level information. The terminal health score and the terminal risk level information are determined as the terminal health status information; For each intelligence board health data in the intelligence board health data set included in the node health monitoring data, the following steps are performed: Based on the intelligence board health data, intelligence board health status information is generated; The terminal health status information and the obtained health status information of each intelligence board are determined as health status trace perception information.

4. The method according to claim 3, wherein, The process of generating a terminal health score based on the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information includes: In response to determining that the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information meet the preset normal status information, the first preset score is used as the terminal processor status score, the terminal disk status score, the terminal memory status score, and the terminal link status score. In response to determining that the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information meet the preset warning status information, the second preset score is used as the terminal processor status score, the terminal disk status score, the terminal memory status score, and the terminal link status score. In response to determining that the terminal processor status information, the terminal disk status information, the terminal memory status information, and the terminal link status information satisfy preset abnormal status information, a third preset score is used as the terminal processor status score, the terminal disk status score, the terminal memory status score, and the terminal link status score. A terminal health score is generated based on preset terminal processor weight, preset terminal disk weight, preset terminal memory weight, preset terminal link weight, terminal processor status score, terminal disk status score, terminal memory status score, and terminal link status score.

5. The method according to claim 2, wherein, The environmental perception and monitoring processing of the various environmental data included in the multi-dimensional data is used to obtain various environmental perception and monitoring information, including: For each of the environmental data sets, perform the following steps: Perform the following steps on the terminal environment data included in the environmental data: In response to determining that the terminal temperature information included in the terminal environment data is greater than a preset first temperature threshold, a first temperature warning message is generated as terminal environment perception information; In response to determining that the terminal temperature information included in the terminal environment data is less than a preset first temperature threshold, the preset temperature perception normal indicator and the terminal temperature information are determined as terminal environment perception information; In response to determining that the terminal humidity information included in the terminal environment data is greater than a preset first humidity threshold, a first humidity warning message is generated as terminal environment perception information; In response to determining that the terminal humidity information included in the terminal environment data is less than a preset first humidity threshold, the preset humidity perception normal indicator and the terminal humidity information are determined as terminal environment perception information; The terminal environment perception information is defined as terminal environment perception monitoring information; For each piece of information board environmental data in the information board environmental data set included in the environmental data, perform the following steps: In response to determining that the temperature information of the information board included in the information board environmental data is greater than a preset second temperature threshold, a second temperature warning information is generated as information board environmental perception information; In response to determining that the information board temperature information included in the information board environmental data is less than a preset second temperature threshold, the preset temperature perception normal indicator and the information board temperature information are determined as information board environmental perception information. In response to determining that the humidity information of the information board included in the information board environmental data is greater than a preset second humidity threshold, a second humidity warning information is generated as information board environmental perception information; In response to determining that the humidity information of the information board included in the information board environmental data is less than a preset second humidity threshold, the preset humidity perception normal indicator and the humidity information of the information board are determined as the information board environmental perception information; The environmental perception information of the information board is identified as the environmental perception monitoring information of the information board. The terminal environmental perception monitoring information and the environmental perception monitoring information obtained from each information board are identified as environmental perception monitoring information.

6. The method according to claim 1, wherein, Each security perception information in the various security perception information corresponds to one health status trace perception information in the various health status trace perception information; each environmental perception monitoring information in the various environmental perception monitoring information corresponds to one health status trace perception information in the various health status trace perception information; and the comprehensive risk assessment processing based on the various security perception information and the various environmental perception monitoring information yields various comprehensive risk assessment information, including: For each health status trace sensing information in the aforementioned health status trace sensing information, the following steps are performed: The security perception information corresponding to the health status trace perception information is identified as the target security perception information; The environmental sensing and monitoring information corresponding to the health status trace sensing information is determined as the target environmental sensing and monitoring information; Based on preset safety risk weights, preset environmental risk weights, preset health risk weights, the target safety perception information, the target environmental perception monitoring information, and health status perception information, comprehensive risk assessment information is generated.

7. A node control device based on security situation information, comprising: The acquisition unit is configured to acquire multi-dimensional data corresponding to each data providing node. Each data providing node includes an encrypted terminal and a variable message sign (VMS) group. Each multi-dimensional data includes security analysis data, node health monitoring data, and environmental data. The security analysis data includes terminal security data and VMS security data sets. The terminal security data includes operating system information, encrypted file audit logs, and terminal permission operation records. The VMS security data sets include security data from each VMS. The VMS security data includes firmware version security status information, source and content integrity information, and link security audit logs. The security awareness processing unit is configured to perform security awareness processing on the various security analysis data included in the various multi-dimensional data to obtain various security awareness information, including: performing the following steps on each security analysis data in the various security analysis data: using a field-programmable gate array to perform abnormal permission filtering processing on the terminal permission operation records included in the terminal security data to obtain abnormal terminal permission operation records; closing the process corresponding to the abnormal terminal permission operation record; generating alarm count information based on the abnormal terminal permission operation record, wherein the alarm count information is a structured data field used to describe the frequency of abnormal permission operation events within a specific time range; performing spatiotemporal correlation analysis processing on the encrypted file audit logs included in the terminal security data and the various link security audit logs included in the intelligence board security data set based on preset spatiotemporal correlation information to obtain at least one spatiotemporal correlation analysis information; performing primary correlation analysis processing on the at least one spatiotemporal correlation analysis information based on the encrypted file audit logs and the various link security audit logs to obtain at least one At least one event primary association information, wherein each event primary association information includes an encrypted terminal identifier and a variable message sign (VMS) identifier; the following steps are performed on each event primary association information: determining the operating system information of the encrypted terminal corresponding to the encrypted terminal identifier included in the event primary association information as the target operating system information; determining the firmware version security posture information and source and content integrity information of the VMS corresponding to the VMS identifier included in the event primary association information as the target firmware version security posture information and target source and content integrity information; performing vulnerability matching analysis on the target operating system information and the target firmware version security posture information based on a preset known vulnerability database to obtain vulnerability matching information; performing attack pattern analysis and intent inference processing on the event primary association information based on a preset attack pattern information database and the vulnerability matching information to obtain attack pattern analysis information; generating security awareness information based on the attack pattern analysis information, the alarm count information, and the target source and content integrity information. The health status trace perception processing unit is configured to perform health status trace perception processing on the health monitoring data of each node included in the multi-dimensional data to obtain various health status trace perception information. The environmental perception and monitoring processing unit is configured to perform environmental perception and monitoring processing on the various environmental data included in the various multi-dimensional data to obtain various environmental perception and monitoring information. The comprehensive risk assessment and processing unit is configured to perform comprehensive risk assessment and processing on the various health status trace perception information based on the various safety perception information and the various environmental perception and monitoring information, so as to obtain various comprehensive risk assessment information. The acquisition unit is configured to acquire location information and status information corresponding to each data providing node. Each location information includes encrypted terminal location information and intelligence board location information. The encrypted terminal location information includes an encrypted terminal identifier, which indicates the geographical location of the encrypted terminal. Each intelligence board location information includes a variable intelligence board identifier, which indicates the geographical location of the variable intelligence board. The dynamic correlation processing unit is configured to perform dynamic correlation processing on the location information based on the comprehensive risk assessment information, the health status perception information, the security perception information, the environmental perception and monitoring information, and the status information to obtain comprehensive security situation information. The display unit is configured to display the various comprehensive security situation information on a preset interactive interface, and to control the various data providing nodes to perform various operations corresponding to the various comprehensive security situation information based on the interface interaction operation of the preset interactive interface.

8. An electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 6.

9. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images