A 5G-based industrial internet security risk assessment method and system

Abstract

The present application relates to the technical field of industrial internet security, in particular to a 5G-based industrial internet security risk assessment method and system, which first carries out full-dimensional original data collection for 5G network, edge, industrial control terminal and service link; then pre-processes the collected full-dimensional original data to form a standard data set with unified structure, complete data and logical coherence; then extracts 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features and full-link risk features from the standard data set, and constructs single-link risk model and full-link risk model; then carries out single-object risk assessment based on the single-link risk model and full-link risk assessment based on the full-link risk model; finally outputs the assessment results. Through the coordinated cooperation of multiple steps, the present application realizes systematic and accurate security risk control of 5G industrial internet full-link and full-object.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, specifically to a 5G-based industrial internet security risk assessment method and system. Background Technology

[0002] The Industrial Internet is a new industrial system formed by the deep integration of new-generation information technologies such as the Internet, big data, and artificial intelligence with traditional industries. By fully connecting the data links of equipment, production lines, factories, supply chains, and even the entire industry, it enables the interconnection of production factors, intelligent control of production processes, and collaborative optimization of industrial chain resources, thereby promoting the digital and intelligent transformation of the manufacturing industry.

[0003] Currently, 5G industrial internet security protection and services are fragmented, failing to coordinate security needs across the entire chain. There is a lack of systematic security assessment, vulnerability protection, and unified service systems for 5G slicing, edge nodes, and heterogeneous industrial control terminals, making it difficult to achieve full-dimensional security coverage of communication protocols, business applications, and network links. The construction of a comprehensive security system is also insufficient. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a 5G-based industrial internet security risk assessment method and system. Through the close coordination of six steps, it achieves systematic and precise security risk management and control of the entire 5G industrial internet link and all objects, effectively solving the current problems of fragmented security protection and service content, lack of overall security requirements across the entire link, and lack of systematic security assessment and unified service system.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A 5G-based industrial internet security risk assessment method includes the following steps: Step 1: Conduct full-dimensional raw data collection for 5G networks, edge computing, industrial control terminals, and business links; Step 2: Perform data preprocessing on the collected raw data from all dimensions to finally form a standard dataset; Step 3: Extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features from the standard dataset, and simultaneously construct single-link risk models and end-to-end risk models; Step 4: Conduct a single-object risk assessment based on the single-link risk model from Step 3; Step 5: Conduct a full-link risk assessment based on the full-link risk model from Step 3; Step 6: Output the results of the single-object risk assessment and the full-link risk assessment.

[0006] Preferably, in step one, the data collected includes 5G slice data, edge node data, heterogeneous industrial control terminal data, service and link data, and management and external data, specifically: 5G slicing data: slice running status, slice configuration data, slice security logs; Edge node data: edge hardware status, edge software data, edge security data; Heterogeneous industrial control terminal data: terminal basic information, terminal operation data, and terminal access data; Business and link data: industrial business data, network link data, and security alarm data; Managing and external data: security configuration data, compliance data, and external threat intelligence.

[0007] Preferably, the single-link risk model in step three includes a 5G slicing risk model, an edge node risk model, and a heterogeneous industrial control terminal risk model.

[0008] Preferably, the formula for the 5G slicing risk model is as follows:

[0009] In the formula, This represents the comprehensive risk value of 5G slicing, and is also the output of the 5G slicing risk model; This represents the complexity coefficient of the slice configuration; This represents the deviation of the slice's operating status; Represents the utilization rate of slice resources; The weighted sum of security log risks represented by the slice. Representing the The frequency of such security incidents This represents the risk weight of this type of event. This is used to smooth out the non-linear impact of frequency on risk, and to avoid excessive amplification of risk from a single high-frequency, low-risk event. , Represents the risk weighting coefficient; This represents the total number of security log event types.

[0010] Preferably, the formula for the edge node risk model is as follows:

[0011] In the formula, This represents the comprehensive risk value of the edge node, and is also the output of the edge node risk model; This represents the cumulative duration of edge hardware failures; This represents the total runtime of the edge nodes; This represents the severity coefficient of edge software vulnerabilities; This represents the frequency of use of edge software; The score represents the effective protection capability of edge security, and is a quantitative score based on effective protection measures such as intrusion detection and encrypted storage. The total score represents the ability to provide effective safety protection. , , This represents the risk weighting coefficient.

[0012] Preferably, the formula expression for the risk model of the heterogeneous industrial control terminal is:

[0013] In the formula, This represents the overall risk value of heterogeneous industrial control terminals, and is also the output of the heterogeneous industrial control terminal risk model. This represents the compliance rate of basic terminal information; This represents the deviation of the terminal's operational data; Represents the baseline value of terminal operating data; This represents the frequency of unauthorized access by the terminal. , , This represents the risk weighting coefficient.

[0014] Preferably, the formula for the end-to-end risk model is as follows:

[0015] In the formula, It represents the overall risk value across the entire risk chain, and is also the output of the entire risk chain model; The total number of risk assessment objects in the representative link; Representing the Weighting coefficients for each evaluation object; Representing the Single-object risk value for each assessment object; The number of core object groups that represent the risk transmission relationship in the chain; This represents the risk transmission amplification coefficient; The geometric average risk represents the core object group, avoiding the excessive amplification of extreme risks of a single object, while reflecting the synergistic impact of risks of multiple objects and the transmission and coupling effects of risks in the chain.

[0016] Preferably, in step four: When the comprehensive risk value of 5G slicing A value greater than 0.7 indicates that the slide is in a risky state; conversely, a value less than 0.7 indicates that the slide is not in a risky state. When the comprehensive risk value of edge nodes A value greater than 0.65 indicates that the edge node is in a risky state; conversely, a value less than 0.65 indicates that the edge node is not in a risky state. When the comprehensive risk value of heterogeneous industrial control terminals A value greater than 0.6 indicates that the terminal is in a risky state; conversely, a value less than 0.6 indicates that the terminal is not in a risky state.

[0017] Preferably, in step five, when the overall risk value of the entire link is... A value greater than 0.7 indicates that the entire supply chain is at risk; conversely, a value less than 0.7 indicates that the entire supply chain is not at risk.

[0018] A 5G-based industrial internet security risk assessment system, applied to a 5G-based industrial internet security risk assessment method, includes a raw data acquisition module, a data preprocessing module, a risk feature extraction module, a model building module, a risk assessment module, and an output feedback module. The raw data acquisition module is used to perform raw data acquisition. The data preprocessing module is used to preprocess the raw data and then construct a standard dataset. The risk feature extraction module is used to extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features based on standard datasets. The model building module is used to construct single-link risk models and full-link risk models. The risk assessment module is used to perform single-object risk assessment and full-chain risk assessment. The output feedback module is used to provide feedback on the results of single-object risk assessment and end-to-end risk assessment.

[0019] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention acquires full-dimensional raw data in step one, constructs a standard data set in step two, and then extracts 5G slice risk characteristics, edge node risk characteristics, heterogeneous industrial control terminal risk characteristics, and full-link risk characteristics in step three. Simultaneously, it constructs single-link risk models and full-link risk models, achieving a systematic analysis and quantitative modeling of the risks of each core component and the overall link of the 5G industrial internet. This breaks down the barriers between security protection and service content, coordinates full-link security requirements, and compensates for the lack of a systematic security assessment and unified service system for 5G slices, edge nodes, and heterogeneous industrial control terminals. It establishes a foundation for full-dimensional security assessment covering communication protocols, business applications, and network links, promoting the systematic construction of a comprehensive security system. This provides scientific and reliable model support and feature basis for the accurate implementation of subsequent steps four (single-object risk assessment) and five (full-link risk assessment), achieving a closed-loop connection from data collection to risk modeling, ensuring that subsequent risk assessments can comprehensively and accurately reflect the actual security situation of the 5G industrial internet.

[0020] 2. This invention, through step four, conducts single-object risk assessment based on a single-link risk model, and step five, conducts full-link risk assessment based on a full-link risk model. It clarifies the risk judgment criteria for each object and the entire link, achieving accurate identification and clear judgment of local risks of each core component and global risks of the entire link. It connects the risk model with actual security protection needs, further improves the unified security service system, strengthens the systematic construction of the whole-domain security system, and effectively solves the problems of difficulty in coordinating full-link security and inability to fully cover security in all dimensions. It provides precise guidance for the formulation of subsequent security control measures and ensures the safe and stable operation of 5G industrial internet. Attached Figure Description

[0021] Figure 1 This is a diagram illustrating the method steps of the present invention; Figure 2 This is a flowchart illustrating the system of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It is worth noting that this application also relates to prior art. Since prior art is well known to those skilled in the art, it will not be described in detail in this application.

[0023] like Figure 1 As shown, a 5G-based industrial internet security risk assessment method includes the following steps: Step 1: Conduct full-dimensional raw data collection for 5G networks, edge computing, industrial control terminals, and business links; The data collected includes 5G slice data, edge node data, heterogeneous industrial control terminal data, service and link data, and management and external data, specifically: 5G slicing data: slice operation status, slice configuration data, slice security logs; edge node data: edge hardware status, edge software data, edge security data; heterogeneous industrial control terminal data: terminal basic information, terminal operation data, terminal access data; service and link data: industrial service data, network link data, security alarm data; management and external data: security configuration data, compliance data, external threat intelligence; Step one, by aggregating raw data from all dimensions, not only provides rich material for subsequent data preprocessing and the construction of standard datasets, but also ensures the comprehensiveness and accuracy of risk assessment from the source, avoiding missed or misjudged risks due to missing or incomplete data. It lays the foundation for the correlation analysis and coupled assessment of risks across the entire chain, effectively supports the efficient implementation of subsequent risk feature extraction, model construction, and quantitative assessment, and provides indispensable data support for timely discovery of potential risks in the 5G industrial internet and the accurate identification and closed-loop management of risks, fundamentally consolidating the feasibility and effectiveness of the entire risk assessment method. Step 2: Perform data preprocessing on the collected raw data from all dimensions to form a standard dataset. First, filter the collected raw data from all dimensions to remove missing values, duplicate values, and invalid interference data. Then, unify data specifications, coding standards, and units to address the format differences of different data types. At the same time, merge and associate related data scattered in different collection objects. Combine the needs of industrial internet scenarios to perform data dimensionality reduction, retain core effective information, and finally form a standard dataset with a unified structure, complete data, and coherent logic. This will reduce the interference of abnormal data in subsequent risk feature extraction and model construction, and improve data quality. Step 3: Extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features from the standard dataset, and simultaneously construct 5G slice risk models, edge node risk models, heterogeneous industrial control terminal risk models, and end-to-end risk models. 5G slicing risks mainly manifest in anomalies in slice configuration, operational status, and security logs. The degree of risk is closely related to the rationality of slice resource allocation and the correlation of security events. A 5G slicing risk model reflects the quantitative impact of resource constraints and security anomalies, with the following formula:

[0024] In the formula, This represents the comprehensive risk value of 5G slicing, and is also the output of the 5G slicing risk model; This represents the complexity coefficient of the slice configuration; This represents the deviation of the slice's operating status; Represents the utilization rate of slice resources; The weighted sum of security log risks represented by the slice. Representing the The frequency of such security incidents This represents the risk weight of this type of event. This is used to smooth out the non-linear impact of frequency on risk, and to avoid excessive amplification of risk from a single high-frequency, low-risk event. , Represents the risk weighting coefficient; Represents the total number of security log event types; The formula of the 5G slicing risk model not only covers the basic stability risks of slice configuration and operation, but also focuses on the direct threats of security events. At the same time, it balances the impact of different risk sources through weight coefficients, so that 5G slicing can meet the core requirements of on-demand resource allocation and ensuring business security. Edge node risks are jointly determined by hardware status, software operation, and security protection capabilities. Hardware failures, software vulnerabilities, and security defense failures are the core risk triggers. The edge node risk model comprehensively reflects the integration of hardware reliability, software robustness, and security protection effectiveness. The formula is as follows:

[0025] In the formula, This represents the comprehensive risk value of the edge node, and is also the output of the edge node risk model; This represents the cumulative duration of edge hardware failures; This represents the total runtime of the edge nodes; This represents the severity coefficient of edge software vulnerabilities; This represents the frequency of use of edge software; The score represents the effective protection capability of edge security, and is a quantitative score based on effective protection measures such as intrusion detection and encrypted storage. The total score represents the ability to provide effective safety protection. , , Represents the risk weighting coefficient; The edge node risk model formula covers the risk sources of edge nodes from three core levels: hardware, software, and security. It quantifies the risks of each dimension in a probabilistic and correlational way, so that edge nodes can fit the characteristics of limited resources, dispersed deployment, and high security protection difficulty. The risks of heterogeneous industrial control terminals focus on the compliance of basic terminal information, the stability of operational data, and the security of access behavior, fully reflecting the terminal's compliance, operational health, and access security. The formula is as follows:

[0026] In the formula, This represents the overall risk value of heterogeneous industrial control terminals, and is also the output of the heterogeneous industrial control terminal risk model. This represents the compliance rate of basic terminal information; This represents the deviation of the terminal's operational data; Represents the baseline value of terminal operating data; This represents the frequency of unauthorized access by the terminal. , , This represents the risk weighting coefficient.

[0027] The risk model formula for heterogeneous industrial control terminals covers the entire lifecycle risks of terminals, from basic identity to operation process and access behavior. Through normalization processing, it achieves the comparability of risks in different dimensions, which can improve the characteristics of heterogeneous industrial control terminals, such as diverse types, large functional differences and complex access scenarios. The end-to-end risk model amplifies the correlation, transmission, and superposition of risks among various objects, reflecting the risk coupling effect between 5G slicing, edge nodes, industrial control terminals, and service links. The formula for the end-to-end risk model is as follows:

[0028] In the formula, It represents the overall risk value across the entire risk chain, and is also the output of the entire risk chain model; The total number of risk assessment objects in the representative link; Representing the Weighting coefficients for each evaluation object; Representing the Single-object risk value for each assessment object; The number of core object groups that represent the risk transmission relationship in the chain; This represents the risk transmission amplification coefficient; The geometric average risk represents the core object group, avoiding the excessive amplification of extreme risks of a single object, while reflecting the synergistic impact of risks of multiple objects and the transmission and coupling effects of risks in the chain; The full-link risk model formula retains the basic contribution of each individual object's risk and reflects the mutual influence of cross-object risks through the product term, thus avoiding assessment bias and comprehensively reflecting the overall risk situation of the entire link. Step 4: Conduct a single-object risk assessment based on the single-link risk model from Step 3, specifically as follows: When the comprehensive risk value of 5G slicing A value greater than 0.7 indicates that the slide is in a risky state; conversely, a value less than 0.7 indicates that the slide is not in a risky state. When the comprehensive risk value of edge nodes A value greater than 0.65 indicates that the edge node is in a risky state; conversely, a value less than 0.65 indicates that the edge node is not in a risky state. When the comprehensive risk value of heterogeneous industrial control terminals A value greater than 0.6 indicates that the terminal is in a risky state; conversely, a value less than 0.6 indicates that the terminal is not in a risky state. Step 5: Conduct a full-link risk assessment based on the full-link risk model from Step 3. Specifically, this involves assessing the overall risk value of the entire link. A value greater than 0.7 indicates that the entire supply chain is at risk; conversely, a value less than 0.7 indicates that the entire supply chain is not at risk. Steps four and five transform the risk model built in step three into actionable and verifiable risk assessment results, bridging model building and result output to achieve accurate risk identification and comprehensive control. Step four conducts risk assessments for individual objects such as 5G slices, edge nodes, and heterogeneous industrial control terminals. By setting differentiated and precise risk thresholds, it can accurately locate the risk status of each independent core component, clarify the specific objects and scope of risk occurrence, and provide clear guidance for subsequent targeted investigation and risk management. Step five focuses on conducting risk assessments across the entire chain. By using unified thresholds to determine the risk status of the entire chain, it achieves global control over the overall operation chain of the industrial internet, taking into account both the correlation of risks of individual objects and the collaborative risks of the overall chain, thus making up for the shortcomings of single-object assessments that only focus on individual risks and ignore global correlation risks. Step 6: Output the results of the single-object risk assessment and the full-link risk assessment.

[0029] like Figure 2 As shown, a 5G-based industrial internet security risk assessment system is applied to a 5G-based industrial internet security risk assessment method, including a raw data acquisition module, a data preprocessing module, a risk feature extraction module, a model building module, a risk assessment module, and an output feedback module. The raw data acquisition module is used to perform raw data acquisition. The data preprocessing module is used to preprocess the raw data and then construct a standard dataset. The risk feature extraction module is used to extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features based on standard datasets. The model building module is used to construct single-link risk models and full-link risk models; The risk assessment module is used to perform single-object risk assessment and end-to-end risk assessment. The output feedback module is used to provide feedback on the results of single-object risk assessment and end-to-end risk assessment.

[0030] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A 5G-based industrial internet security risk assessment method, characterized in that, Includes the following steps: Step 1: Conduct full-dimensional raw data collection for 5G networks, edge computing, industrial control terminals, and business links; Step 2: Perform data preprocessing on the collected raw data from all dimensions to finally form a standard dataset; Step 3: Extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features from the standard dataset, and simultaneously construct single-link risk models and end-to-end risk models; Step 4: Conduct a single-object risk assessment based on the single-link risk model from Step 3; Step 5: Conduct a full-link risk assessment based on the full-link risk model from Step 3; Step 6: Output the results of the single-object risk assessment and the full-link risk assessment.

2. The industrial internet security risk assessment method based on 5G according to claim 1, characterized in that, In step one, the data collected includes 5G slice data, edge node data, heterogeneous industrial control terminal data, service and link data, and management and external data, specifically: 5G slicing data: slice running status, slice configuration data, slice security logs; Edge node data: edge hardware status, edge software data, edge security data; Heterogeneous industrial control terminal data: terminal basic information, terminal operation data, and terminal access data; Business and link data: industrial business data, network link data, and security alarm data; Managing and external data: security configuration data, compliance data, and external threat intelligence.

3. The industrial internet security risk assessment method based on 5G according to claim 1, characterized in that, The single-link risk model in step three includes the 5G slicing risk model, the edge node risk model, and the heterogeneous industrial control terminal risk model.

4. The industrial internet security risk assessment method based on 5G according to claim 3, characterized in that, The formula for the 5G slicing risk model is as follows: In the formula, This represents the comprehensive risk value of 5G slicing, and is also the output of the 5G slicing risk model; This represents the complexity coefficient of the slice configuration; This represents the deviation of the slice's operating status; Represents the utilization rate of slice resources; The weighted sum of security log risks represented by the slice. Representing the The frequency of such security incidents This represents the risk weight of this type of event. This is used to smooth out the non-linear impact of frequency on risk, and to avoid excessive amplification of risk from a single high-frequency, low-risk event. , Represents the risk weighting coefficient; This represents the total number of security log event types.

5. The industrial internet security risk assessment method based on 5G according to claim 3, characterized in that, The formula for the edge node risk model is as follows: In the formula, This represents the comprehensive risk value of the edge node, and is also the output of the edge node risk model; This represents the cumulative duration of edge hardware failures; This represents the total runtime of the edge nodes; This represents the severity coefficient of edge software vulnerabilities; This represents the frequency of use of edge software; The score represents the effective protection capability of edge security, and is a quantitative score based on effective protection measures such as intrusion detection and encrypted storage. The total score represents the ability to provide effective safety protection. , , This represents the risk weighting coefficient.

6. The industrial internet security risk assessment method based on 5G according to claim 3, characterized in that, The formula for the risk model of heterogeneous industrial control terminals is as follows: In the formula, This represents the overall risk value of heterogeneous industrial control terminals, and is also the output of the heterogeneous industrial control terminal risk model. This represents the compliance rate of basic terminal information; This represents the deviation of the terminal's operational data; Represents the baseline value of terminal operating data; This represents the frequency of unauthorized access by the terminal. , , This represents the risk weighting coefficient.

7. The industrial internet security risk assessment method based on 5G according to claim 3, characterized in that, The formula for the end-to-end risk model is as follows: In the formula, It represents the overall risk value across the entire risk chain, and is also the output of the entire risk chain model; The total number of risk assessment objects in the representative link; Representing the Weighting coefficients for each evaluation object; Representing the Single-object risk value for each assessment object; The number of core object groups that represent the risk transmission relationship in the chain; This represents the risk transmission amplification coefficient; The geometric average risk represents the core object group, avoiding the excessive amplification of extreme risks of a single object, while reflecting the synergistic impact of risks of multiple objects and the transmission and coupling effects of risks in the chain.

8. The industrial internet security risk assessment method based on 5G according to claim 4, characterized in that, In step four: When the comprehensive risk value of 5G slicing A value greater than 0.7 indicates that the slide is in a risky state; Conversely, it means the slide is not in a risky state; When the comprehensive risk value of edge nodes A value greater than 0.65 indicates that the edge node is in a risky state; Conversely, it means that the edge node is not in a risky state; When the comprehensive risk value of heterogeneous industrial control terminals A value greater than 0.6 indicates that the terminal is in a risky state; Conversely, it means the terminal is not in a risky state.

9. A 5G-based industrial internet security risk assessment method according to claim 7, characterized in that, In step five, when the overall risk value of the entire link... A value greater than 0.7 indicates that the entire supply chain is at risk. Conversely, it means that the entire supply chain is not at risk.

10. A 5G-based industrial internet security risk assessment system, applied to the 5G-based industrial internet security risk assessment method described in any one of claims 1 to 9, characterized in that, It includes a raw data acquisition module, a data preprocessing module, a risk feature extraction module, a model building module, a risk assessment module, and an output feedback module; The raw data acquisition module is used to perform raw data acquisition. The data preprocessing module is used to preprocess the raw data and then construct a standard dataset. The risk feature extraction module is used to extract 5G slice risk features, edge node risk features, heterogeneous industrial control terminal risk features, and end-to-end risk features based on standard datasets. The model building module is used to construct single-link risk models and full-link risk models. The risk assessment module is used to perform single-object risk assessment and full-chain risk assessment. The output feedback module is used to provide feedback on the results of single-object risk assessment and end-to-end risk assessment.

Images