An industrial internet-oriented task risk continuous analysis method

Abstract

The application provides an industrial internet-oriented task risk continuous analysis method, comprising the following steps: collecting physical domain, control domain and network domain data in an industrial task execution process, aligning according to a unified time window and task stage marking, mapping the three-domain objects into a unified heterogeneous node set and calculating node-time window abnormal factors; performing adaptive time reservation and decay enhancement based on abnormal strength to obtain time-enhanced abnormal values; performing neighborhood fusion based on the spatial correlation within the domain to obtain intra-domain spatial-enhanced abnormal values; constructing a network-control bridge and a control-physical bridge to determine cross-domain support strength, fusing the intra-domain spatial-enhanced abnormal values and the cross-domain support strength to determine node-level risks, determining chain-level risks for legal cross-domain chains, and comprehensively outputting task risk analysis results by combining the node-level risks and the chain-level risks. The application can improve the full-process risk continuous analysis, dynamic evaluation and accurate determination capability of industrial tasks.

Description

Technical Field

[0001] This invention belongs to the field of industrial information security technology, specifically relating to a method for continuous analysis of task risks for the industrial internet. Background Technology

[0002] The execution of industrial internet tasks involves physical devices, control units, and network communication entities. The physical domain reflects the operating status of equipment and process variables, the control domain reflects control logic, action scheduling, and parameter changes, and the network domain reflects communication connections, protocol interactions, and data transmission behavior. These three types of objects form a closed-loop relationship of network interaction, control actions, and physical responses around the same industrial task, jointly determining the task execution status and security risk status.

[0003] Existing industrial safety analysis methods mainly fall into two categories: First, online time-series anomaly detection and state evolution analysis schemes oriented towards time continuity. These schemes establish normal state models based on historical operating data and identify anomalies by comparing the deviation between the current state and the predicted state. However, they lack mechanisms for adaptively retaining and attenuating the impact of historical anomalies based on the intensity of the anomalies, making it difficult to organize consecutive anomaly segments into a continuous risk evolution process. Second, multi-domain joint modeling and graph structure analysis schemes oriented towards cross-domain associations. These schemes abstract industrial objects as graph nodes and learn the association relationships through graph neural networks. However, they lack differentiated modeling of different spatial relationships within the three domains, as well as cross-domain bridge support mechanisms centered on control relationships and chain-level consensus enhancement mechanisms.

[0004] Existing technologies have the following problems: On the one hand, they lack the ability to retain the impact of anomalies and express the evolution of risks throughout the entire task process, making it difficult to characterize the persistence, lag, and cross-domain asynchronous propagation characteristics of anomalies during task execution; on the other hand, they lack the ability to cross-domain structured association for industrial task execution logic, making it difficult to achieve accurate risk assessment by combining local enhancement of the three domains with cross-domain support. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides a method for continuous task risk analysis for the Industrial Internet. The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides a method for continuous analysis of task risks in the Industrial Internet, including: Collect task-related data from three domains during the execution of industrial tasks, align the task-related data from the three domains according to a unified time window and label the task stages to obtain time window data with task stage labels; the task-related data from the three domains includes physical domain data, control domain data and network domain data. The three-domain task-related objects in the time window data are mapped to a unified heterogeneous node set, and the node-time window anomaly factor is calculated based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label. Based on the node-time window anomaly factor, adaptive time retention and attenuation enhancement of outliers are performed to obtain time-enhanced outliers; Based on the spatial correlation within the domain to which each node belongs, the time-enhanced anomalies are spatially enhanced within the domain to obtain spatially enhanced anomalies within the domain. Based on cross-domain association, network-control bridges and control-physical bridges are constructed, and cross-domain support strength is determined according to the spatial augmentation anomalies within the domain, the network-control bridges, and the control-physical bridges. Node-level risks are determined based on the intra-domain spatial augmentation anomalies and the cross-domain support strength. Based on the node-level risks, chain-level risks are determined for legitimate cross-domain chains composed of network domain nodes, control domain nodes, and physical domain nodes. The task risk analysis results are determined based on the node-level risk and the chain-level risk.

[0006] In one embodiment of the present invention, aligning the three-domain task-related data according to a unified time window and labeling the task stages to obtain time window data with task stage labels includes: The physical domain data, the control domain data, and the network domain data are mapped to a unified time window set according to a unified time window length. Based on the task phase division information, the unified time windows in the unified time window set are labeled with task phases to obtain the time window data with task phase labels. The physical domain data includes sensor measurements, actuator operating status, equipment process measurement point data, and process variables. The control domain data includes PLC status, control mode, step number, action execution record, set value change record, and control response log. The network domain data includes packet capture information, traffic session information, protocol interaction information, and communication relationship information.

[0007] In one embodiment of the present invention, the step of mapping the three-domain task-related objects in the time window data to a unified heterogeneous node set, and calculating the node-time window anomaly factor based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label, includes: The physical domain objects in the time window data are mapped to a set of physical domain nodes, the control domain objects in the time window data are mapped to a set of control domain nodes, and the network domain objects in the time window data are mapped to a set of network domain nodes. The physical domain node set, the control domain node set, and the network domain node set are merged into the unified heterogeneous node set; Based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label, the node-time window anomaly factor of each node within the unified time window is calculated.

[0008] In one embodiment of the present invention, the step of calculating the node-time window anomaly factor of each node within a unified time window based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label includes: Calculate the physical domain node anomaly factor corresponding to the physical domain node based on continuous process variable deviation, discrete state anomaly, and physical consistency anomaly. Calculate the control domain node anomaly factor based on control state anomaly, state transition anomaly, control action frequency anomaly, setpoint change anomaly, and control-physical response anomaly. Calculate the network domain node anomaly factor based on traffic scale anomaly, protocol structure anomaly, communication relationship anomaly, and stage-permitted communication relationship constraints. The node-time window anomaly factor is determined based on the physical domain node anomaly factor, the control domain node anomaly factor, and the network domain node anomaly factor.

[0009] In one embodiment of the present invention, the step of adaptive time retention and attenuation enhancement of outliers based on the node-time window anomaly factor to obtain time-enhanced outliers includes: The corresponding time retention length is determined based on the anomaly intensity of the node-time window anomaly factor in the historical time window; Based on the current time window and the time retention length, determine the effective historical time set corresponding to each node; The historical anomaly factors within the effective historical time set are time-decayed to obtain the decayed historical anomaly factors. The node-time window anomaly factor of the current time window is fused with the decayed historical anomaly factor to obtain the time-enhanced anomaly value.

[0010] In one embodiment of the present invention, the step of performing intra-domain spatial augmentation on the time-enhanced anomalies based on the spatial correlation within the domain to which each node belongs, to obtain intra-domain spatial augmented anomalies, includes: The physical domain spatial association is determined based on the process flow adjacency relationship between physical domain nodes, and the time-enhanced outliers of physical domain nodes are fused based on the physical domain spatial association to obtain the physical domain neighborhood fusion result. The spatial association relationship of the control domain is determined based on the control hierarchy dependency relationship between control domain nodes, and the neighborhood fusion of the time-enhanced outliers of the control domain nodes is performed based on the spatial association relationship of the control domain to obtain the neighborhood fusion result of the control domain. The spatial association relationship of the network domain is determined based on the communication topology adjacency relationship between network domain nodes, and the temporal enhancement anomalies of the network domain nodes are fused based on the spatial association relationship of the network domain to obtain the neighborhood fusion result of the network domain. Based on the neighborhood fusion results of the physical domain, the control domain, and the network domain, spatial augmentation anomalies within the domain are determined.

[0011] In one embodiment of the present invention, the step of constructing a network-control bridge and a control-physical bridge based on cross-domain association relationships, and determining the cross-domain support strength based on the intra-domain spatial augmentation anomaly, the network-control bridge, and the control-physical bridge, includes: The network-control bridge is constructed based on the communication access relationship, protocol interaction relationship, and task control relationship between network domain nodes and control domain nodes; The control-physical bridge is constructed based on the control action relationship, control loop relationship, and control response relationship between the control domain node and the physical domain node; Based on the intra-domain spatial augmentation anomalies of network domain nodes, the support strength of the network domain for the control domain nodes is determined through the network-control bridge. Based on the intradomain spatial augmentation anomalies of the control domain nodes, the support strength of the control domain for the physical domain nodes is determined through the control-physical bridge. The cross-domain support strength is defined as the support strength of the network domain for the control domain nodes and the support strength of the control domain for the physical domain nodes.

[0012] In one embodiment of the present invention, determining node-level risk based on the intra-domain spatial augmentation anomaly and the cross-domain support strength includes: By fusing the intra-domain spatial augmentation outliers of control domain nodes with the cross-domain support strength from the network domain, the node-level risk of control domain nodes is obtained. The node-level risk of a physical domain node is obtained by fusing the intra-domain spatial augmentation anomaly of a physical domain node with the cross-domain support strength from the control domain. Node-level risks of network domain nodes are determined based on intra-domain spatial augmentation anomalies of network domain nodes within the network domain. The node-level risk is determined based on the node-level risk of the control domain node, the node-level risk of the physical domain node, and the node-level risk of the network domain node.

[0013] In one embodiment of the present invention, determining the chain-level risk of a legitimate cross-domain chain composed of network domain nodes, control domain nodes, and physical domain nodes based on the node-level risk includes: If the network domain node and the control domain node satisfy the network-control bridge, and the control domain node and the physical domain node satisfy the control-physical bridge, a valid cross-domain chain composed of the network domain node, the control domain node, and the physical domain node is constructed. Calculate the consensus term of the legitimate cross-domain chain based on the node-level risks of network domain nodes, control domain nodes, and physical domain nodes on the legitimate cross-domain chain; The consensus term is integrated with the node-level risk on the legitimate cross-domain chain to obtain the chain-level risk.

[0014] Secondly, the present invention provides a task risk continuous analysis device for the Industrial Internet, comprising: The data acquisition module is used to collect task-related data in three domains during the execution of industrial tasks, align the task-related data in three domains according to a unified time window and label the task stages to obtain time window data with task stage labels; the task-related data in three domains includes physical domain data, control domain data and network domain data. An anomaly factor construction module is used to map the three-domain task-related objects in the time window data into a unified heterogeneous node set, and calculate the node-time window anomaly factor based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label. The time enhancement module is used to perform adaptive time retention and decay enhancement of outliers based on the node-time window anomaly factor to obtain time-enhanced outliers; The intra-domain spatial enhancement module is used to perform intra-domain spatial enhancement on the time-enhanced anomalies based on the spatial correlation within the domain to which each node belongs, thereby obtaining intra-domain spatial enhancement anomalies. The support strength determination module is used to construct network-control bridges and control-physical bridges based on cross-domain association relationships, and determine cross-domain support strength based on the spatial augmentation anomalies within the domain, the network-control bridges, and the control-physical bridges. The risk determination module is used to determine node-level risks based on the intra-domain spatial enhancement anomalies and the cross-domain support strength; and to determine chain-level risks for legitimate cross-domain chains composed of network domain nodes, control domain nodes, and physical domain nodes based on the node-level risks. The result determination module is used to determine the task risk analysis results based on the node-level risk and the chain-level risk.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention provides a method for continuous task risk analysis for the Industrial Internet. This method collects physical domain data, control domain data, and network domain data during the execution of industrial tasks. Data is aligned using a unified time window and labeled with task stages. Task-related objects from these three domains are mapped to a unified heterogeneous node set. A node-time window anomaly factor is calculated based on the domain to which each node belongs and the task stage label. Based on the node-time window anomaly factor, adaptive time retention and attenuation enhancement of outliers are performed to obtain time-enhanced anomalies. Based on the spatial relationships within each node's domain, intra-domain spatial enhancement is applied to the time-enhanced anomalies to obtain intra-domain spatial enhancement anomalies. Based on cross-domain relationships, network-control bridges and control-physical bridges are constructed, and cross-domain support strength is determined based on intra-domain spatial enhancement anomalies. Node-level risk is determined based on intra-domain spatial enhancement anomalies and cross-domain support strength. Chain-level risk is determined for legitimate cross-domain chains based on node-level risk. Finally, the task risk analysis result is determined based on node-level risk and chain-level risk. Therefore, it is possible to organize abnormal fragments scattered across multiple time windows into a continuous risk evolution process, enabling node risk judgment to integrate the impact of anomalies in the local and neighboring domains and achieve progressive support between the network domain, control domain, and physical domain through cross-domain bridges. Chain-level risk enhancement is performed on the case of weak anomalies of multiple nodes on a legitimate cross-domain chain, thereby improving the ability to continuously analyze, dynamically assess, and accurately determine risks throughout the entire industrial task process.

[0016] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] Figure 1 This is a schematic diagram illustrating the implementation process of a task risk continuous analysis method for the Industrial Internet provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a task risk continuous analysis device for the industrial internet provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the hardware entity of an electronic device to which embodiments of the present invention are applied. Detailed Implementation

[0018] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0019] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating the implementation process of a task risk continuous analysis method for the Industrial Internet provided by an embodiment of the present invention. Figure 1 As shown, the task risk continuous analysis method for the Industrial Internet provided in this embodiment of the invention may include the following steps: Step S101: Collect task-related data from the three domains during the execution of industrial tasks, align the task-related data from the three domains according to a unified time window and label the task stages to obtain time window data with task stage labels.

[0020] The data related to the three domain tasks include physical domain data, control domain data, and network domain data.

[0021] In one possible implementation, physical domain data, control domain data, and network domain data can be mapped to a unified time window set according to a unified time window length; based on task phase division information, the unified time windows in the unified time window set are labeled with task phases to obtain time window data with task phase labels.

[0022] The physical domain data includes sensor measurements, actuator operating status, equipment process measurement data, and process variables related to task execution results. The control domain data includes programmable logic controller (PLC) status, control mode, step number, action execution record, setpoint change record, parameter modification record, program switching record, and control response log. The network domain data includes packet capture information, traffic session information, protocol interaction information, communication relationship information, and access records related to industrial protocols.

[0023] For example, since there are differences in data sampling granularity and temporal precision in different domains, task-related data from the three domains can be uniformly mapped to a unified time window set. In the middle. Let the uniform time window length be... For any original timestamp Its corresponding time window can be represented as: ; This enables the alignment and synchronization of task-related data across the three domains on a unified time scale.

[0024] After time alignment is completed, each unified time window can be assigned a corresponding task stage label based on the task stage segmentation information during the industrial task execution process, denoted as: ; in, This indicates the task stage label. Normal behavior patterns, control action patterns, and communication patterns differ across stages. Therefore, the calculation of anomaly factors in subsequent domains can employ stage-conditional modeling to ensure that anomaly determination results are consistent with the task execution context.

[0025] Step S102: Map the three-domain task-related objects in the time window data to a unified heterogeneous node set, and calculate the node-time window anomaly factor based on the domain and task stage label of each node in the unified heterogeneous node set.

[0026] In one possible implementation, physical domain objects in the time window data can be mapped to a set of physical domain nodes, control domain objects in the time window data can be mapped to a set of control domain nodes, and network domain objects in the time window data can be mapped to a set of network domain nodes. The physical domain node set, control domain node set, and network domain node set are merged into a unified heterogeneous node set. The node-time window anomaly factor of each node within the unified time window is calculated based on the domain to which each node belongs and the task stage label in the unified heterogeneous node set.

[0027] In one possible implementation, the node-time window anomaly factor for each node within a unified time window is calculated based on the domain and task stage labels of each node in a unified heterogeneous node set. This includes: calculating the physical domain node anomaly factor for physical domain nodes based on deviations in continuous process variables, discrete state anomalies, and physical consistency anomalies; calculating the control domain node anomaly factor for control domain nodes based on control state anomalies, state transition anomalies, control action frequency anomalies, setpoint change anomalies, and control-physical response anomalies; calculating the network domain node anomaly factor for network domain nodes based on traffic scale anomalies, protocol structure anomalies, communication relationship anomalies, and stage-permitted communication relationship constraints; and determining the node-time window anomaly factor based on the physical domain node anomaly factor, control domain node anomaly factor, and network domain node anomaly factor.

[0028] For example, to achieve unified measurement and representation of data from different domains at the task level, objects participating in task execution in the three domains can be mapped to node sets respectively. The physical domain node set is denoted as... This includes sensor nodes, actuator nodes, equipment nodes, and process measurement point nodes; the set of control domain nodes is denoted as... This includes PLC nodes, control loop nodes, step unit nodes, and control status nodes; the set of network domain nodes is denoted as... This includes industrial host nodes, PLC network entity nodes, HMI nodes, engineering station nodes, historical station nodes, and task-related communication entity nodes. The unified heterogeneous node set is defined as... For any node Define its domain as This ensures that each node belongs only to its own domain. Task-related behaviors across the three domains can be uniformly represented as anomaly factors at the node-time window granularity (i.e., node-time window anomaly factors). For any domain... Nodes in Define its time window The original anomaly intensity on is This representation method allows time information to be transmitted through... Upon entering the model, spatial information is transmitted through nodes. This allows for the integration into the model, providing a unified foundation for subsequent spatiotemporal correlation analysis.

[0029] For physical domain data, this invention simultaneously considers continuous process variables, discrete state variables, and physical consistency relationships.

[0030] For continuous process variables, such as liquid level, flow rate, pressure, temperature, current, voltage, rotational speed, vibration, and concentration, this invention first performs resampling, missing value processing, and abnormal glitch cleaning, and then constructs original value features, first-order difference features, and window statistical features.

[0031] Specifically, for nodes Continuous features on The degree of deviation is calculated using a robust deviation method. ,Right now: ; in, Representation of features In the stage The normal reference median is below. This represents the corresponding robust scaling estimate, defined as: ; in, Indicates the absolute deviation of the median. The correction factor can be expressed as: ; in, The quantile function of the standard normal distribution. To prevent extremely small positive numbers with a denominator of zero.

[0032] Using the robust deviations described above, this invention calculates the original value deviation score, the difference deviation score, and the window statistical deviation score of continuous quantities, and then merges them.

[0033] For discrete state variables, such as pump start / stop states, valve on / off states, limit switch states, and binary alarm states, state probability modeling, switching behavior modeling, and dwell behavior modeling can be used. Specifically, for discrete state variables... In the stage The probability of its normal occurrence is statistically analyzed, and then an abnormal state score is defined. At the same time, the deviations between the number of state transitions and the current state dwell time within the statistical window and the normal reference are used to reflect the abnormal behavior of discrete states.

[0034] For physical consistency relationships, this invention constructs local consistency constraints between action-response or state-result. For example, after a control action occurs, the corresponding physical quantity should produce the expected response within a reasonable time delay; if the control action has been executed but the physical process does not change as expected, it is considered a consistency anomaly. This invention defines a consistency deviation score based on this type of relationship and incorporates it into the calculation of the physical domain anomaly factor.

[0035] Combining the above three types of information, physical domain nodes In the time window raw outlier scores Represented as: ; in, , , These represent the original value deviation, difference deviation, and window statistical deviation score of a continuous quantity, respectively. Represents the discrete state anomaly score. Indicates the score for physical consistency anomalies. The corresponding weights are then used. Further, the original anomaly scores are compressed and normalized to obtain the physical domain node anomaly factors. : ; For control domain data, this invention constructs control domain anomaly factors from aspects such as control state, state transition, control action, setpoint change, parameter / program event, and control-physical response relationship.

[0036] Specifically, for First, obtain its current state. The state at the previous moment Information such as the number of actions within the window, the magnitude of changes in set values, parameter modification events, and program switching events. In the stage... The normal occurrence probability of the current state is modeled to define the abnormal control state score. for: ; Simultaneously, the normal probability of state transitions is modeled, and an abnormal state transition score is defined. for: ; in, Indicates the mission phase The current state of the lower control domain node c is now visible. The normal probability, Indicates the mission phase The next state is from the previous state Transfer to current state The normal transition probability can be obtained by statistically analyzing the frequency of state occurrence and state transition in the normal operation sample. The lower the probability, the more the state or state transition deviates from the normal control behavior under the current stage, and therefore the higher the corresponding anomaly score. For control actions, setpoint changes, and parameter / program events, this invention statistically analyzes their deviation degree based on stage-conditional references. Among them, the action frequency can be characterized by the deviation between the number of actions within the window and the normal reference; the setpoint change can be characterized by the deviation between the current change amplitude and the normal reference; and parameter modification and program switching events can be treated separately as high-risk discrete anomalies with weighted analysis.

[0037] Regarding the control-physical response relationship, this invention further analyzes whether the relevant physical domain nodes generate a response within a reasonable time range after the control action is issued. If the actual response does not match the normal response delay or response amplitude, it is recorded as an abnormal control response.

[0038] Based on the above steps, control domain nodes can be defined. In the time window raw outlier scores for: ; in, This indicates an abnormal frequency of control actions. This indicates an abnormal change in the set value. This indicates an error in the parameter / program event. This indicates an abnormal control-physical response.

[0039] Further compression and normalization yield the control domain node anomaly factor. for: ; For network domain data, this invention constructs network domain anomaly factors from three levels: traffic scale, protocol structure, and communication relationship, and further introduces stage-conditional topology constraints.

[0040] For network domain nodes It can extract traffic scale features such as packet count, byte count, average packet length, packet rate, and byte rate from a unified time window; extract the proportion of various protocols, protocol entropy, and semantic features of industrial protocols to form protocol structure features; and combine communication edge, flow, and role relationships to extract communication relationship features such as the number of active neighbors, flow count, proportion of major communication flows, edge existence, edge frequency, and edge role relationships.

[0041] In the stage The present invention constructs node-level and edge-level reference models based on normal operation data. For node-level traffic scale characteristics and protocol structure characteristics, the deviations from normal references are calculated respectively; for edge-level relationship characteristics, it is first determined whether a certain edge is within the set of allowed communication relationships in the current stage. If it does not belong to the allowed set, it is recorded as an existence anomaly; secondly, it is determined whether the communication frequency deviates from the normal frequency of the edge in the current stage; and thirdly, it is determined whether the protocol composition and role relationships deviate from the normal mode.

[0042] Set up network domain nodes The abnormal traffic volume score is The protocol structure anomaly score is The edge relation anomaly score is Then network domain nodes In the time window raw outlier scores It can be represented as: ; in, For the corresponding weights.

[0043] Further compression and normalization yields the network domain node anomaly factor. for: ; Finally, a node-time window anomaly factor can be constructed based on the physical domain node anomaly factor, the control domain node anomaly factor, and the network domain node anomaly factor.

[0044] Step S103: Based on the node-time window anomaly factor, perform adaptive time retention and attenuation enhancement of outliers to obtain time-enhanced outliers.

[0045] In one possible implementation, the corresponding time retention length can be determined based on the anomalous intensity of the node-time window anomaly factor in the historical time window; the effective historical time set corresponding to each node can be determined based on the current time window and the time retention length; the historical anomaly factor within the effective historical time set can be time-attenuated to obtain the attenuated historical anomaly factor; and the node-time window anomaly factor of the current time window can be fused with the attenuated historical anomaly factor to obtain the time-enhanced anomaly value.

[0046] For example, in order to solve the problems of asynchronous occurrence of anomalies in different domains and the difficulty of historical anomalies in influencing subsequent judgments, this invention designs an anomaly value adaptive time retention and decay enhancement mechanism.

[0047] For domain Middle node In the time window Abnormal factors The present invention assigns a corresponding time retention length to each anomalous event based on its intensity: ; in, and These represent the minimum retention length and the maximum retention length, respectively. This represents the nonlinear adjustment parameter. Therefore, the larger the outlier, the longer its retention time; the smaller the outlier, the shorter its retention time.

[0048] For the current time window This invention defines nodes In the domain The effective historical time set is: ; And the decayed historical anomaly factor is calculated based on the exponential decay method. for: ; This design allows high-intensity anomalies from the previous moment or even earlier to retain some influence in the current time window, thus characterizing the persistence and cross-domain asynchronous propagation of anomalies during the execution of industrial tasks.

[0049] Step S104: Based on the spatial correlation within the domain of each node, perform intra-domain spatial augmentation on the time-augmented outliers to obtain intra-domain spatial augmented outliers.

[0050] In one possible implementation, physical domain spatial relationships can be determined based on the process flow adjacency relationships between physical domain nodes, and time-enhanced outliers of physical domain nodes can be fused into neighborhoods based on these relationships to obtain a neighborhood fusion result for the physical domain. Similarly, control domain spatial relationships can be determined based on the control hierarchy dependencies between control domain nodes, and time-enhanced outliers of control domain nodes can be fused into neighborhoods based on these relationships to obtain a neighborhood fusion result for the control domain. Furthermore, network domain spatial relationships can be determined based on the communication topology adjacency relationships between network domain nodes, and time-enhanced outliers of network domain nodes can be fused into neighborhoods based on these relationships to obtain a neighborhood fusion result for the network domain. Finally, based on the neighborhood fusion results for the physical domain, control domain, and network domain, intra-domain spatial enhancement outliers can be determined.

[0051] For example, to enhance the local risk perception capability of nodes in this domain, intra-domain spatial enhancement mechanisms can be constructed for the physical domain, control domain, and network domain respectively.

[0052] Among them, the spatial augmentation anomaly value within the domain is a set of neighborhood fusion results from the physical domain, the control domain, and the network domain.

[0053] In the physical domain, the process flow distance between nodes is defined. Based on this, physical domain spatial weights are constructed. for: ; in, Represents the physical domain spatial attenuation coefficient. Physical domain spatial weights. This describes the degree of influence of adjacent process nodes on the anomaly determination of the current physical domain node in the process flow.

[0054] In the control domain, define the control hierarchy distance between control domain nodes. Construct control domain spatial weights : ; in, This represents the control domain space attenuation coefficient, used to characterize the influence of neighboring nodes on the anomaly determination of the current control domain node in the upper and lower control relationships.

[0055] In a network domain, the number of communication topology hops between network domain nodes is defined. And, in conjunction with the communication relationships allowed at the current stage, construct network domain spatial weights. : ; in, Represents the network domain spatial attenuation coefficient. For indicator functions, Representation phase The set of allowed communication edges.

[0056] Furthermore, for any field Nodes in Based on the set of neighboring nodes of its domain, define the spatial augmentation anomaly within the domain. for: ; in, Representation domain The set of nodes, This represents the spatial weight within the domain at the current stage, and the spatial augmentation outliers within the domain. This includes the neighborhood fusion results of the physical domain, the control domain, and the network domain. For physical domain nodes, the spatial augmentation anomalies within their domain are the neighborhood fusion results of the physical domain; for control domain nodes, the spatial augmentation anomalies within their domain are the neighborhood fusion results of the control domain; and for network domain nodes, the spatial augmentation anomalies within their domain are the neighborhood fusion results of the network domain.

[0057] According to the above implementation method, when there is a high-intensity anomaly in the neighborhood of a node, the anomaly in its neighborhood will enhance the local risk assessment of the current node; however, this enhancement only occurs within the current neighborhood and does not mean that a node has anomalies in three neighborhoods at the same time.

[0058] Step S105: Construct network-control bridges and control-physical bridges based on cross-domain association relationships, and determine cross-domain support strength based on intra-domain spatial augmentation anomalies, network-control bridges, and control-physical bridges.

[0059] In one possible implementation, a network-control bridge can be constructed based on the communication access relationship, protocol interaction relationship, and task control relationship between network domain nodes and control domain nodes; a control-physical bridge can be constructed based on the control action relationship, control loop relationship, and control response relationship between control domain nodes and physical domain nodes; the support strength of the network domain for the control domain nodes can be determined through the network-control bridge based on the intra-domain spatial augmentation anomalies of the network domain nodes; the support strength of the control domain for the physical domain nodes can be determined through the control-physical bridge based on the intra-domain spatial augmentation anomalies of the control domain nodes; and the support strength of the network domain for the control domain nodes and the support strength of the control domain for the physical domain nodes can be used as the cross-domain support strength.

[0060] For example, after completing intra-domain temporal and spatial augmentations, a cross-domain support delivery mechanism can be introduced to uniformly express the structured relationships between the physical domain, control domain, and network domain. This cross-domain support delivery mechanism does not simply superimpose anomalies of a single node in different domains, but rather establishes a cross-domain bridge through the control domain, allowing anomalies in one domain to serve as supporting evidence influencing the risk assessment of relevant nodes in another domain.

[0061] Network-control bridges can be defined. for: ; Then network domain pairs Support strength Defined as: ; in, Enhance outliers within the domain space of network domain nodes.

[0062] Control-physical bridges can be defined. for: ; Then the control domain to the physical domain nodes Support strength Defined as: ; in, To enhance the spatial outlier values ​​within the control domain nodes.

[0063] Therefore, network domain anomalies can be supported by the network-control bridge to support the risk assessment of relevant control domain nodes, and control domain anomalies can be supported by the control-physical bridge to support the risk assessment of relevant physical domain nodes, thus forming a cross-domain support transmission path that conforms to the execution logic of industrial tasks.

[0064] Step S106: Determine node-level risks based on intra-domain spatial augmentation outliers and cross-domain support strength.

[0065] In one possible implementation, the node-level risk of a control domain node can be obtained by fusing the intra-domain spatial augmentation anomalies of a control domain node with the cross-domain support strength from the network domain; the node-level risk of a physical domain node can be obtained by fusing the intra-domain spatial augmentation anomalies of a physical domain node with the cross-domain support strength from the control domain; the node-level risk of a network domain node can be determined based on the intra-domain spatial augmentation anomalies of a network domain node; and the node-level risk can be determined based on the node-level risks of the control domain node, the physical domain node, and the network domain node.

[0066] For example, at the node level, the principle of risk assessment within the domain of a node can be referenced. That is, the risk of each node is first determined by the spatiotemporal augmentation anomalies in its own domain, and then supplemented and enhanced by supporting evidence transmitted from other domains through bridges.

[0067] Control domain node Node-level risks Defined as: ; in, This indicates an in-domain spatial augmentation outlier for a control domain node within the control domain. Indicates the strength of cross-domain support from the network domain. and These are the corresponding weights.

[0068] Physical domain node Node-level risks Defined as: ; in, This represents an in-domain spatial augmentation anomaly of a physical domain node within the physical domain. Indicates the strength of cross-domain support from the control domain. and These are the corresponding weights.

[0069] For network domain nodes Its node-level risk is mainly determined by the intra-domain spatial augmentation anomalies of network domain nodes in the network domain. It can also be further extended by introducing reverse support terms from the control domain according to actual needs.

[0070] The above implementation method can realize a node-level risk judgment mechanism with local anomalies as the core and cross-domain support as a supplement, thereby avoiding the semantic confusion caused by simple splicing of cross-domain features.

[0071] Step S107: Determine the chain-level risk for a legitimate cross-domain chain composed of network domain nodes, control domain nodes, and physical domain nodes based on node-level risk.

[0072] In one possible implementation, a legitimate cross-domain chain composed of network domain nodes, control domain nodes, and physical domain nodes can be constructed, provided that network domain nodes and control domain nodes satisfy a network-control bridge and control domain nodes and physical domain nodes satisfy a control-physical bridge. Based on the node-level risks of network domain nodes, control domain nodes, and physical domain nodes on the legitimate cross-domain chain, a consensus term of the legitimate cross-domain chain is calculated. The consensus term is then fused with the node-level risks on the legitimate cross-domain chain to obtain the chain-level risk.

[0073] For example, in order to further identify potential risks that are scattered across multiple nodes and domains during the execution of industrial tasks but co-evolve along legitimate propagation paths, this invention constructs a consensus enhancement mechanism on legitimate cross-domain chains based on node-level determination.

[0074] set up A valid cross-domain chain is defined as follows: ; Network domain nodes Capable of supporting via network-control bridge , Able to support physical domain nodes through control-physical bridge Based on this, the time window for defining this legitimate cross-domain chain is determined. consensus items for: ; The consensus term of this legitimate cross-domain chain is used to characterize the situation where network domain nodes, control domain nodes, and physical domain nodes simultaneously exhibit weak anomalies and converge in a consistent manner on the same legitimate chain. When the anomalies of the three nodes do not individually reach strong out-of-bounds limits, but are simultaneously approaching dangerous boundaries on the same chain, the consensus term can effectively enhance the representation of chain-level risks.

[0075] Furthermore, chain-level risk is defined as: ; in, For the corresponding weights.

[0076] Through the above implementation method, based on node-level risk assessment, the consistency of risk among multiple nodes on legitimate cross-domain chains can be enhanced, thereby supporting continuous correlation analysis of abnormal propagation paths and evolution trends.

[0077] Step S108: Determine the task risk analysis results based on node-level risk and chain-level risk.

[0078] The task risk analysis results include node-level risk and chain-level risk.

[0079] It should be noted that node-level risk results are used to characterize the local risk status of a single node in the current time window during the execution of industrial tasks, and are suitable for locating high-risk equipment, high-risk control units, and high-risk communication entities; chain-level risk results are used to characterize the overall risk status on legitimate cross-domain chains, and are suitable for identifying risk propagation paths and their evolution trends that span the network domain, control domain, and physical domain.

[0080] By combining node-level and chain-level risks, it is possible to continuously analyze, dynamically assess, and accurately determine the risk status throughout the entire process of industrial task execution, thereby providing technical support for subsequent risk management, anomaly interpretation, and security protection.

[0081] The present invention provides a method for continuous task risk analysis for the Industrial Internet. This method collects physical domain data, control domain data, and network domain data during the execution of industrial tasks. Data is aligned using a unified time window and labeled with task stages. Task-related objects from these three domains are mapped to a unified heterogeneous node set. A node-time window anomaly factor is calculated based on the domain to which each node belongs and the task stage label. Based on the node-time window anomaly factor, adaptive time retention and attenuation enhancement of outliers are performed to obtain time-enhanced anomalies. Based on the spatial relationships within each node's domain, intra-domain spatial enhancement is applied to the time-enhanced anomalies to obtain intra-domain spatial enhancement anomalies. Based on cross-domain relationships, network-control bridges and control-physical bridges are constructed, and cross-domain support strength is determined based on intra-domain spatial enhancement anomalies. Node-level risk is determined based on intra-domain spatial enhancement anomalies and cross-domain support strength. Chain-level risk is determined for legitimate cross-domain chains based on node-level risk. Finally, the task risk analysis result is determined based on node-level risk and chain-level risk. Therefore, it is possible to organize abnormal fragments scattered across multiple time windows into a continuous risk evolution process, enabling node risk judgment to integrate the impact of anomalies in the local and neighboring domains and achieve progressive support between the network domain, control domain, and physical domain through cross-domain bridges. Chain-level risk enhancement is performed on the case of weak anomalies of multiple nodes on a legitimate cross-domain chain, thereby improving the ability to continuously analyze, dynamically assess, and accurately determine risks throughout the entire industrial task process.

[0082] Please see Figure 2, Figure 2 This is a schematic diagram of a task risk continuous analysis device for the Industrial Internet provided in an embodiment of the present invention. The task risk continuous analysis device for the Industrial Internet provided by the present invention includes a data acquisition module 201, an anomaly factor construction module 202, a time enhancement module 203, a domain spatial enhancement module 204, a support strength determination module 205, a risk determination module 206, and a result determination module 207.

[0083] The data acquisition module 201 is used to collect task-related data in three domains during the execution of industrial tasks, align the task-related data in three domains according to a unified time window and label the task stages to obtain time window data with task stage labels; the task-related data in three domains includes physical domain data, control domain data and network domain data. Anomaly factor construction module 202 is used to map three-domain task-related objects in time window data to a unified heterogeneous node set, and calculate node-time window anomaly factor based on the domain and task stage label of each node in the unified heterogeneous node set. The time enhancement module 203 is used to perform adaptive time preservation and decay enhancement of outliers based on node-time window outlier factors to obtain time-enhanced outliers; The intra-domain spatial enhancement module 204 is used to perform intra-domain spatial enhancement on time-enhanced anomalies based on the spatial association relationship within the domain to which each node belongs, and to obtain intra-domain spatial enhancement anomalies. The support strength determination module 205 is used to construct network-control bridges and control-physical bridges based on cross-domain association relationships, and to determine cross-domain support strength based on intra-domain spatial augmentation anomalies, network-control bridges, and control-physical bridges. The risk determination module 206 is used to determine node-level risks based on intra-domain spatial augmentation outliers and cross-domain support strength; and to determine chain-level risks for legitimate cross-domain chains composed of network domain nodes, control domain nodes, and physical domain nodes based on node-level risks. The result determination module 207 is used to determine the task risk analysis results based on node-level risk and chain-level risk.

[0084] Please see Figure 3 , Figure 3 This is a schematic diagram of the hardware entity of an electronic device to which an embodiment of the present invention applies. The electronic device provided in this embodiment includes a processor 301, a communication interface 302, a memory 303, and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other via the communication bus 304. Memory 303 is used to store computer programs; When the processor 301 executes the program stored in the memory 303, it implements the steps in the above method embodiments.

[0085] The communication bus 304 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 304 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0086] Communication interface 302 is used for communication between the above-mentioned electronic device and other devices.

[0087] The memory 303 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory 303 may also be at least one storage device located remotely from the aforementioned processor.

[0088] The processor 301 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0089] The method provided in this invention can be applied to electronic devices. Specifically, the electronic device can be a desktop computer, a portable computer, a smart mobile terminal, a server, etc. No limitation is made herein; any electronic device that can implement this invention falls within the protection scope of this invention.

[0090] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps provided in the above-described method embodiments.

[0091] For the embodiments of the device / electronic device / storage medium, since they are basically similar to the method embodiments, the description is relatively simple. For specific details and beneficial effects, please refer to the description of the method embodiments.

[0092] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0093] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0094] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus (devices), or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects, all of which are collectively referred to herein as "modules" or "systems." Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The computer program may be stored / distributed in a suitable medium, provided with or as part of other hardware, or may take other distribution forms, such as via the Internet or other wired or wireless telecommunications systems.

[0095] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0096] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0098] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for continuous analysis of task risks in the Industrial Internet, characterized in that, include: Collect task-related data from three domains during the execution of industrial tasks, align the task-related data from the three domains according to a unified time window and label the task stages to obtain time window data with task stage labels; the task-related data from the three domains includes physical domain data, control domain data and network domain data. The three-domain task-related objects in the time window data are mapped to a unified heterogeneous node set, and the node-time window anomaly factor is calculated based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label. Based on the node-time window anomaly factor, adaptive time retention and attenuation enhancement of outliers are performed to obtain time-enhanced outliers; Based on the spatial correlation within the domain to which each node belongs, the time-enhanced anomalies are spatially enhanced within the domain to obtain spatially enhanced anomalies within the domain. Based on cross-domain association, network-control bridges and control-physical bridges are constructed, and cross-domain support strength is determined according to the spatial augmentation anomalies within the domain, the network-control bridges, and the control-physical bridges. Node-level risks are determined based on the intra-domain spatial augmentation anomalies and the cross-domain support strength. Based on the node-level risks, chain-level risks are determined for legitimate cross-domain chains composed of network domain nodes, control domain nodes, and physical domain nodes. The task risk analysis results are determined based on the node-level risk and the chain-level risk.

2. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The step of aligning the three-domain task-related data according to a unified time window and labeling the task stages to obtain time window data with task stage labels includes: The physical domain data, the control domain data, and the network domain data are mapped to a unified time window set according to a unified time window length. Based on the task phase division information, the unified time windows in the unified time window set are labeled with task phases to obtain the time window data with task phase labels. The physical domain data includes sensor measurements, actuator operating status, equipment process measurement point data, and process variables. The control domain data includes PLC status, control mode, step number, action execution record, set value change record, and control response log. The network domain data includes packet capture information, traffic session information, protocol interaction information, and communication relationship information.

3. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The step of mapping the three-domain task-related objects in the time window data to a unified heterogeneous node set, and calculating the node-time window anomaly factor based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label, includes: The physical domain objects in the time window data are mapped to a set of physical domain nodes, the control domain objects in the time window data are mapped to a set of control domain nodes, and the network domain objects in the time window data are mapped to a set of network domain nodes. The physical domain node set, the control domain node set, and the network domain node set are merged into the unified heterogeneous node set; Based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label, the node-time window anomaly factor of each node within the unified time window is calculated.

4. The method for continuous analysis of task risks for the Industrial Internet according to claim 3, characterized in that, The calculation of the node-time window anomaly factor for each node within a unified time window, based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label, includes: Calculate the physical domain node anomaly factor corresponding to the physical domain node based on continuous process variable deviation, discrete state anomaly, and physical consistency anomaly. Calculate the control domain node anomaly factor based on control state anomaly, state transition anomaly, control action frequency anomaly, setpoint change anomaly, and control-physical response anomaly. Calculate the network domain node anomaly factor based on traffic scale anomaly, protocol structure anomaly, communication relationship anomaly, and stage-permitted communication relationship constraints. The node-time window anomaly factor is determined based on the physical domain node anomaly factor, the control domain node anomaly factor, and the network domain node anomaly factor.

5. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The process of adaptive time retention and attenuation enhancement of outliers based on the node-time window anomaly factor, resulting in time-enhanced outliers, includes: The corresponding time retention length is determined based on the anomaly intensity of the node-time window anomaly factor in the historical time window; Based on the current time window and the time retention length, determine the effective historical time set corresponding to each node; The historical anomaly factors within the effective historical time set are time-decayed to obtain the decayed historical anomaly factors. The node-time window anomaly factor of the current time window is fused with the decayed historical anomaly factor to obtain the time-enhanced anomaly value.

6. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The process of performing intra-domain spatial augmentation on the time-augmented anomalies based on the spatial correlation within the domain of each node, resulting in intra-domain spatial augmented anomalies, includes: The physical domain spatial association is determined based on the process flow adjacency relationship between physical domain nodes, and the time-enhanced outliers of physical domain nodes are fused based on the physical domain spatial association to obtain the physical domain neighborhood fusion result. The spatial association relationship of the control domain is determined based on the control hierarchy dependency relationship between control domain nodes, and the neighborhood fusion of the time-enhanced outliers of the control domain nodes is performed based on the spatial association relationship of the control domain to obtain the neighborhood fusion result of the control domain. The spatial association relationship of the network domain is determined based on the communication topology adjacency relationship between network domain nodes, and the temporal enhancement anomalies of the network domain nodes are fused based on the spatial association relationship of the network domain to obtain the neighborhood fusion result of the network domain. Based on the neighborhood fusion results of the physical domain, the control domain, and the network domain, spatial augmentation anomalies within the domain are determined.

7. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The construction of network-control bridges and control-physical bridges based on cross-domain association relationships, and the determination of cross-domain support strength based on the intra-domain spatial augmentation anomalies, the network-control bridges, and the control-physical bridges, includes: The network-control bridge is constructed based on the communication access relationship, protocol interaction relationship, and task control relationship between network domain nodes and control domain nodes; The control-physical bridge is constructed based on the control action relationship, control loop relationship, and control response relationship between the control domain node and the physical domain node; Based on the intra-domain spatial augmentation anomalies of network domain nodes, the support strength of the network domain for the control domain nodes is determined through the network-control bridge. Based on the intradomain spatial augmentation anomalies of the control domain nodes, the support strength of the control domain for the physical domain nodes is determined through the control-physical bridge. The cross-domain support strength is defined as the support strength of the network domain for the control domain nodes and the support strength of the control domain for the physical domain nodes.

8. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The determination of node-level risk based on the intra-domain spatial augmentation anomalies and the cross-domain support strength includes: By fusing the intra-domain spatial augmentation outliers of control domain nodes with the cross-domain support strength from the network domain, the node-level risk of control domain nodes is obtained. The node-level risk of a physical domain node is obtained by fusing the intra-domain spatial augmentation anomaly of a physical domain node with the cross-domain support strength from the control domain. Node-level risks of network domain nodes are determined based on intra-domain spatial augmentation anomalies of network domain nodes within the network domain. The node-level risk is determined based on the node-level risk of the control domain node, the node-level risk of the physical domain node, and the node-level risk of the network domain node.

9. The method for continuous analysis of task risks for the Industrial Internet according to claim 1, characterized in that, The determination of chain-level risk for a legitimate cross-domain chain composed of network domain nodes, control domain nodes, and physical domain nodes based on the node-level risk includes: If the network domain node and the control domain node satisfy the network-control bridge, and the control domain node and the physical domain node satisfy the control-physical bridge, a valid cross-domain chain composed of the network domain node, the control domain node, and the physical domain node is constructed. Calculate the consensus term of the legitimate cross-domain chain based on the node-level risks of network domain nodes, control domain nodes, and physical domain nodes on the legitimate cross-domain chain; The consensus term is integrated with the node-level risk on the legitimate cross-domain chain to obtain the chain-level risk.

10. A task risk continuous analysis device for the Industrial Internet, characterized in that, include: The data acquisition module is used to collect task-related data in three domains during the execution of industrial tasks, align the task-related data in three domains according to a unified time window and label the task stages to obtain time window data with task stage labels; the task-related data in three domains includes physical domain data, control domain data and network domain data. An anomaly factor construction module is used to map the three-domain task-related objects in the time window data into a unified heterogeneous node set, and calculate the node-time window anomaly factor based on the domain to which each node belongs in the unified heterogeneous node set and the task stage label. The time enhancement module is used to perform adaptive time retention and decay enhancement of outliers based on the node-time window anomaly factor to obtain time-enhanced outliers; The intra-domain spatial enhancement module is used to perform intra-domain spatial enhancement on the time-enhanced anomalies based on the spatial correlation within the domain to which each node belongs, thereby obtaining intra-domain spatial enhancement anomalies. The support strength determination module is used to construct network-control bridges and control-physical bridges based on cross-domain association relationships, and determine cross-domain support strength based on the spatial augmentation anomalies within the domain, the network-control bridges, and the control-physical bridges. The risk determination module is used to determine node-level risks based on the intra-domain spatial augmentation anomalies and the cross-domain support strength. Based on the node-level risks, chain-level risks are determined for legitimate cross-domain chains composed of network domain nodes, control domain nodes, and physical domain nodes. The result determination module is used to determine the task risk analysis results based on the node-level risk and the chain-level risk.

Images