An industrial internet information security monitoring system based on digital twinning

Abstract

The application discloses an industrial internet information security monitoring system based on digital twinning, and belongs to the technical field of industrial internet information security, and comprises the following steps: acquiring data of the industrial internet, constructing a digital twinning model, collecting safety monitoring data in real time, constructing a physical network event knowledge graph, performing semantic mapping on the safety monitoring data through the physical network event knowledge graph, injecting the digital twinning model for dynamic updating, obtaining an evolved dynamic digital twinning model, identifying a current safety situation based on the safety monitoring data, performing prospective safety simulation deduction on the dynamic digital twinning model, obtaining a risk prediction result, generating a monitoring strategy adjustment instruction according to the risk prediction result and executing the monitoring strategy adjustment instruction, and reporting and warning an abnormality captured in the industrial internet; the application realizes prediction of safety risks, adaptively adjusts the frequency and granularity of each monitoring node, and improves the utilization rate of safety monitoring resources and the monitoring accuracy.

Description

Technical Field

[0001] This invention relates to the field of industrial internet information security technology, specifically to an industrial internet information security monitoring system based on digital twins. Background Technology

[0002] The Industrial Internet is a new type of infrastructure and application model that deeply integrates next-generation information and communication technologies with the industrial economy. It achieves comprehensive connectivity and collaboration among people, machines, things, and systems through the comprehensive interconnection of industrial equipment, control systems, information systems, and the internet. The Industrial Internet tightly couples physical production space with cyberspace, significantly improving industrial production efficiency while also exposing industrial control systems to a more complex and open network environment.

[0003] First, there is the disconnect between physical and cybersecurity incidents. Traditional security monitoring systems typically rely on network traffic analysis and intrusion detection, focusing on anomaly detection in cyberspace while neglecting physical data such as device operating status and industrial control commands. Existing systems lack the ability to systematically correlate physical and cybersecurity incidents, making it difficult to effectively detect a large number of complex attacks that cross physical and network domains.

[0004] Secondly, static monitoring models struggle to address dynamic threats. Existing security monitoring systems typically rely on predefined rule bases or statically trained detection models for threat identification, lacking the ability to dynamically evolve with the operational status of the Industrial Internet. When equipment configurations change, network topology is adjusted, or new attack methods emerge, the detection accuracy of static models drops significantly, resulting in numerous false negatives and missed positives.

[0005] Third, the allocation of security monitoring resources lacks adaptive adjustment capabilities. Existing systems adopt a uniform monitoring strategy for all nodes in the industrial internet, which cannot dynamically adjust monitoring resources according to the spatial distribution of the current security situation. This results in insufficient monitoring in high-risk areas and waste of resources in low-risk areas, leading to low overall monitoring efficiency.

[0006] Fourth, there is a lack of forward-looking security risk prediction capabilities. Existing security monitoring systems mainly rely on post-incident detection and alerts, lacking predictive analysis methods for the propagation paths and potential impact range of attacks, making it difficult to take effective preventive measures before security incidents spread.

[0007] Based on this, the present invention designs an industrial internet information security monitoring system based on digital twins to solve the above problems. Summary of the Invention

[0008] In view of the above-mentioned shortcomings of the existing technology, the present invention provides an industrial internet information security monitoring system based on digital twins.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] An industrial internet information security monitoring system based on digital twins, the system comprising a digital twin construction module, a data monitoring module, an IoT event correlation module, a dynamic evolution module, a simulation and deduction module, and an anomaly alarm module, wherein:

[0011] The digital twin construction module is used to acquire physical entity data and network data from the Industrial Internet to construct a digital twin model.

[0012] The data monitoring module is used to collect safety monitoring data in real time. The safety monitoring data includes equipment operating status time-series data, network traffic data, control command data, and physical environment parameter data.

[0013] The IoT event association module is used to construct an IoT event knowledge graph that connects physical space security events with cyberspace security events.

[0014] The dynamic evolution module is used to semantically map security monitoring data through the Internet of Things event knowledge graph, inject it into the digital twin model for dynamic updates, and obtain the evolved dynamic digital twin model.

[0015] The simulation and deduction module is used to identify the current security situation based on security monitoring data, and to perform forward-looking security simulation and deduction on the dynamic digital twin model based on the current security situation to obtain risk prediction results;

[0016] The anomaly alarm module is used to generate and execute monitoring strategy adjustment instructions based on risk prediction results, and to report and warn of anomalies captured in the industrial internet.

[0017] Furthermore, acquire physical entity configuration information, equipment operating parameters, network topology, and historical security event data from the Industrial Internet. Based on the acquired data, construct a digital twin model encompassing the physical layer, network layer, control layer, and application layer, including:

[0018] Based on the physical entity configuration information, construct the device geometric model and physical attribute model as the physical layer digital twin base;

[0019] Based on the network topology, construct the network connection model and communication protocol model of the Industrial Internet as the digital twin foundation of the network layer;

[0020] Based on the equipment operating parameters, construct the equipment control logic model and the industrial control protocol behavior model as the digital twin foundation of the control layer;

[0021] Security threat models and vulnerability analysis models are built based on historical security incident data, serving as the foundation for application-layer digital twins.

[0022] Furthermore, based on the physical device distribution and network architecture of the Industrial Internet, the deployment locations of monitoring probes are determined, including device-embedded probes, edge gateway probes, and control center probes.

[0023] Each monitoring probe collects time-series data on the operating status of the equipment, network traffic data, control command data, and physical environment parameter data. The collected data is timestamped and preprocessed to obtain preprocessed real-time safety monitoring data.

[0024] Furthermore, entity recognition and relationship extraction are performed on the physical layer data in the real-time security monitoring data to obtain physical layer semantic annotation data;

[0025] Entity recognition and relation extraction are performed on network layer data and control layer data in real-time security monitoring data to obtain network layer semantic annotation data.

[0026] Semantic mapping and alignment are performed between the physical layer semantic annotation data and the network layer semantic annotation data to obtain the Internet of Things event knowledge graph.

[0027] Injecting the IoT event knowledge graph into the digital twin model drives the updating of model parameters and structure at the corresponding level.

[0028] Furthermore, the Industrial Internet ontology includes a set of entity types and a set of relationship types. The set of entity types includes device entities, network entities, protocol entities, vulnerability entities, attack mode entities, and security measure entities. The set of relationship types includes dependency relationships, association relationships, triggering relationships, and mitigation relationships.

[0029] Furthermore, based on real-time security monitoring data, current security events and abnormal states are identified, and each monitoring node is evaluated to obtain the abnormality type identifier and abnormality level of each node;

[0030] The abnormal status identifier, abnormal type identifier, abnormal severity level, and abnormal spatial distribution information of each monitoring node are vector-encoded and output as the current security situation vector.

[0031] Furthermore, the current security situation vector is input into the dynamic digital twin model to simulate the propagation process of several attack paths in the dynamic digital twin model. Based on the risk propagation trajectory of each preset attack path, the security risk probability and risk level of each monitoring node within the future time window are predicted, and the risk prediction results are output.

[0032] Furthermore, based on the risk prediction results, monitoring nodes with a safety risk probability exceeding the first threshold are marked as high-risk monitoring nodes, and monitoring nodes with a safety risk probability below the second threshold are marked as low-risk monitoring nodes.

[0033] For high-risk monitoring nodes, generate the first adjustment instruction to increase the monitoring frequency and refine the monitoring granularity;

[0034] For medium-risk monitoring nodes, a second adjustment instruction with a higher monitoring frequency and more granular monitoring is generated;

[0035] For low-risk monitoring nodes, a third adjustment instruction is generated to reduce the monitoring frequency and coarsen the monitoring granularity;

[0036] The device identifiers and network location identifiers of high-risk monitoring nodes are used as identifiers for key monitoring areas, and together with the first adjustment instruction, the second adjustment instruction, and the third adjustment instruction, they form the monitoring strategy adjustment instruction.

[0037] Furthermore, the monitoring strategy adjustment command is sent to each monitoring probe in the distributed security monitoring probe network;

[0038] Each monitoring probe parses the monitoring strategy adjustment instructions and extracts the monitoring frequency adjustment parameters, monitoring granularity adjustment parameters, and key monitoring area identifiers corresponding to its own deployment location;

[0039] If the monitoring probe is deployed within the area indicated by the key monitoring area marker, the monitoring probe will increase the monitoring frequency and refine the monitoring granularity according to the first adjustment instruction;

[0040] If the monitoring probe is deployed at the edge of the area indicated by the key monitoring area marker, the monitoring probe will slightly increase the monitoring frequency and slightly refine the monitoring granularity according to the second adjustment instruction;

[0041] If the deployment location of the monitoring probe is not within the area indicated by the key monitoring area marker, the monitoring probe shall reduce the monitoring frequency and coarsen the monitoring granularity in accordance with the third adjustment instruction;

[0042] Each monitoring probe restarts collecting safety monitoring data according to the adjusted monitoring frequency and granularity, forming a closed-loop iteration.

[0043] Furthermore, after each closed-loop iteration, the newly identified security event types, newly discovered security event relationships, and data that contradict the IoT event knowledge graph are used as knowledge graph update data. Based on the knowledge graph update data, knowledge conflicts are resolved, and incremental updates of the IoT event knowledge graph are achieved.

[0044] Compared with the prior art, the beneficial effects of this invention are as follows:

[0045] By constructing a knowledge graph model of Internet of Things (IoT) events based on physical and cyberspace security events, the system overcomes the blind spots of existing monitoring systems in the face of physical-cyber composite attacks, thus improving the detection coverage of security threats to the Industrial Internet. By continuously injecting real-time collected security monitoring data into a digital twin model, and simulating attack paths on the dynamic digital twin model, the system achieves forward-looking prediction of security risks within future time windows. Based on the risk prediction results, the system adaptively adjusts the monitoring frequency and granularity of each monitoring node, achieving efficient allocation of security monitoring resources and effectively avoiding resource waste. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0047] Figure 1 This is an architecture diagram of an industrial internet information security monitoring system based on digital twins according to the present invention.

[0048] Figure 2 This is a flowchart of an industrial internet information security monitoring system based on digital twins according to the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Example 1: Figure 1 This invention provides an industrial internet information security monitoring system based on digital twins. The method executed by this system includes the following steps:

[0051] Step S1: Acquire physical entity data and network data of the Industrial Internet and construct a digital twin model.

[0052] Step S1 includes the following steps:

[0053] The digital twin building module acquires physical entity configuration information, equipment operating parameters, network topology and historical security event data of the Industrial Internet, and simultaneously extracts cross-layer dependencies between the four layers. Using the above data as input, it constructs a four-layer digital twin model including the physical layer, network layer, control layer and application layer.

[0054] Based on the physical entity configuration information, geometric models and physical attribute models of various equipment in the industrial site are constructed as the physical layer digital twin foundation. The physical layer digital twin foundation describes the physical attributes of the equipment, such as spatial location, geometry, mass, and temperature tolerance range, establishing the static physical topology of the industrial site. The physical attribute model can be represented as:

[0055]

[0056] in, Represents the physical layer digital twin substrate, Indicates the first Device identifier for physical equipment. Indicates the first The geometric attribute vector of the device. Indicates the first The physical attribute vector of the equipment (including upper and lower limits of operating parameters such as rated power, operating temperature range, and rated speed). This represents the total number of physical devices in the Industrial Internet.

[0057] Indicates the first The geometric attribute vector of the device includes the device type, spatial coordinates, and dimensional parameters. Indicates the first The physical attribute vector of the equipment includes the upper and lower limits of operating parameters such as rated power, operating temperature range, and rated speed.

[0058] Based on the network topology, a network connection model and communication protocol model for the Industrial Internet are constructed as the foundation for the network layer digital twin. The network connection model describes the logical connection relationships between nodes and is represented using a directed graph:

[0059]

[0060] in, A network topology diagram representing the digital twin substrate of the network layer. Represents a set of network nodes. Represents the set of network edges. This represents the attribute weight matrix for each communication link.

[0061] This represents a set of network nodes, including various network entities such as industrial controllers, sensors, actuators, gateways, and switches. Let the set of network edges be represented, where each directed edge is a given edge. Indicates from node To the node There is a communication link. This represents the attribute weight matrix for each communication link, including parameters such as link bandwidth, transmission delay, and communication protocol type.

[0062] Based on equipment operating parameters, a device control logic model and an industrial control protocol behavior model are constructed as the foundation for the control layer digital twin. The control layer digital twin foundation describes the logical state transition relationships of each controller in the industrial control system and the instruction interaction specifications between them and the actuators, characterizing the control behavior benchmark under normal operating conditions.

[0063] Based on historical security incident data, security threat models and vulnerability analysis models are constructed as the foundation for application-layer digital twins. The application-layer digital twin foundation aggregates information such as the type, location, propagation path, and severity of historical attack events, providing prior knowledge for subsequent simulations and extrapolations.

[0064] A global synchronization clock is maintained for the four-layer model base. Whenever any layer receives new monitoring data and its state is updated, a cross-layer synchronization event is triggered. The cross-layer synchronization event carries the updated layer identifier, a summary of the updated content, and a global clock stamp, and is broadcast to notify the other layers.

[0065] After receiving a cross-layer synchronization event, each layer determines whether it needs to be updated in conjunction with the other layer based on the inter-layer dependencies: changes in the physical layer state trigger the synchronization verification of the network layer topology and the control layer behavior baseline; changes in the network layer topology trigger the incremental correction of the control layer protocol behavior model and the application layer vulnerability assessment results; and abnormal control layer commands trigger the command association comparison of the application layer.

[0066] The system monitors device access events and topology change events reported by various monitoring probes in the Industrial Internet. When a new device is detected, an incremental modeling process is executed: the device identifier, device type, and basic communication parameters are extracted from the new device's access signal to generate an initial device description; based on the device type, the nearest neighbor template is matched from a pre-set device template library, and parameters are filled in using the template parameters and the actual operating parameters reported by the new device to quickly construct the geometric and physical attribute models of the new device; based on the network access point information of the new device, the new node and its corresponding communication link edge set are inserted into the network topology graph, and the attribute weight matrix is ​​updated to achieve local incremental updates at the network layer; the control logic model and security assessment results of the control domain where the new device is located are locally refreshed, and the incremental changes are synchronized to the corresponding sections of the control layer and application layer.

[0067] After the incremental update is completed, the cross-layer collaborative data synchronization protocol is used to notify each layer to complete the linkage verification and ensure global consistency.

[0068] Based on the above four foundational layers, an initial static digital twin model is formed, denoted as... Its formal definition is:

[0069]

[0070] in, Represents the physical layer digital twin substrate, A network topology diagram representing the digital twin substrate of the network layer. Represents the digital twin substrate of the control layer. This represents the application layer digital twin substrate.

[0071] This represents the digital twin foundation of the control layer, including the state space, instruction set, and normal behavior baseline of each industrial controller. This represents the application-layer digital twin foundation, which includes a historical security threat signature database and vulnerability assessment results.

[0072] Step S2: Collect safety monitoring data in real time. The safety monitoring data includes equipment operating status time-series data, network traffic data, control command data, and physical environment parameter data.

[0073] Step S2 includes the following steps:

[0074] The data monitoring module is based on the physical device distribution of the Industrial Internet ( Spatial coordinate information of each device) and network architecture ( The network topology is used to determine the deployment location of monitoring probes. Deployment locations are categorized into three types: device-side embedded probes, directly embedded within specific industrial equipment to collect local operating status data; edge gateway probes, deployed at the aggregation nodes of fieldbus and industrial Ethernet to collect gateway-side traffic; and control center probes, deployed at the monitoring and data acquisition layer of the industrial control system to collect control command data.

[0075] To address the issue of single-point failures in static probe deployment leading to monitoring blind spots, the data monitoring module employs redundant probe deployment and an automatic takeover mechanism to ensure the continuity and integrity of monitoring data acquisition.

[0076] Based on the three types of probes mentioned above, backup probes are configured for edge gateway probes covering important areas. Backup probes are located in the same physical area or adjacent network segments as primary probes, and remain in standby mode with a low-frequency heartbeat under normal conditions. Each monitoring probe continuously reports its heartbeat status to the probe management center, which periodically checks the online status of each primary probe. When a primary probe fails to report a heartbeat signal for several consecutive heartbeat cycles, the probe management center determines that the probe is offline and issues a takeover command to the backup probe in the corresponding area or to adjacent primary probes with overlapping coverage. The designated probe adjusts its acquisition frequency and monitoring granularity based on the command, taking over the data acquisition tasks for the area covered by the offline probe until the offline probe returns to normal or completes physical replacement.

[0077] Each monitoring probe continuously collects the following four types of safety monitoring data according to its respective deployment location:

[0078] Equipment operating status timing data, denoted as Including the time of data collection Measurements reflecting the physical operating state of industrial equipment include vibration amplitude, rotational speed, current, and temperature; network traffic data is denoted as... This includes network layer characteristics such as data packet rate, data packet size distribution, source / destination addresses, and protocol types for each communication link; control command data, denoted as... Including industrial controllers at any time The content, frequency, and execution results of the instructions sent to each actuator; physical environment parameter data, denoted as... It includes environmental sensor measurements such as ambient temperature, humidity, and smoke concentration in industrial settings.

[0079] The above four types of collected data are timestamped and preprocessed, including outlier removal, missing value imputation, and unit normalization, to obtain the preprocessed real-time security monitoring dataset:

[0080]

[0081] in, Indicates at time Real-time security monitoring datasets collected and preprocessed. This is timing data of the equipment's operating status. For network traffic data, To control command data, This refers to physical environment parameter data.

[0082] Step S3: Construct a knowledge graph of physical space security events and cyberspace security events.

[0083] Step S3 includes the following steps:

[0084] The IoT event correlation module uses real-time security monitoring datasets Using this as input, construct a knowledge graph of physical space security events and cyberspace security events.

[0085] right Physical layer data in and This involves entity identification and relationship extraction. Entity identification aims to identify entities related to physical security events from the time-series data stream, including the device entity experiencing the anomaly, the attack mode entity to which the anomaly belongs, and the vulnerability entity involved. Relationship extraction aims to identify the dependencies and triggering relationships between entities, such as device... Temperature anomaly triggered the actuator The above processing generates physical layer semantic annotation data, denoted as... .

[0086] right Network layer data and control layer data (in) and Entity recognition and relation extraction are performed to generate semantically labeled data for the network layer, denoted as . Network layer entity types include network entities, protocol entities, vulnerability entities, attack pattern entities, and security measure entities; relationship types include dependency relationships, association relationships, triggering relationships, and mitigation relationships.

[0087] The Industrial Internet ontology is described using a formal entity-relationship framework, defined as follows:

[0088]

[0089] in, This represents the industrial internet security ontology. Represents a collection of entity types. Represents a set of relation types.

[0090] .

[0091] Physical layer semantic annotation data semantic annotation data of network layer In a unified ontology Semantic mapping and alignment are performed under constraints. Semantic mapping establishes a correspondence between cross-domain entity pairs with semantic relationships by calculating the similarity between physical layer entities and network layer entities in the embedding space. Let physical layer entities... The embedding vector is Network layer entities The embedding vector is The semantic similarity between the two is calculated as follows:

[0092]

[0093] in, Represents physical layer entities With network layer entities cosine similarity, and These are the representation vectors of the corresponding entities in the knowledge graph embedding space. Representing vectors Norm.

[0094] when When the preset alignment threshold is exceeded, a cross-domain semantic relationship is confirmed between the two entities, and a corresponding edge is established in the knowledge graph.

[0095] After the semantic mapping and alignment processes described above, the Internet of Things (IoT) event knowledge graph is obtained, denoted as […]. Its definition is:

[0096]

[0097] in, For IoT event knowledge graph, Represents a set of cross-domain relationships. Represents the semantic annotation data of the physical layer of the Internet of Things. semantic annotation data of network layer Related.

[0098] It represents a set of cross-domain relationships, including physical-network cross-domain entity relationship edges established through semantic alignment, as well as entity relationship edges within each domain.

[0099] The maintenance time decay factor for each IoT event in the IoT event knowledge graph. Let the IoT event... The length of time since it was last verified by an actual observed event is The effective confidence level after attenuation is:

[0100]

[0101] in, Indicating the Internet of Things incident Time decay effective confidence level, Indicating the Internet of Things incident The original confidence level, It is a natural constant. This is the knowledge decay rate coefficient. This represents the length of time elapsed since the most recent actual observation of the triplet until the current moment.

[0102] The knowledge decay rate coefficient is set based on statistical data on the life cycle of vulnerabilities in industrial sites, reflecting the timeliness of industrial security knowledge.

[0103] Perform graph pruning periodically: when the effective confidence level of the triplet is... When the value is below the preset pruning threshold, the triple is removed from the main graph and transferred to the historical archive. For low-frequency access subgraphs that are densely clustered in the main graph, a subgraph compression operation is performed to replace the dense subgraphs with aggregated nodes while retaining the key semantic attributes of the subgraphs. This reduces the graph size without significantly losing the ability to express knowledge and maintains the graph query efficiency in large-scale industrial scenarios.

[0104] Knowledge graph of Internet of Things events Injecting digital twin models This drives the updating of model parameters and structure at the corresponding level, and completes the initial injection of IoT event association knowledge.

[0105] Step S4: Semantically map the security monitoring data through the Internet of Things event knowledge graph, inject it into the digital twin model for dynamic updates, and obtain the evolved dynamic digital twin model.

[0106] Step S4 includes the following steps:

[0107] The dynamic evolution module monitors the dataset in real time for security purposes. Hewu.com Event Knowledge Graph For input, Multimodal data in Semantic mapping is performed to determine the knowledge graph entity node corresponding to each collected data point, and its quantified state is injected into the corresponding level of the digital twin model to drive the dynamic update of model parameters.

[0108] Set at time The resulting dynamic digital twin model after the update is Its update process can be represented as:

[0109]

[0110] in, Indicates time The dynamic digital twin model state, express The state of the digital twin model at each update time. This indicates the time step of the model update. This indicates an update to the model state. For Internet of Things (IoT) event knowledge graph.

[0111] Indicates according to Various monitoring data in China, combined with The semantic mapping relationship in the middle, for The relevant parameters of the physical layer, network layer, control layer and application layer are corrected and updated.

[0112] Through the aforementioned continuous update mechanism, the dynamic digital twin model It can reflect the current operating status of the industrial internet in real time.

[0113] Step S5: Identify the current security situation based on security monitoring data, and conduct forward-looking security simulation and deduction on the dynamic digital twin model based on the current security situation to obtain risk prediction results.

[0114] Step S5 includes the following steps:

[0115] Step 5.1: The simulation and deduction module first uses the real-time safety monitoring dataset. It identifies current security events and abnormal states, evaluates each monitoring node, and obtains the abnormality type identifier and abnormality level of each node.

[0116] Let the set of monitoring nodes in the Industrial Internet be . ,in This represents the total number of monitoring nodes. For each monitoring node... The following descriptive quantities were obtained after the safety assessment:

[0117] Abnormal status indicator ,in Represents a node In an abnormal state, Indicates that the node is in a normal state; anomaly type identifier. The value is a type label from a predefined set of attack types, such as denial-of-service attack, man-in-the-middle attack, or control command tampering; the anomaly level. The larger the value, the higher the degree of anomaly; anomaly spatial distribution information. , containing nodes The device identifier and network location identifier, corresponding to Device coordinates and Network location encoding in [the context].

[0118] The four types of descriptive variables of each monitoring node are vector-encoded and concatenated to form the current security situation vector:

[0119]

[0120] in, This represents the current security situation vector. This represents feature encoding and concatenation. This is an abnormal status indicator. This serves as an anomaly type identifier. The level of abnormality. For abnormal spatial distribution information, For equipment number, This represents the total number of devices.

[0121] This represents a mapping function that encodes and concatenates the anomaly descriptors of each monitoring node, identifying discrete types. Category embedding encoding is used for numerical parameters. , Directly involved in numerical encoding, for location information Positional encoding is used to ultimately form a vector representing the current global security situation.

[0122] Step 5.2: The simulation and deduction module will vectorize the current security situation. Input dynamic digital twin model Simulate several preset attack paths in The propagation process is analyzed, and the security risks of each monitoring node within a future time window are predicted based on the risk propagation trajectory of each preset attack path.

[0123] Let the preset attack path set be ,in This indicates the total number of preset attack paths, and each attack path... Based on the application layer digital twin foundation The historical attack events in the data are summarized and refined to describe the characteristics of a certain type of attack in the network topology. The gradual infiltration process. Regarding the attack path... At the node The risk propagation at this location is calculated using the following risk propagation model:

[0124] set up for Attribute weight matrix From the node To the node The basic weight of the link includes the weight for risk propagation. Defined as:

[0125]

[0126] in, For the node To the node The weight of directed risk propagation. for The set of directed communication links in [the context]. When When, it indicates from node To the node There is no directed communication link.

[0127]

[0128] in, Indicates the attack path Next, node Future time window The probability of subsequent security risks Indicates the attack path Middle node The set of upstream neighboring nodes, Indicates upstream node At any moment The current security risk probability, Indicates from node To the node Risk propagation weight, This indicates the length of the time window for risk prediction.

[0129] node The probability of infection within the future time window is equal to the probability that none of its upstream nodes have successfully transmitted the risk. The probability of the opposite event of this event.

[0130] Based on comprehensive risk probability Risk levels are assessed for each monitoring node. Let the risk level mapping function be... Then the node The risk level is:

[0131]

[0132] in, For nodes The risk level, w represents the time window. For risk level mapping function, This is a comprehensive risk probability.

[0133] During the security situation identification phase, if there are anomaly type identifiers for monitoring nodes... Failure to connect with the Internet of Things event knowledge graph If an attack pattern entity match is found, or if the abnormal propagation trajectories of multiple nodes deviate significantly from all preset attack paths, then a dynamic unknown attack path generation process is triggered: starting from the currently identified set of abnormal nodes, based on the network topology... The network connectivity and communication protocol types of each node are analyzed, and possible propagation paths originating from the anomalous initiating node are enumerated in a depth-first manner. Each candidate path is scored based on its risk propagation weight, and the highest-scoring paths are selected as dynamically generated candidate attack paths, added to the simulation path set for risk propagation calculation. After this simulation, the dynamically generated candidate attack paths are written into the simulation with a lower initial confidence level. The candidate knowledge areas will be selected and incorporated into the historical attack path library after subsequent iterations and verifications.

[0134] The overall risk probability of each node and risk level The summarized output is the risk prediction result, denoted as .

[0135] Step S6: Based on the risk prediction results, generate and execute monitoring strategy adjustment instructions, and report and issue early warnings for anomalies captured in the industrial internet.

[0136] Step S6 includes the following steps:

[0137] Step 6.1: The anomaly alarm module is based on the risk prediction results. Each monitoring node is classified and marked according to its risk level, and differentiated monitoring strategy adjustment instructions are generated.

[0138] For each monitoring node Pre-label asset importance level Among them, high-value core equipment, such as the main PLC of the production line, has significant value. Value selection, low-value assets such as ordinary sensors have relatively small Values, The range of values ​​is Configuration is based on asset classification results. Historical attack frequency is statistically analyzed, and nodes are... The frequency of attacks within a historical statistical period is normalized into a historical attack frequency factor. , The larger the value, the more frequently the node has been attacked in history.

[0139] node High-risk determination threshold and low-risk determination threshold The following adaptive calculation is performed based on asset importance weights and historical attack frequency factors:

[0140]

[0141]

[0142] in, As a high-risk benchmark threshold, As a low-risk benchmark threshold, This is the adjustment coefficient for asset importance weights relative to the high-risk threshold. This is the adjustment coefficient for asset importance weights relative to the low-risk threshold. This is the adjustment coefficient of the historical attack frequency factor on the high-risk threshold. This is the adjustment coefficient of the historical attack frequency factor on the low-risk threshold.

[0143] All adjustment coefficients are positive to ensure that nodes with higher asset importance or higher historical attack frequency have lower trigger thresholds and receive stricter security protection.

[0144] The anomaly alarm module is based on risk prediction results. According to the node Overall risk probability With personalized thresholds , Based on this relationship, each monitoring node is divided into three risk levels, and corresponding monitoring strategy adjustment instructions are generated:

[0145] For the overall risk probability For high-risk monitoring nodes, generate the first adjustment command to increase monitoring frequency and refine monitoring granularity.

[0146] For the overall risk probability to satisfy For medium-risk monitoring nodes, proportional interpolation is performed based on the relative position of the risk probability within the medium-risk range to generate a second adjustment instruction that finely adjusts the monitoring frequency and granularity proportionally; let the baseline monitoring frequency be... The highest frequency of targets under high-risk conditions is Then medium-risk nodes Adjustment frequency The calculation is as follows:

[0147]

[0148] in, Indicates medium-risk nodes Adjusted monitoring frequency Indicates the baseline monitoring frequency. This indicates the highest monitoring frequency under high-risk conditions. Represents a node The overall risk probability, For nodes The low-risk threshold For nodes The high-risk determination threshold.

[0149] For the overall risk probability For low-risk monitoring nodes, a third adjustment command is generated to reduce the monitoring frequency and coarsen the monitoring granularity.

[0150] The device identifiers and network location identifiers of high-risk monitoring nodes are used as identifiers for key monitoring areas, and together with the first, second, and third adjustment instructions, they form the monitoring strategy adjustment instruction. This information is then distributed to each monitoring probe in the distributed security monitoring probe network. Each monitoring probe then parses the data. It extracts the monitoring frequency adjustment parameters and monitoring granularity adjustment parameters corresponding to its own deployment location, restarts the collection of security monitoring data according to the adjusted parameters, generates a new round of real-time security monitoring dataset, drives the dynamic evolution module to update the dynamic digital twin model, and triggers the simulation and deduction module again to perform situation identification and risk deduction, forming a complete closed-loop iterative mechanism.

[0151] Step 6.2: After each closed-loop iteration, the newly identified security event types, newly discovered security event correlations, and their associations with the existing IoT event knowledge graph are compared. Conflicting data, used as knowledge graph update data .

[0152] If the entity types or relation types involved in the opposition triples are all already... If a large number of these occur, it is considered a noise conflict, and a Bayesian weighted confidence update is performed; if the opposing triples involve If a new combination of entities or a new attack relationship has not yet appeared or appears with a very low frequency, it is determined to be the introduction of new knowledge. The triple is marked as new knowledge to be verified and saved to the candidate knowledge area of ​​the knowledge graph with a low initial confidence. The deletion operation of the original triple is not performed for the time being. It will be formally included in the main graph after sufficient supporting evidence is accumulated in subsequent iterations.

[0153] for Zhongyu For parts where existing knowledge conflicts occur, a knowledge conflict resolution mechanism is used to handle them. Let's assume a certain triple (entity) in the existing knowledge graph... Relationship, entity The corresponding confidence level is The number of supporting evidence for the opposing triples observed in the new iteration is The total number of historical observations is The updated confidence level is then updated using a Bayesian weighted algorithm:

[0154]

[0155] in, This represents the updated confidence level of the triplet after resolution. This indicates the confidence level of the triplet that existed before resolution. This represents the total number of observations for the entity pairs involved in the triple during historical iterations. This indicates the number of observational evidences supporting the new triplet in this iteration. This indicates the amount of observational evidence supporting the original triplet in historical iterations.

[0156] When the updated confidence level When the value is below the preset minimum confidence threshold, the original triplet will be removed from... Removed from the middle and replaced with a new triplet; when When the value exceeds the preset minimum confidence threshold, retain the original triples and add the new triples as supplementary knowledge. This enables incremental updates to the Internet of Things (IoT) event knowledge graph.

[0157] Through the aforementioned incremental update mechanism, the IoT event knowledge graph... As the system is continuously expanded and corrected during operation, the accuracy of semantic mapping and the accuracy of attack path simulation in subsequent iterations are continuously improved.

[0158] Step 6.3: Report and issue early warnings for anomalies captured in the Industrial Internet. The early warning report includes: the node's anomaly status identifier, anomaly type identifier, anomaly severity level, anomaly spatial distribution information, and anomaly propagation trajectory and range.

[0159] Example 2: Figure 2 A flowchart of an industrial internet information security monitoring system based on digital twins according to the present invention is provided.

[0160] The industrial internet environment used in the experiment includes: The monitoring nodes are divided into four types according to their equipment functions: 5 programmable logic controller (PLC) nodes, numbered... to There are 8 industrial sensor nodes (sensor nodes), numbered as follows: to There are 4 edge gateway nodes, numbered as follows: to There are 3 human-computer interaction terminal nodes (HMI nodes), numbered as follows: to There are 34 directed communication links between the aforementioned nodes, forming a hierarchical industrial network topology. .

[0161] Two existing technical solutions were set up as benchmark comparison groups in the control experiment: Benchmark Method A is an industrial internet security monitoring solution based on a traditional network intrusion detection system. This solution only collects and analyzes network traffic data and uses a unified static rule base for threat identification on all nodes. Benchmark Method B is an industrial internet security monitoring solution based on a static machine learning model. This solution performs joint modeling of historical traffic and device logs during the offline training phase, forms a fixed detection model, and then deploys it in the production environment. It does not have the ability to update the model at runtime and uses a unified fixed monitoring frequency on all nodes. The solution of this invention was run in the same experimental environment. All experiments were conducted within a continuous 72-hour simulation period, during which three types of controlled attack scenarios were injected: control command tampering attacks targeting PLC nodes, network denial-of-service attacks targeting edge gateway nodes, and cross-domain composite man-in-the-middle attacks spanning sensor nodes and HMI nodes.

[0162] The digital twin building module collects the physical entity configuration information of the factory to construct the physical layer digital twin foundation. Geometric attribute vectors of 20 devices were entered. With physical property vector Using PLC nodes For example, its physical property vector The main parameters are as follows: rated power is 24W, and operating temperature range is... to During normal operation, the CPU utilization rate is capped at 80%, and the number of input / output channels is 16 / 16; its geometric attribute vector Record the equipment type label as PLC, and the spatial coordinates as the factory coordinate system. The dimensions are .

[0163] Network layer digital twin substrate In, node set It includes the aforementioned 20 monitoring nodes. (Edge set) It contains 34 directed communication links, with an attribute weight matrix. Record the main communication parameters of each link. (Based on the edge gateway node) To PLC node control link For example, the link bandwidth is 100Mbps, the normal transmission latency is 2.3ms, and the communication protocol type is Modbus TCP; taking the sensor node as an example... To the edge gateway node uplink For example, the link bandwidth is 10Mbps, the normal transmission latency is 0.8ms, and the communication protocol type is MQTT.

[0164] Application Layer Digital Twin Foundation Based on 1,247 historical security incident records from similar factories over the past three years, a set of preset attack paths was compiled. , contains The attack paths cover various attack types, including control command tampering, denial of service, man-in-the-middle attacks, data injection, and lateral movement. Each path is abstracted from the sequence of penetration steps taken by attackers in historical events.

[0165] The data monitoring module deploys a total of 20 device-embedded probes, 4 edge gateway probes, and 1 control center probe across 20 monitoring nodes. The probe sampling time step is... Set to 1 second. In the simulation experiment... At each second, the following real-time security monitoring data was collected, and some typical nodes are used as examples for illustration.

[0166] For sensor nodes Its equipment operating status time series data Record the current vibration amplitude value (Normal baseline value) (deviation exceeding 260%), operating temperature is (Exceeding the rated upper limit) The current reading is (Normal baseline value) ); its physical environment parameter data Record the current ambient temperature of the equipment compartment as follows: The humidity is 62%, and the smoke concentration sensor reading is... (Within the normal range).

[0167] For edge gateway nodes Its network traffic data Record the current packet arrival rate as per second. Data packets (normal baseline value is per second) (Number of data packets, anomaly rate of approximately 39 times), average data packet size: (Normal average is) The communication destination address is highly concentrated in the PLC node. The Modbus TCP port 502 matches the characteristics of a denial-of-service attack.

[0168] For PLC nodes Its control command data The record shows that the number of times the currently received write register instruction (function code 0x10) has been issued in the past 60 seconds is 218 (the normal baseline value is 12 times every 60 seconds), and 7 of the instruction source addresses are not in the whitelist.

[0169] After timestamping and preprocessing the four types of monitoring data from all 20 nodes, the time was obtained. Real-time security monitoring dataset The outlier removal rate was 0.3%, the missing value imputation rate was 0.1%, and after dimensional normalization, all types of data were mapped to... Interval.

[0170] IoT event association module Entity identification and relationship extraction were performed. A total of 14 physical layer entities were identified from the physical layer data (including 5 abnormal device entities, 3 vulnerable entities, and 6 attack pattern entities), and 21 network layer entities were identified from the network layer and control layer data (including 8 network entities, 4 protocol entities, 5 vulnerable entities, and 4 attack pattern entities). Cross-domain entity pairs were extracted as candidate entities. Group.

[0171] With sensor nodes abnormal entities with excessively high temperatures With edge gateway nodes High-frequency Modbus data injection entity detected above Taking the calculation of cross-domain semantic association between two entities as an example, after encoding their representation vectors in the embedding space, the cosine similarity is:

[0172]

[0173] The alignment threshold derived from historical security events is 0.75, because... This confirms the existence of a cross-domain semantic association between the two entities: sensor Physical anomalies and Malicious data injection on the gateway side has a semantically related attack chain, which is reflected in the IoT event knowledge graph. Establish cross-domain triggering relationship edges.

[0174] After cosine similarity calculation, 22 out of all 35 cross-domain candidate entity pairs had similarity scores exceeding the alignment threshold of 0.75, successfully establishing cross-domain association edges and forming a knowledge graph of IoT events. The graph contains 35 node entities and 83 relationship edges, including 22 cross-domain relationship edges and 61 intra-domain relationship edges.

[0175] The dynamic evolution module will pass Injection after semantic mapping Complete the model update and obtain This update triggered 14 layer parameter correction operations, including 6 physical layer parameter updates (mainly involving...). Temperature threshold state and The device load status), and five network layer topology weight updates (mainly involving device load status), are among the five items that update the network layer topology weights. to The link's traffic weight changes from the normal state. Upgraded to ), 3 items related to the update of the control layer instruction behavior baseline (involving (Anomaly marker for the frequency of received commands).

[0176] The simulation and deduction module is based on A security assessment was conducted on all 20 monitoring nodes, and the anomaly description quantity for each node was obtained. The table below lists the assessment results for 6 representative nodes (anomaly severity level ranges from 1 to 5, with higher values ​​indicating a higher degree of anomaly):

[0177]

[0178] The current security posture vector is obtained by concatenating the anomaly descriptors of all 20 nodes. Its dimensions are (Each node contains 4 types of feature codes).

[0179] The simulation and deduction module will enter In the preset attack path set Select the three paths that best match the current exception type (control command tampering paths). Denial of Service Path Cross-domain composite attack path A risk propagation simulation was conducted, and the high-risk determination threshold was calculated as follows: The low-risk threshold is .

[0180] By path (Control command tampering path) at PLC node Taking risk propagation calculation at a location as an example. Node The set of upstream neighboring nodes is For a two-way communication link, the security risk probabilities at the current moment are as follows: , The corresponding risk propagation weights are respectively , Substituting into the risk propagation model, we get:

[0181]

[0182]

[0183]

[0184]

[0185] because ,node identified as a high-risk node The time window length corresponding to high-risk nodes is... Seconds. It is predicted that there is an 82.6% probability that it will be affected by the lateral spread of a control command tampering attack within the next 2 minutes.

[0186] Based on the simulation results of the three attack paths, the risk levels of all 20 nodes are summarized. The table below lists the risk distribution statistics and the average overall risk probability for each node type:

[0187]

[0188] The anomaly alarm module is based on risk prediction results. The overall risk probability exceeds The 10 high-risk nodes were marked as key monitoring areas, and the first adjustment instruction was generated; the overall risk probability was lower than that of the key monitoring areas. The three low-risk nodes generate the second adjustment instruction. The specific adjustment parameters are as follows:

[0189] For high-risk nodes (such as PLC nodes) (represented by) monitoring frequency From the benchmark value Upgraded to Monitoring particle size The approach refines from coarse-grained (collecting only device status summaries) to fine-grained (collecting complete register states and the execution results of each instruction); for low-risk nodes (based on sensor nodes)... (represented by) monitoring frequency From the benchmark value Reduce to Monitoring particle size The granularity is reduced from fine to coarse (only periodic summary statistics are reported); for medium-risk nodes, the monitoring frequency and granularity remain unchanged from the baseline value.

[0190] The aforementioned differentiated adjustment strategy reduces the overall sampling data volume of the entire system probes at the time of the attack compared to baseline method A and baseline method B, while significantly increasing the monitoring sampling density in high-risk areas. Based on the computational resource consumption within this simulation window, the effective utilization rate of monitoring computational resources (defined as the proportion of computational resources consumed by high-risk nodes to the total computational resources) reaches 78.4%, while baseline methods A and B, which employ a uniform monitoring strategy for all nodes, have ratios of only 42.1% and 46.7%, respectively. The resource utilization efficiency of this invention is 86.2% higher than baseline method A and 67.9% higher than baseline method B.

[0191] The anomaly alarm module synchronously generates an early warning report. The report includes the anomaly status identifiers of 10 high-risk nodes, anomaly type identifiers (including three categories: control command tampering, denial of service, and man-in-the-middle attack), and anomaly severity level (maximum level 5, involving...). and ), abnormal spatial distribution information (corresponding to the factory coordinate system location), and predicted attack propagation trajectories generated by simulation (involving paths) : ,path : ,path : (and the predicted scope of impact).

[0192] To further verify the comprehensive performance of this invention under different attack scenarios and node types, a total of 150 controlled attack events were injected 50 times each of the three attack scenarios within a 72-hour simulation period. The detection effect of each attack type was evaluated on the corresponding main target node type. Comparison metrics included threat detection rate (the proportion of correctly detected attack events), false alarm rate (the proportion of normal events misclassified as attacks), and average alarm latency (the time interval from the occurrence of the attack to the system issuing an alarm). The comparison results of the three methods are shown in the table below:

[0193] Scenario 1: Control command tampering attack (Target node type: PLC node, 50 injections in total)

[0194]

[0195] Baseline method A, relying solely on network traffic characteristics, lacks awareness of physical layer command semantics, failing to detect numerous complex command tampering attacks involving mixed physical layer anomalies. Baseline method B possesses some joint modeling capabilities, but limited by its static model, it misses some variant attack commands injected in this instance. The present invention's solution utilizes cross-domain semantic associations within the IoT event knowledge graph to... abnormal instruction frequency and The system achieves the highest threat detection rate and the lowest false alarm rate through joint identification of network traffic anomalies and forward-looking simulation using a dynamic digital twin model.

[0196] Scenario 2: Network Denial-of-Service Attack (Target Node Type: Edge Gateway Node, 50 Injections in Total)

[0197]

[0198] Denial-of-service attacks have relatively obvious traffic characteristics, and both baseline methods A and B have certain detection capabilities. However, limited by static rules and fixed models, they have a high rate of false negatives for low-rate, slow-moving denial-of-service attacks. The solution of this invention uses dynamically updated... The weight matrix and risk propagation simulation can identify early attack signs before the network congestion level reaches the traditional threshold. The average alarm latency is reduced by 59.4% compared with the benchmark method A and by 50.0% compared with the benchmark method B.

[0199] Scenario 3: Cross-domain composite man-in-the-middle attack (target node types: sensor nodes and HMI nodes, a total of 50 injections)

[0200]

[0201] Cross-domain composite man-in-the-middle attacks involve both physical layer sensor data tampering and network layer communication hijacking, making them the most difficult attack type to detect among the three scenarios. Baseline method A, lacking any physical layer sensing capability, failed to detect over half of the attack events. Baseline method B, while possessing a foundation in joint modeling, suffers from a significantly lower detection rate due to its static model's inability to adapt to dynamically adjusted attacker strategies. The proposed solution establishes cross-domain correlations between sensor physical anomalies and HMI communication anomalies through an IoT event knowledge graph, combined with real-time updates of a dynamic twin model. In composite attack scenarios, this solution achieves a 46 percentage point improvement in detection rate compared to baseline method A and a 24 percentage point improvement compared to baseline method B, demonstrating the most significant advantage.

[0202] The overall performance of the three methods across all 150 controlled attack events is summarized below:

[0203]

[0204] The above data shows that the solution of the present invention is significantly better than the two existing mainstream monitoring technologies in four core indicators: threat detection rate, false alarm rate, alarm latency, and monitoring resource utilization.

[0205] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An industrial internet information security monitoring system based on digital twins, characterized in that, The system includes a digital twin construction module, a data monitoring module, an IoT event correlation module, a dynamic evolution module, a simulation and deduction module, and an anomaly alarm module, wherein: The digital twin construction module is used to acquire physical entity data and network data from the Industrial Internet to construct a digital twin model. The data monitoring module is used to collect safety monitoring data in real time. The safety monitoring data includes equipment operating status time-series data, network traffic data, control command data, and physical environment parameter data. The IoT event association module is used to construct an IoT event knowledge graph that connects physical space security events with cyberspace security events. The dynamic evolution module is used to semantically map security monitoring data through the Internet of Things event knowledge graph, inject it into the digital twin model for dynamic updates, and obtain the evolved dynamic digital twin model. The simulation and deduction module is used to identify the current security situation based on security monitoring data, and to perform forward-looking security simulation and deduction on the dynamic digital twin model based on the current security situation to obtain risk prediction results; The anomaly alarm module is used to generate and execute monitoring strategy adjustment instructions based on risk prediction results, and to report and warn of anomalies captured in the industrial internet.

2. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, The digital twin construction module, when acquiring physical entity data and network data from the Industrial Internet and constructing a digital twin model, includes: Acquire physical entity configuration information, equipment operating parameters, network topology, and historical security event data from the Industrial Internet. Based on the acquired data, construct a digital twin model encompassing the physical layer, network layer, control layer, and application layer, including: Based on the physical entity configuration information, construct the device geometric model and physical attribute model as the physical layer digital twin base; Based on the network topology, construct the network connection model and communication protocol model of the Industrial Internet as the digital twin foundation of the network layer; Based on the equipment operating parameters, construct the equipment control logic model and the industrial control protocol behavior model as the digital twin foundation of the control layer; Security threat models and vulnerability analysis models are built based on historical security incident data, serving as the foundation for application-layer digital twins.

3. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, When the data monitoring module performs real-time collection of security monitoring data, it includes: Based on the physical device distribution and network architecture of the Industrial Internet, the deployment locations of monitoring probes are determined, including embedded probes at the device end, edge gateway probes, and control center probes. Each monitoring probe collects time-series data on the operating status of the equipment, network traffic data, control command data, and physical environment parameter data. The collected data is timestamped and preprocessed to obtain preprocessed real-time safety monitoring data.

4. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, The IoT event association module, when constructing an IoT event knowledge graph of physical space security events and cyberspace security events, includes: Entity recognition and relation extraction are performed on the physical layer data in real-time security monitoring data to obtain physical layer semantic annotation data. Entity recognition and relation extraction are performed on network layer data and control layer data in real-time security monitoring data to obtain network layer semantic annotation data. Semantic mapping and alignment are performed between the physical layer semantic annotation data and the network layer semantic annotation data to obtain the Internet of Things event knowledge graph. Injecting the IoT event knowledge graph into the digital twin model drives the updating of model parameters and structure at the corresponding level.

5. The industrial internet information security monitoring system based on digital twins according to claim 4, characterized in that, Entities and relationships in the Industrial Internet include: The Industrial Internet ontology comprises a set of entity types and a set of relationship types. The set of entity types includes device entities, network entities, protocol entities, vulnerability entities, attack mode entities, and security measure entities. The set of relationship types includes dependency relationships, association relationships, triggering relationships, and mitigation relationships.

6. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, When the simulation and deduction module performs the identification of the current security situation based on security monitoring data, it includes: Based on real-time security monitoring data, current security events and abnormal states are identified, and each monitoring node is evaluated to obtain the abnormality type identifier and abnormality level of each node. The abnormal status identifier, abnormal type identifier, abnormal severity level, and abnormal spatial distribution information of each monitoring node are vector-encoded and output as the current security situation vector.

7. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, When the simulation and deduction module performs a forward-looking security simulation and deduction of the dynamic digital twin model based on the current security situation and obtains risk prediction results, it includes: The current security situation vector is input into the dynamic digital twin model to simulate the propagation process of several attack paths in the dynamic digital twin model. Based on the risk propagation trajectory of each preset attack path, the security risk probability and risk level of each monitoring node within the future time window are predicted, and the risk prediction results are output.

8. The industrial internet information security monitoring system based on digital twins according to claim 1, characterized in that, When the anomaly alarm module executes the command to adjust the monitoring strategy based on the risk prediction results, it includes: Based on the risk prediction results, monitoring nodes with a safety risk probability exceeding the first threshold are marked as high-risk monitoring nodes, and monitoring nodes with a safety risk probability below the second threshold are marked as low-risk monitoring nodes. For high-risk monitoring nodes, generate the first adjustment instruction to increase the monitoring frequency and refine the monitoring granularity; For medium-risk monitoring nodes, a second adjustment instruction with a higher monitoring frequency and more granular monitoring is generated; For low-risk monitoring nodes, a third adjustment instruction is generated to reduce the monitoring frequency and coarsen the monitoring granularity; The device identifiers and network location identifiers of high-risk monitoring nodes are used as identifiers for key monitoring areas, and together with the first adjustment instruction, the second adjustment instruction, and the third adjustment instruction, they form the monitoring strategy adjustment instruction.

9. The industrial internet information security monitoring system based on digital twins according to claim 8, characterized in that, The monitoring strategy adjustment instruction execution process includes: The command to adjust the monitoring strategy is sent to each monitoring probe in the distributed security monitoring probe network; Each monitoring probe parses the monitoring strategy adjustment instructions and extracts the monitoring frequency adjustment parameters, monitoring granularity adjustment parameters, and key monitoring area identifiers corresponding to its own deployment location; If the monitoring probe is deployed within the area indicated by the key monitoring area marker, the monitoring probe will increase the monitoring frequency and refine the monitoring granularity according to the first adjustment instruction; If the monitoring probe is deployed at the edge of the area indicated by the key monitoring area marker, the monitoring probe will slightly increase the monitoring frequency and slightly refine the monitoring granularity according to the second adjustment instruction; If the deployment location of the monitoring probe is not within the area indicated by the key monitoring area marker, the monitoring probe shall reduce the monitoring frequency and coarsen the monitoring granularity in accordance with the third adjustment instruction; Each monitoring probe restarts collecting safety monitoring data according to the adjusted monitoring frequency and granularity, forming a closed-loop iteration.

10. The industrial internet information security monitoring system based on digital twins according to claim 9, characterized in that, The steps of closed-loop iteration include: After each closed-loop iteration, the newly identified security event types, newly discovered security event relationships, and data that contradict the IoT event knowledge graph are used as knowledge graph update data. Based on the knowledge graph update data, knowledge conflicts are resolved, and incremental updates of the IoT event knowledge graph are achieved.

Images