CN112953900A

CN112953900A - Data processing method combining big data and edge calculation and artificial intelligence server

Info

Publication number: CN112953900A
Application number: CN202110106835.5A
Authority: CN
Inventors: 吴静昱
Original assignee: Individual
Current assignee: Individual
Priority date: 2020-07-04
Filing date: 2020-07-04
Publication date: 2021-06-11
Also published as: CN111935089A; CN111935089B; CN112953901A

Abstract

According to the data processing method and the artificial intelligence server combining big data and edge calculation, first working state data and second working state data are obtained, then state transmission data of the first working state data are determined, state priority of each second working state data is further determined, then production state topology is built based on the state priority, feature data are extracted, and finally target industrial equipment with intrusion behaviors is determined according to difference data of the feature data when the feature data in two adjacent time periods are inconsistent. Therefore, abnormal industrial equipment can be judged in time, accurate targets can be provided for subsequent abnormal repair, corresponding security measures can be executed in time, the occurrence of serious production accidents caused by potential safety hazards due to the fact that industrial equipment is invaded by hackers in the industrial internet production system is avoided, and safe and reliable operation of the industrial internet production system is further ensured.

Description

Data processing method combining big data and edge calculation and artificial intelligence server

Technical Field

The application relates to the technical field of edge calculation data processing, in particular to a data processing method combining big data and edge calculation and an artificial intelligence server.

Background

With the rapid development of scientific technology, industrial internet technology has been gradually applied to various automated industrial scenes. The industrial internet can provide flexible and quick service functions for traditional industrial manufacturers, and the industrial manufacturing quality and efficiency are obviously improved.

However, in view of the characteristics of the industrial internet, the interconnection and intercommunication of information among the nodes (components) of the industrial internet needs to be realized, the high penetration fusion of information technology, and especially the tight combination of the industrial production process, the control network and the internet, so that the industrial production faces a serious information security risk at the same time of improving the efficiency. The more serious information security risk hidden danger is as follows: a hacker may tamper the operation parameters of the industrial device maliciously by stealing the production information of the industrial device, which may cause serious production safety accidents in the entire industrial internet production system.

Disclosure of Invention

The application provides a data processing method combining big data and edge calculation and an artificial intelligence server, so as to solve the technical problems in the prior art.

In a first aspect, a data processing method for big data and edge calculation is provided, which is applied to an artificial intelligence server, the artificial intelligence server is in communication with an industrial production control server and a plurality of industrial devices, the method at least includes the following steps:

detecting and acquiring a first business production identifier of an industrial production control server and a second business production identifier of each industrial device, and acquiring first working state data of the industrial production control server and second working state data of each industrial device under the condition that the first business production identifier and the second business production identifier are the same;

determining state transmission data of the first working state data in the current time period according to the set time step, and determining the state priority of each second working state data in the current time period according to the state transmission data;

constructing a production state topology of the industrial equipment based on the state priority, and extracting feature data of the production state topology in the current time period;

under the condition that the first service production identification and the second service production identification are still the same in the next time period of the current time period, if the feature data of the production state topology in the next time period is inconsistent with the feature data of the production state topology in the current time period, determining the target industrial equipment with intrusion behavior according to the difference data between the feature data of the production state topology in the next time period and the feature data of the production state topology in the current time period.

In a second aspect, an artificial intelligence server is provided, where the artificial intelligence server communicates with an industrial production control server and a plurality of industrial devices that are communicatively connected to each other, and the artificial intelligence server is specifically configured to:

In a third aspect, an artificial intelligence server is provided, comprising: the system comprises a processor, a memory and a network interface, wherein the memory and the network interface are connected with the processor; the network interface is connected with a nonvolatile memory in the artificial intelligence server; when the processor is operated, the computer program is called from the nonvolatile memory through the network interface, and the computer program is operated through the memory so as to execute the method.

In a fourth aspect, a computer-readable storage medium is provided, in which a computer program is recorded, and when the computer program runs in a memory of an artificial intelligence server, the method is implemented.

According to the data processing method and the artificial intelligence server combining big data and edge calculation, first working state data of the industrial production control server and second working state data of each industrial device are obtained when a first business production identification of the industrial production control server and a second business production identification of each industrial device are the same, then state transmission data of the first working state data are determined, further state priority of each second working state data is determined, then a production state topology is built based on the state priority, feature data of the production state topology is extracted, and finally target industrial devices with intrusion behaviors are determined according to difference data of the feature data in two adjacent time periods when the feature data in the two adjacent time periods are inconsistent. Therefore, abnormal industrial equipment can be judged in time, accurate targets can be provided for subsequent abnormal repair, corresponding security measures can be executed in time, the occurrence of serious production accidents caused by potential safety hazards due to the fact that industrial equipment is invaded by hackers in the industrial internet production system is avoided, and safe and reliable operation of the industrial internet production system is further ensured.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.

FIG. 1 is a communication architecture diagram of a big data and edge computing data processing system, shown in the present application, according to an example embodiment.

FIG. 2 is a flow chart illustrating a data processing method for big data and edge calculation according to an exemplary embodiment of the present application.

FIG. 3 is a hardware block diagram of an artificial intelligence server according to an exemplary embodiment of the present application.

Detailed Description

The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The inventor discovers that, based on the edge computing technology, most of the existing industrial internet production systems marginalize and distribute the production control authority, that is, the industrial devices at the edge end can autonomously modify and adjust the operating parameters of the industrial devices, and frequent information interconnection and intercommunication can be performed between the industrial devices under the industrial internet production systems, so that if one of the industrial devices is hacked, other industrial devices are easily hacked. Most of the current industrial internet production systems relate to the industrial industries of water conservancy, energy, traffic and other affairs, national security and social stability, and if the industrial internet production systems have potential safety hazards, huge loss can be caused.

Therefore, in order to solve the above problems, it is necessary to monitor the operating state of the industrial device without affecting the normal operation of the industrial device, and analyze the monitored state data, so as to timely determine the abnormal industrial device, thereby providing an accurate target for subsequent abnormal repair, and further avoiding the occurrence of information security hidden danger and serious production accidents caused by the invasion of the industrial device by a hacker in the industrial internet production system.

To achieve the above objective, please first refer to fig. 1, which provides a communication architecture diagram of a big data and edge computing data processing system 100, wherein the data processing system 100 may include an artificial intelligence server 200, an industrial production control server 300, and a plurality of industrial devices 400. Wherein the industrial production control server 300 and the plurality of industrial devices 400 communicate with each other to form an industrial internet production system. In this embodiment, the industrial internet production system can be applied to a plurality of fields such as new infrastructure, smart manufacturing, smart city, etc., and is not limited herein.

Further, the artificial intelligence server 200 is respectively in communication with the industrial production control server 300 and each industrial device 400, and is configured to monitor the operating states of the industrial production control server 300 and each industrial device 400 on the premise of not affecting the normal production operation of the industrial production control server 300 and each industrial device 400, so as to determine whether the state of the industrial production control server 300 and each industrial device 400 is abnormal due to hacker intrusion, which can provide an accurate target for subsequent abnormal recovery, and ensure the safe and reliable operation of the industrial internet production system.

On the basis of the above, please refer to fig. 2 in combination, which is a flowchart illustrating a data processing method for big data and edge calculation according to an embodiment of the present invention, the method may be applied to the artificial intelligence server 200 in fig. 1, and specifically may include the contents described in the following steps S21 to S24.

Step S21, detecting and acquiring a first business production identifier of an industrial production control server and a second business production identifier of each industrial device, and acquiring first operating state data of the industrial production control server and second operating state data of each industrial device when the first business production identifier and the second business production identifier are the same.

In this embodiment, the service production identifier is used to represent a type of a production line in which the industrial production control server and the industrial device are located, different service production identifiers correspond to different types of production lines, and the operating state data is used to represent an operating state of the industrial production control server and the industrial device, such as an electricity utilization state, a loss state, a transmission state, a signal transmission state, and the like, which is not limited herein.

Step S22, determining the status transmission data of the first operating status data in the current time period according to the set time step, and determining the status priority of each second operating status data in the current time period according to the status transmission data.

In practical application, the set time step can be adjusted according to the number of the industrial devices, the state transmission data can represent authority information of the industrial production control server for controlling each industrial device, and the state priority refers to the controlled weight level of each industrial device relative to the industrial production control server.

And step S23, constructing the production state topology of the industrial equipment based on the state priority, and extracting the characteristic data of the production state topology in the current time period.

In specific implementation, the production state topology comprises topology nodes corresponding to the industrial equipment, and the characteristic data is used for representing the state stability and the data anti-intrusion coefficient of the production state topology.

Step S24, when it is detected that the first service production identifier and the second service production identifier are still the same in the next time period of the current time period, if the feature data of the production state topology in the next time period is inconsistent with the feature data of the production state topology in the current time period, determining the target industrial device with intrusion behavior according to the difference data between the feature data of the production state topology in the next time period and the feature data of the production state topology in the current time period.

In this embodiment, the target industrial device may be understood as an industrial device invaded by a hacker or malware, the target industrial device may communicate with other industrial devices, and the hacker or malware may continue to invade other industrial devices through communication links between the target industrial device and the other industrial devices. Therefore, the target industrial equipment is accurately determined through the steps, and corresponding security measures can be executed in time, so that the safe and reliable operation of the industrial internet production system is ensured.

It can be understood that through the descriptions of the above steps S21-S24, the first operating status data of the industrial production control server and the second operating status data of each industrial device are firstly obtained when the first service production identifier of the industrial production control server and the second service production identifier of each industrial device are the same, then the status transfer data of the first operating status data is determined, and further the status priority of each second operating status data is determined, then the production status topology is constructed based on the status priorities and the feature data of the production status topology is extracted, and finally the target industrial device with intrusion behavior is determined according to the difference data of the feature data in two adjacent time periods when the feature data in two adjacent time periods are inconsistent. Therefore, abnormal industrial equipment can be judged in time, accurate targets can be provided for subsequent abnormal repair, corresponding security measures can be executed in time, the occurrence of serious production accidents caused by potential safety hazards due to the fact that industrial equipment is invaded by hackers in the industrial internet production system is avoided, and safe and reliable operation of the industrial internet production system is further ensured.

On the basis of the above-mentioned steps S21 to S24, in order to ensure that other industrial devices in the industrial internet production system are not hacked, after the target industrial device is determined, the method may further include the following steps S25 to S27.

And step S25, extracting the communication protocol text of the target industrial equipment.

Step S26, performing communication path identification on the communication protocol text to obtain a plurality of pieces of communication path information included in the communication protocol text.

Step S27, determining a communication frequency band corresponding to each piece of communication path information, and broadcasting an interference frequency band corresponding to the communication frequency band in a communication range of the target industrial device based on the communication frequency band, so as to implement communication shielding for the target industrial device.

When the contents described in the above steps S25 to S27 are applied, the interference frequency band can be broadcast for the target industrial device after the target industrial device is determined to implement communication shielding of the target industrial device, and normal interaction between the industrial production control server and other devices is not affected, so that data information interaction between the target industrial device and the industrial production control server and between the target industrial device and other devices can be cut off, and it is ensured that other industrial devices in the industrial internet production system are not hacked.

During specific implementation, accurate and reliable determination of target industrial equipment is very critical, otherwise, large-scale production accidents and data potential safety hazards of an industrial internet production system can be caused. However, the inventor finds that the determined difference data of different time periods may be missing in the concrete implementation process, so that the target industrial equipment is difficult to accurately determine. For the reason that indirect correlation of each industrial device in different time periods is not considered, in order to improve the above problem, in step S24, the target industrial device having intrusion behavior is determined according to difference data between the feature data of the production state topology in the next time period and the feature data of the production state topology in the current time period, which may specifically include the following contents described in steps S241 to S245.

Step S241, extracting a first dictionary data set of the feature data of the production state topology in the next time period based on a first time sequence data flow of the feature data of the production state topology in the next time period, and extracting a second dictionary data set of the feature data of the production state topology in the current time period based on a second time sequence data flow of the feature data of the production state topology in the current time period; the first dictionary data set and the second dictionary data set respectively comprise a plurality of data segments with different feature weights, and the data segments in the first dictionary data set and the second dictionary data set do not have data categories.

Step S242, obtaining the first sequence information of one data segment of the feature data of the production state topology in the first dictionary data set in the next time period, finding out the data segment having the largest feature weight in the second dictionary data set, and determining the data segment as a template data segment.

Step S243, determining, in the template data segment, second sequence values corresponding to each first sequence value in the first sequence information based on the calculated rate of change in the node concentration level of the production state topology between the current time segment and the next time segment, and arranging the determined second sequence values in a reverse order of the corresponding first sequence values in the first sequence information to obtain second sequence information; determining a correlation coefficient between the first sequence information and the second sequence information and calculating a state correlation coefficient of each industrial device in the current time period based on the correlation coefficient; and weighting the correlation coefficient by adopting the activity corresponding to the interaction frequency between each industrial device and the industrial production control server in the current time period to obtain the state correlation coefficient.

And step S244, calculating an indirect correlation coefficient of each industrial device between the current time period and the next time period according to the state correlation coefficient.

Specifically, step S244 can be obtained by steps S2441 to S2443.

Step S2441, according to the first device associated path information and the second device associated path information corresponding to each state correlation coefficient obtained through calculation, determining information signatures of multiple pieces of path resource information to be mapped, and the information signatures and the overlapping rates between different pieces of path resource information are used for determining the state correlation change rate of the industrial device corresponding to each state correlation coefficient between the current time period and the next time period.

Step S2442, respectively mapping each state correlation change rate to the device state lists corresponding to the production state topology in the current period and the next period based on the information signature and the overlap rate to obtain a first state correlation base value and a second state correlation base value.

And step S2443, calculating an indirect correlation coefficient of each industrial device between the current time period and the next time period according to the first state correlation base value and the second state correlation base value.

Step S245, weighting the characteristic data of the production state topology in the next time period and the characteristic data of the production state topology in the current time period respectively by adopting the indirect correlation coefficient to obtain a first weighted array and a second weighted array; and determining the difference data through the array similarity between the first weighted array and the second weighted array obtained through calculation, and determining the target industrial equipment with the intrusion behavior according to the difference data.

Based on the descriptions of the steps S241 to S245, indirect correlation of each industrial device in different time periods can be considered when determining difference data in different time periods, so as to ensure that the determined difference data is not missing, and thus, a target industrial device can be accurately determined based on complete and accurate difference data.

On the basis of the above steps S241 to S245, in order to accurately and reliably determine the target industrial device, the difference data is determined by the array similarity between the first weighting array and the second weighting array obtained by calculation described in step S245, and the target industrial device with intrusion behavior is determined according to the difference data, which may exemplarily include the contents described in the following steps (1) to (4).

(1) Acquiring a first data distribution diagram of the feature data of the production state topology in the next time period and a second data distribution diagram of the feature data in the current time period, which are extracted based on the array similarity, and dividing the first data distribution diagram and the second data distribution diagram according to the same dividing density to obtain a plurality of first sub-diagrams corresponding to the first data distribution diagram and a plurality of second sub-diagrams corresponding to the second data distribution diagram.

(2) Determining a Euclidean distance between a first subgraph and a second subgraph at the same position, and determining a confidence difference value of the current Euclidean distance between the current time period and the next time period based on a first confidence of the current Euclidean distance in the current time period and a second confidence of the current Euclidean distance in the next time period aiming at the current Euclidean distance in the Euclidean distances.

(3) And determining the first target data of the first subgraph and the second target data of the second subgraph corresponding to the confidence difference value smaller than the set value as difference data.

(4) And determining a corresponding target node from the production state topology at the image position of the first data distribution diagram based on the first sub-diagram smaller than the set value, and determining the industrial equipment corresponding to the target node as target industrial equipment.

When the method described in the above steps (1) to (4) is executed, the target industrial equipment can be accurately and reliably determined based on the confidence of the euclidean distance of the data distribution map corresponding to the feature data.

In a specific implementation process, in order to ensure the feature recognition degree of the production status topology, thereby reducing the time consumption of feature data extraction, the steps of constructing the production status topology of the industrial equipment based on the status priority and extracting the feature data of the production status topology in the current time period, which are described in step S23, may be exemplarily implemented by the following steps S231 to S234.

Step S231, determining to-be-identified device tag information of the industrial device corresponding to each state priority, extracting tag dimension information of the device tag information, and obtaining a first information set including tag dimension distribution and distribution configuration information corresponding to the tag dimension distribution.

Step S232, performing correlation analysis on the device tag information of the industrial device based on the first information set, and performing gain weight calculation on target device tag information satisfying a set correlation condition to obtain a state gain weight and a tag clustering weight of the industrial device corresponding to the target device tag information.

Step S233, under the condition that the state gain weight is in a preset weight interval, determining that the industrial equipment corresponding to the state gain weight in the preset weight interval is a local central node, and determining a node connection line list of the local central node based on target equipment label information corresponding to the local central node; and constructing the production state topology according to the determined node connecting line lists of the plurality of local central nodes and the plurality of local central nodes.

Step S234, extracting feature data of the production state topology in the current time period from the state record list corresponding to each local central node according to the node connection list corresponding to each local central node.

It can be understood that through steps S231 to S234, a plurality of local center nodes and node connection line lists can be determined based on the device tag information and the state gain weight of the industrial device corresponding to each state priority, so as to ensure the feature recognition degree of the constructed production state topology. Furthermore, when extracting the feature data, the feature data can be extracted only by processing the state record list corresponding to each local central node, so that each node in the production state topology can be prevented from being analyzed, and the time consumption of extracting the feature data is reduced.

Alternatively, the determining of the state transmission data of the first operation state data in the current time period according to the set time step described in step S22 may specifically include the following contents described in step S2211 to step S2213.

Step S2211, dividing the first working state data into a plurality of data intervals according to the set step length, and determining data association degrees and data defect coefficients between two adjacent data intervals; and judging whether the first working state data has authority class identification and system class identification or not based on the determined data association degree and the data defect coefficient.

Step S2212, if it is determined that the permission type identifier and the system type identifier exist in the first working state data, calculating an interval transfer coefficient between each data interval of the first working state data under the system type identifier and each data interval of the first working state data under the permission type identifier according to a data interval of the first working state data under the permission type identifier and interval description information of the numerical value interval.

Step S2213, a data interval in which an interval transfer coefficient between the data interval of the first working state data under the system type identifier and under the authority type identifier is greater than a set coefficient is divided under the authority type identifier, and the state transfer data of the first working state data in the current time period is determined based on an authority data field corresponding to the data interval under the authority type identifier.

The data interval division can be performed on the first working state data by applying the contents described in the above steps S2211 to S2213, so that the state transfer data of the first working state data in the current time period is accurately determined according to the authority data field corresponding to the data interval.

On the basis of the above steps S2211 to S2213, in step S22, the status priority of each second operation status data in the current period is determined according to the status transmission data, which may be implemented based on the method described in the following steps S2221 to S2223.

Step S2221, controlled index information of the second working state data determined according to the authority data field set corresponding to the state transfer data is obtained.

Step S2222, for the controlled index information of the current second operating state data in the controlled index information of the second operating state data, calculate a controlled coefficient of the controlled index information of the current second operating state data in the current time period according to first control response information of the controlled index information of the current second operating state data in the current time period and second control response information of the controlled index information of each second operating state data in the current time period.

Step S2223, determining the state priority of the current second working state data in the current time period based on the controlled coefficient of the controlled index information of the current second working state data in the current time period and the matching degree between the current second working state data and the permission data field set.

It can be understood that through the above steps described in the above steps S2221 to S2223, the state priority of the second operation state data in the current time period can be accurately and reliably determined based on the controlled index information of the second operation state data determined by the permission data field set.

Based on the same inventive concept, a data processing device for big data and edge calculation is also provided, and the specific description about the device is as follows.

A1. A big data and edge calculation data processing device is applied to an artificial intelligence server, the artificial intelligence server is communicated with an industrial production control server and a plurality of industrial devices which are mutually communicated, and the device at least comprises the following functional modules:

the state data acquisition module is used for detecting and acquiring a first business production identifier of an industrial production control server and a second business production identifier of each industrial device, and acquiring first working state data of the industrial production control server and second working state data of each industrial device under the condition that the first business production identifier and the second business production identifier are the same;

the priority determining module is used for determining state transmission data of the first working state data in the current time period according to the set time step, and determining the state priority of each second working state data in the current time period according to the state transmission data;

the state topology construction module is used for constructing the production state topology of the industrial equipment based on the state priority and extracting the characteristic data of the production state topology in the current time period;

and the intrusion behavior judging module is used for determining the target industrial equipment with the intrusion behavior according to the difference data between the characteristic data of the production state topology in the next time period and the characteristic data of the production state topology in the current time period if the characteristic data of the production state topology in the next time period is inconsistent with the characteristic data of the production state topology in the current time period under the condition that the first service production identifier and the second service production identifier are still the same in the next time period of the current time period.

A2. The data processing apparatus according to a1, the apparatus further comprising at least an intrusion behavior processing module for: extracting a communication protocol text of the target industrial equipment; identifying a communication path of the communication protocol text to obtain a plurality of pieces of communication path information included in the communication protocol text; and determining a communication frequency band corresponding to each piece of communication path information, and broadcasting an interference frequency band corresponding to the communication frequency band in the communication range of the target industrial equipment based on the communication frequency band so as to realize communication shielding of the target industrial equipment.

A3. According to the data processing apparatus of a1 or a2, an intrusion behavior determination module configured to:

extracting a first dictionary data set of the feature data of the production state topology in the next time period based on a first time-series data flow of the feature data of the production state topology in the next time period, and extracting a second dictionary data set of the feature data of the production state topology in the current time period based on a second time-series data flow of the feature data of the production state topology in the current time period; wherein the first dictionary data set and the second dictionary data set both comprise a plurality of data segments with different feature weights, and the data segments in the first dictionary data set and the second dictionary data set do not have data categories;

acquiring first sequence information of one data segment of the feature data of the production state topology in the first dictionary data set in the next time period, searching the data segment with the maximum feature weight in the second dictionary data set, and determining the data segment as a template data segment;

determining second sequence values corresponding to each first sequence value in the first sequence information in the template data segment based on the calculated change rate of the production state topology in the node concentration degree between the current time segment and the next time segment, and arranging the determined second sequence values according to the reverse order of the sequence of the corresponding first sequence values in the first sequence information to obtain second sequence information; determining a correlation coefficient between the first sequence information and the second sequence information and calculating a state correlation coefficient of each industrial device in the current time period based on the correlation coefficient; the state correlation coefficient is obtained by weighting the correlation coefficient by adopting the activity corresponding to the interaction frequency between each industrial device and the industrial production control server in the current time period;

calculating an indirect correlation coefficient of each industrial device between the current time period and the next time period according to the state correlation coefficient;

weighting the characteristic data of the production state topology in the next time period and the characteristic data of the production state topology in the current time period respectively by adopting the indirect correlation coefficient to obtain a first weighted array and a second weighted array; and determining the difference data through the array similarity between the first weighted array and the second weighted array obtained through calculation, and determining the target industrial equipment with the intrusion behavior according to the difference data.

A4. The data processing apparatus of a3, the intrusion behavior determination module further configured to:

according to the first device associated path information and the second device associated path information corresponding to each state correlation coefficient obtained through calculation, determining information signatures to be mapped and used for determining a plurality of path resource information of state correlation change rates of industrial devices in the current time period and the next time period corresponding to each state correlation coefficient, and overlapping rates of different path resource information;

respectively mapping each state correlation change rate to a device state list corresponding to the production state topology in the current period and the next period based on the information signature and the overlapping rate to obtain a first state correlation base value and a second state correlation base value;

and calculating an indirect correlation coefficient of each industrial device between the current time period and the next time period according to the first state correlation base value and the second state correlation base value.

A5. The data processing apparatus of a3, the intrusion behavior determination module further configured to:

acquiring a first data distribution diagram of the feature data of the production state topology in the next time period and a second data distribution diagram of the feature data in the current time period, which are extracted based on the array similarity, and dividing the first data distribution diagram and the second data distribution diagram according to the same division density to obtain a plurality of first sub-diagrams corresponding to the first data distribution diagram and a plurality of second sub-diagrams corresponding to the second data distribution diagram;

determining a Euclidean distance between a first subgraph and a second subgraph at the same position, and determining a confidence difference value of the current Euclidean distance between the current time period and the next time period based on a first confidence of the current Euclidean distance in the current time period and a second confidence of the current Euclidean distance in the next time period aiming at the current Euclidean distance;

determining first target data of a first sub-graph and second target data of a second sub-graph corresponding to the confidence coefficient difference value smaller than the set value as difference data;

and determining a corresponding target node from the production state topology at the image position of the first data distribution diagram based on the first sub-diagram smaller than the set value, and determining the industrial equipment corresponding to the target node as target industrial equipment.

A6. The data processing apparatus of a1, the state topology construction module to:

determining equipment label information to be identified of the industrial equipment corresponding to each state priority, extracting label dimension information of the equipment label information, and obtaining a first information set comprising label dimension distribution and distribution configuration information corresponding to the label dimension distribution;

performing correlation analysis on the equipment tag information of the industrial equipment based on the first information set, and performing gain weight calculation on target equipment tag information meeting set correlation conditions to obtain a state gain weight and a tag clustering weight of the industrial equipment corresponding to the target equipment tag information;

under the condition that the state gain weight is in a preset weight interval, determining that the industrial equipment corresponding to the state gain weight in the preset weight interval is a local central node, and determining a node connection line list of the local central node based on target equipment label information corresponding to the local central node; constructing the production state topology according to the determined node connecting line lists of the plurality of local central nodes and the plurality of local central nodes;

and extracting the characteristic data of the production state topology in the current period from the state record list corresponding to each local central node according to the node connecting line list corresponding to each local central node.

A7. The data processing apparatus of a1, the priority determination module to:

dividing the first working state data into a plurality of data intervals according to the set step length, and determining data association degree and data defect coefficient between two adjacent data intervals; judging whether the first working state data has authority class identification and system class identification or not based on the determined data association degree and the data defect coefficient;

if the authority category identifier and the system category identifier exist in the first working state data, calculating an interval transfer coefficient between each data interval of the first working state data under the system category identifier and each data interval of the first working state data under the authority category identifier according to a data interval of the first working state data under the authority category identifier and interval description information of the numerical value interval;

dividing a data interval of the first working state data, which has an interval transfer coefficient greater than a set coefficient, between the data interval of the first working state data under the system type identifier and the data interval under the authority type identifier, and determining the state transfer data of the first working state data in the current time interval based on an authority data field corresponding to the data interval under the authority type identifier.

A8. The data processing apparatus of a7, the priority determination module to:

acquiring controlled index information of second working state data determined according to the authority data field set corresponding to the state transfer data;

for the controlled index information of the current second working state data in the controlled index information of the second working state data, calculating a controlled coefficient of the controlled index information of the current second working state data in the current time period according to first control response information of the controlled index information of the current second working state data in the current time period and second control response information of the controlled index information of each second working state data in the current time period;

and determining the state priority of the current second working state data in the current time period based on the controlled coefficient of the controlled index information of the current second working state data in the current time period and the matching degree between the current second working state data and the permission data field set.

For the description of the functional modules, reference is made to the description of the corresponding method steps, which are not further described here.

Based on the same inventive concept, a data processing system for big data and edge calculation is also provided, which is described in detail as follows.

B1. A big data and edge calculation data processing system comprises an artificial intelligence server, an industrial production control server and a plurality of industrial devices, wherein the artificial intelligence server is communicated with the industrial production control server and the industrial devices which are in communication connection with each other;

the artificial intelligence server is used for:

B2. The data processing system of B1, the artificial intelligence server further configured to: extracting a communication protocol text of the target industrial equipment; identifying a communication path of the communication protocol text to obtain a plurality of pieces of communication path information included in the communication protocol text; and determining a communication frequency band corresponding to each piece of communication path information, and broadcasting an interference frequency band corresponding to the communication frequency band in the communication range of the target industrial equipment based on the communication frequency band so as to realize communication shielding of the target industrial equipment.

B3. The data processing system of B1 or B2, the artificial intelligence server to:

B4. The data processing system of B3, the artificial intelligence server configured to:

B5. The data processing system of B3, the artificial intelligence server configured to:

B6. The data processing system of B1, the artificial intelligence server configured to:

B7. The data processing system of B1, the artificial intelligence server configured to:

B8. The data processing system of B7, the artificial intelligence server configured to:

On the basis, please refer to fig. 3 in combination, there is also provided an artificial intelligence server 200, including: a processor 210, and a memory 220 and a network interface 230 connected to the processor 210. The network interface 220 is connected to the non-volatile memory 240 in the artificial intelligence server 200. The processor 210 retrieves a computer program from the non-volatile memory 240 via the network interface 230 and runs the computer program via the memory 220 to perform the above-described method.

Likewise, a computer-readable storage medium is also provided, which is burned with a computer program, which when run in the memory 220 of the artificial intelligence server 200 implements the above-described method.

Claims

1. A data processing method for big data and edge calculation is applied to an artificial intelligence server which is communicated with an industrial production control server and a plurality of industrial devices which are mutually communicated, and the method at least comprises the following steps:

under the condition that the first service production identifier and the second service production identifier are still the same in the next time period of the current time period, if the feature data of the production state topology in the next time period is inconsistent with the feature data of the production state topology in the current time period, determining target industrial equipment with intrusion behavior according to difference data between the feature data of the production state topology in the next time period and the feature data of the production state topology in the current time period;

wherein determining the state priority of each second operating state data in the current time period according to the state transfer data comprises:

2. A data processing method according to claim 1, characterized in that the method comprises at least the following further steps:

extracting a communication protocol text of the target industrial equipment;

identifying a communication path of the communication protocol text to obtain a plurality of pieces of communication path information included in the communication protocol text;

and determining a communication frequency band corresponding to each piece of communication path information, and broadcasting an interference frequency band corresponding to the communication frequency band in the communication range of the target industrial equipment based on the communication frequency band so as to realize communication shielding of the target industrial equipment.

3. The data processing method according to claim 1 or 2, wherein the target industrial device with intrusion behavior is determined according to difference data between the feature data of the production state topology in the next time period and the feature data of the production state topology in the current time period, further comprising:

4. The data processing method according to claim 3, wherein calculating an indirect correlation coefficient between the current time period and the next time period of each industrial device according to the state correlation coefficient specifically comprises:

5. The data processing method according to claim 3, wherein determining the difference data by calculating an array similarity between the first weighted array and the second weighted array, and determining a target industrial device having an intrusion behavior according to the difference data specifically comprises:

6. The data processing method according to claim 1, wherein constructing a production state topology of the industrial device based on the state priority, and extracting feature data of the production state topology in a current period specifically comprises:

7. An artificial intelligence server, comprising:

a processor, and

a memory and a network interface connected with the processor;

the network interface is connected with a nonvolatile memory in the artificial intelligence server;

the processor, when running, retrieves a computer program from the non-volatile memory via the network interface and runs the computer program via the memory to perform the method of any of claims 1-6 above.

8. A computer-readable storage medium, characterized in that the computer-readable storage medium is recorded with a computer program, and the computer program is used for implementing the method of any one of the above claims 1-6 when the computer program runs in the internal memory of the artificial intelligence server.