CN115271407B

CN115271407B - Industrial Internet data processing method and system based on artificial intelligence

Info

Publication number: CN115271407B
Application number: CN202210856740.XA
Authority: CN
Inventors: 任胜林
Original assignee: Inner Mongolia Huaifeng Technology Co ltd
Current assignee: Inner Mongolia Huaifeng Technology Co ltd
Priority date: 2022-07-21
Filing date: 2022-07-21
Publication date: 2023-09-26
Anticipated expiration: 2042-07-21
Also published as: CN115271407A

Abstract

According to the industrial Internet data processing method and system based on artificial intelligence, a first event capturing report obtained by capturing risk events through current cloud service interaction information of a digital intelligent production line is obtained, then the first event capturing report is adjusted based on prior capturing report indication of the digital intelligent production line to obtain a first tracking analysis report, and then the first tracking analysis report is checked according to prior capturing report indication of potential risk interaction events and a knowledge unit relation network corresponding to the first tracking analysis report to obtain a first checked analysis report. Therefore, the linkage analysis processing of the first event capturing report and the priori capturing report indication of the digital intelligent production line can be realized, and the correlation characteristics of the first event capturing report and the priori capturing report indication are fully mined, so that the obtained first calibrated analysis report can record and output the description vector of the potential risk interaction event as accurately, completely and reliably as possible.

Description

Industrial Internet data processing method and system based on artificial intelligence

Technical Field

The invention relates to the technical field of artificial intelligence, in particular to an industrial Internet data processing method and system based on artificial intelligence.

Background

From the perspective of network infrastructure development, the industrial internet is an important content of network construction.

On the one hand, the industrial Internet can accelerate network evolution and upgrade, promote the public Internet of people and people interconnection and the Internet of things and things interconnection to people, machines, things, systems and the like to comprehensively interconnect and expand, and greatly improve the supporting service capability of network facilities.

On the other hand, the industrial internet can expand the digital economic space. In view of the strong permeability of the industrial Internet, the method can be deeply fused with various fields of entity economy such as traffic, logistics, energy, medical treatment, agriculture and the like, realizes the wide interconnection and intercommunication of industrial upstream and downstream and across fields, promotes the scientific spanning of network application from virtual to entity and living to production, and greatly expands the development space of network economy.

At present, the industrial internet is increasingly widely applied to intelligent production, and the data security problems caused by the industrial internet are not ignored, so that how to analyze and process risk events in the industrial internet interaction process with high quality is a current technical problem.

Disclosure of Invention

In order to improve the technical problems in the related art, the invention provides an industrial Internet data processing method and system based on artificial intelligence.

In a first aspect, an embodiment of the present invention provides an industrial internet data processing method based on artificial intelligence, which is applied to an artificial intelligence service system, and the method at least includes: acquiring a first event capturing report obtained by capturing risk events according to current cloud service interaction information of a digital intelligent production line; utilizing an priori capture report instruction of the digital intelligent production line to adjust the first event capture report to obtain a first tracking analysis report of a potential risk interaction event in the current cloud service interaction information; and combining the knowledge unit relation network corresponding to the first tracking analysis report to calibrate the first tracking analysis report to obtain a first calibrated analysis report of the potential risk interaction event.

By applying the embodiment, the first event capturing report obtained by capturing the risk event with respect to the current cloud service interaction information of the digital intelligent production line can be obtained, then the first event capturing report is adjusted based on the prior capturing report indication of the digital intelligent production line, the first tracking analysis report of the potential risk interaction event in the current cloud service interaction information is obtained, and then the first tracking analysis report is checked according to the prior capturing report indication of the potential risk interaction event and the knowledge unit relation network corresponding to the first tracking analysis report, so that the first checked analysis report of the potential risk interaction event is obtained. Therefore, the linkage analysis processing of the first event capturing report and the priori capturing report indication of the digital intelligent production line can be realized, and the correlation characteristics of the first event capturing report and the priori capturing report indication are fully mined, so that the obtained first calibrated analysis report can record and output the description vector of the potential risk interaction event as accurately, completely and reliably as possible.

In a possible technical solution, the adjusting the first event capturing report by using the a priori capturing report indication of the digital intelligent production line to obtain a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information includes:

determining, with the a priori capture report indication of the digital intelligent production line, a risk event classification annotation of the first event capture report, wherein the risk event classification annotation is used to distinguish the potential risk interaction event;

and adjusting the first event capturing report by combining the risk event classification annotation of the first event capturing report to obtain a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information.

In one possible solution, the determining, using an a priori capture report indication of the digital intelligent production line, a risk event classification annotation of the first event capture report includes:

pairing an a priori capture report indication of the digital intelligent production line with the first event capture report;

and on the basis of pairing the first event capture report with the prior capture report indication, taking the risk event classification annotation indicated by the prior capture report as the risk event classification annotation of the first event capture report.

In one possible solution, the determining, using an a priori capture report indication of the digital intelligent production line, a risk event classification annotation of the first event capture report includes: a specified risk event classification annotation is added to the first event capture report based on the first event capture report indicating unpaired with the prior capture report.

In one possible solution, the pairing the a priori capture report indication of the digital intelligent production line with the first event capture report includes:

determining a first content window size where the first event capture report coincides with a constraint content set indicated by an a priori capture report, and determining a global content window size where the constraint content set of the first event capture report overlaps with the constraint content set indicated by the a priori capture report;

a pairing index of the first event capture report with the a priori capture report indication is determined in conjunction with a ratio of the first content window size to the global content window size.

And using an priori capture report indication of the digital intelligent production line, and on the basis of determining that the first event capture report does not capture the acquired potential risk interaction event in the current cloud service interaction information, using the priori capture report indication of the potential risk interaction event which is not captured as a first tracking analysis report of the potential risk interaction event which is not captured in the current cloud service interaction information.

In a possible technical solution, the verifying the first tracking analysis report in combination with the knowledge unit relationship network corresponding to the first tracking analysis report to obtain a first verified analysis report of the potential risk interaction event includes:

carrying out relationship network fusion on a priori capture report indicating corresponding knowledge unit relationship network of the same potential risk interaction event and a knowledge unit relationship network corresponding to the first tracking analysis report to obtain a fused knowledge unit relationship network;

and obtaining a first calibrated analysis report for calibrating the first tracking analysis report by using the integrated knowledge unit relation network.

In one possible technical solution, the performing relationship network fusion on the prior capture report of the same risk potential interaction event indicates a corresponding knowledge unit relationship network and a knowledge unit relationship network corresponding to the first tracking analysis report includes: and for the same potential risk interaction event, carrying out relationship network fusion on a knowledge unit relationship network corresponding to the prior capture report indication of the cloud service interaction information of the last group of the current cloud service interaction information and a knowledge unit relationship network corresponding to the first tracking analysis report.

In one possible solution, the method further includes:

obtaining a calibrated analysis report of the potential risk interaction event, wherein the calibrated analysis report comprises the first calibrated analysis report and a second calibrated analysis report, and the second calibrated analysis report is obtained by capturing the risk event based on prior cloud service interaction information of a digital intelligent production line;

determining a current captured report indication of the potential risk interaction event using a target analysis report of the collated analysis reports;

wherein the current capture report indicates that a sum of bias variables from a number of the target analysis reports satisfies a set condition.

In one possible solution, the method further includes:

determining deviation variables of a first proofed analysis report and a plurality of second proofed analysis reports in the proofed analysis reports, wherein the first proofed analysis report is one of the proofed analysis reports, and the second proofed analysis report is a proofed content set outside the first proofed analysis report;

determining a correlation report number corresponding to the first calibrated analysis report, wherein the correlation report number is the number of second calibrated analysis reports with the deviation variable of the first calibrated analysis report smaller than the deviation variable determination value;

And determining a target analysis report in the calibrated analysis report according to the association report number corresponding to the first calibrated analysis report.

In one possible technical solution, the determining, in combination with the association report number corresponding to the first calibrated analysis report, the target analysis report in the calibrated analysis report includes:

determining a first collated analysis report with the largest association report number in a plurality of first collated analysis reports;

and taking the first calibrated analysis report with the largest associated report number and the second calibrated analysis report with the first calibrated analysis report with the largest associated report number and the deviation variable smaller than the deviation variable judgment value as target analysis reports in the calibrated analysis reports.

In a second aspect, the present invention also provides an artificial intelligence service system, including a processor and a memory; the processor is in communication with the memory, and the processor is configured to read the computer program from the memory and execute the computer program to implement the method described above.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.

Fig. 1 is a schematic flow chart of an industrial internet data processing method based on artificial intelligence according to an embodiment of the invention.

Fig. 2 is a schematic diagram of a communication architecture of an application environment of an industrial internet data processing method based on artificial intelligence according to an embodiment of the present invention.

Detailed Description

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the invention. Rather, they are merely examples of apparatus and methods consistent with aspects of the invention as detailed in the accompanying claims.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order.

The method embodiments provided by the embodiments of the present invention may be implemented in an artificial intelligence service system, a computer device, or similar computing device. Taking the example of operating on an artificial intelligence service system, the artificial intelligence service system 10 may include one or more processors 102 (the processor 102 may include, but is not limited to, a microprocessor MCU, a programmable logic device FPGA, etc. processing means) and a memory 104 for storing data, and optionally the artificial intelligence service system may also include transmission means 106 for communication functions. It will be appreciated by those of ordinary skill in the art that the above-described architecture is merely illustrative and is not intended to limit the architecture of the artificial intelligence service system described above. For example, the artificial intelligence service system 10 may also include more or fewer components than shown above, or have a different configuration than shown above.

The memory 104 may be used to store a computer program, for example, a software program of application software and a module, such as a computer program corresponding to an industrial internet data processing method based on artificial intelligence in an embodiment of the present invention, and the processor 102 executes the computer program stored in the memory 104 to perform various functional applications and data processing, that is, implement the above-mentioned method. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory remotely located with respect to processor 102, which may be connected to artificial intelligence service system 10 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission means 106 is arranged to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the artificial intelligence service system 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, simply referred to as NIC) that can connect to other network devices through a base station to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is used to communicate with the internet wirelessly.

Based on this, referring to fig. 1, fig. 1 is a schematic flow chart of an industrial internet data processing method based on artificial intelligence according to an embodiment of the present invention, where the method is applied to an artificial intelligence service system, and further may include the following technical solutions described below.

NODE11 obtains the first event capturing report obtained by capturing risk events according to the current cloud service interaction information of the digital intelligent production line.

In the embodiment of the invention, the artificial intelligent service system can collect the interaction information of the digital intelligent production line (digital production environment or digital production task) to obtain the current cloud service interaction information of the digital intelligent production line, or the artificial intelligent service system can obtain the current cloud service interaction information of the digital intelligent production line from other servers. The current cloud service interaction information may be a text message, for example, the current cloud service interaction information may be an interaction log text of the digital intelligent production line, or the current cloud service interaction information may also be a knowledge unit relationship network (a feature map or feature distribution composed of knowledge feature points) collected for the digital intelligent production line. Further, risk event capturing can be performed on the current cloud service interaction information, and a first event capturing report is obtained.

In the embodiment of the invention, risk event capturing can be performed on the current cloud service interaction information based on a related risk event positioning algorithm (such as an AI-based risk mining model CNN, DNN and the like). The first event capture report may be a constraint content set obtained by capturing the risk event with respect to the current cloud service interaction information, and the constraint content set may indicate a distribution tag and windowed data corresponding to the potential risk interaction event, so that the first event capture report may include the distribution tag information and the windowed data information. The constraint type content set can be used for carrying out data region calibration and marking in a window constraint mode, and the distribution label and the windowed data of the potential risk interaction event corresponding to the constraint type content set can be the distribution label and the windowed data of the potential risk interaction event in the digital intelligent production line. The first event capture report may be deemed a preliminarily generated event capture report. In some embodiments, the artificial intelligence service system also obtains the first event capture report directly from the other server.

Further, the distribution label where the first event capturing report corresponds to the potential risk interaction event may be a distribution label of the potential risk interaction event in a production line mapping space (a global feature mapping space built based on the existing AI technology) of the digital intelligent production line, for example, the first event capturing report may include a positioning variable of the potential risk interaction event in the production line mapping space. The artificial intelligence service system can directly obtain a first event capture report that includes tags of the potential risk interaction event distributed under the production line map space.

In some embodiments, a distribution label of the potential risk interaction event in a service interaction mapping space (a local feature mapping space built based on the existing AI technology) can be obtained first, and then the distribution label of the potential risk interaction event in the service interaction mapping space can be changed into a distribution label of the potential risk interaction event in the production line mapping space according to a relative distribution label transformation relationship between the service interaction mapping space and the production line mapping space. The potentially risky interaction event may be a security threat, vulnerability event, etc. existing in the digital intelligent production line, for example, the potentially risky interaction event may be a data leak, a firewall defect, a traffic attack, etc. The first event capture report may also include risk event classification annotations (class labels or event identifications) for the corresponding potential risk interaction events, such that the potential risk interaction event indicated by the first event capture report can be determined from the risk event classification annotations of the first event capture report.

And the NODE12 utilizes the prior capture report instruction of the digital intelligent production line to adjust the first event capture report so as to obtain a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information.

In the embodiment of the invention, the prior capture report indication of the digital intelligent production line can be an event capture report of the potential risk interaction event obtained by improving the second event capture report, and the prior capture report indication can indicate the distribution label where the potential risk interaction event is located as accurately as possible. The second event capturing report may be obtained by capturing risk events with respect to all or part of prior cloud service interaction information of the digital intelligent production line, the prior cloud service interaction information may be cloud service interaction information collected before the current cloud service interaction information, and the second event capturing report may be a prior event capturing report of a potential risk interaction event. In an embodiment of the present invention, the second event capture report may have a similar concept to that of the first event capture report. Further, the second event capture report may be a constrained content set obtained by risk event capture for a priori cloud service interaction information, and the second event capture report may include distribution tag information and windowed data information.

It may be appreciated that one risk potential interaction event in the digital intelligent production line may correspond to one prior capture report indication, in other words, a plurality of second event capture reports obtained by capturing risk events according to all or part of prior cloud service interaction information may obtain one prior capture report indication of each risk potential interaction event, and after obtaining a new capture report indication of one risk potential interaction event, the recorded prior capture report indication may be adjusted, so that one risk potential interaction event corresponds to one prior capture report indication, and thus the recorded prior capture report indication is reduced.

In some embodiments, the capturing report indication corresponding to each cloud service interaction information may also be recorded, and on the basis of improved optimization of event capturing report with respect to each cloud service interaction information of the digital intelligent production line, the prior capturing report indication mentioned in the NODE12 may be considered as the capturing report indication corresponding to the last group of cloud service interaction information of the current cloud service interaction information.

In the embodiment of the invention, the first event capture report can be adjusted based on the prior capture report indication of the digital intelligent production line, for example, the prior capture report indication can be paired with the first event capture report, and the association between the potential risk interaction event corresponding to the first event capture report and the historical potential risk interaction event corresponding to the prior capture report indication can be established. Based on the association between the risk potential interaction event corresponding to the first event capture report and the historical risk potential interaction event corresponding to the prior capture report indication, the first event capture report may be adjusted, for example, a risk event classification annotation of the first event capture report may be determined, or the prior capture report indication of the same risk potential interaction event and the first event capture report may be relational-network fused, for example, a constraint content set corresponding to the prior capture report indication and a constraint content set corresponding to the first event capture report may be relational-network fused.

In this way, by adjusting the first event capturing report based on the prior capturing report indication of the digital intelligent production line, a corresponding relationship between the potential risk interaction event of the current cloud service interaction information and the potential risk interaction event of the prior cloud service interaction information can be created, so that the obtained first tracking analysis report carries risk event classification annotation as accurate and reliable as possible. The first trace analysis report may also be a constraint type content set, and further, the first trace analysis report may include distribution tag information and windowed data information of the potential risk interaction event.

And the NODE13 is combined with the knowledge unit relation network corresponding to the first tracking analysis report to calibrate the first tracking analysis report, so that a first calibrated analysis report of the potential risk interaction event is obtained.

In the embodiment of the invention, aiming at one potential risk interaction event in the digital intelligent production line, the potential risk interaction event may exist in the current cloud service interaction information or may exist in one or a plurality of priori cloud service interaction information, so that the one potential risk interaction event in the current cloud service interaction information may have a first tracking analysis report, and in some embodiments, may also have an a priori capture report indication. On the basis that only a first tracking analysis report exists in one potential risk interaction event in the current cloud service interaction information, the first tracking analysis report can be checked according to a knowledge unit relation network corresponding to the first tracking analysis report of the potential risk interaction event, and a first checked analysis report of the potential risk interaction event is obtained. Based on the indication that one potential risk interaction event in the current cloud service interaction information not only has the first tracking analysis report but also has the prior capture report, the first tracking analysis report can be checked according to the knowledge unit relation network corresponding to the first tracking analysis report of the potential risk interaction event and the knowledge unit relation network corresponding to the prior capture report indication, so as to obtain a first checked analysis report of the potential risk interaction event.

Further, the error information which is more prominent in the knowledge unit relation network corresponding to the first tracking analysis report and/or the prior capture report indication of the potential risk interaction event can be cleaned, or the data information can be completed for the knowledge unit relation network corresponding to the first tracking analysis report, so that the first calibrated analysis report of the potential risk interaction event can be obtained. Therefore, the first calibrated analysis report can reflect the distribution label of the potential risk interaction event in the current cloud service interaction information in the digital intelligent production line as accurately and reliably as possible.

In the embodiment of the invention, on the basis that the current cloud service interaction information is text information, the text information can be changed into the knowledge unit relation network according to the word vector of the text information. A priori capture report indication and/or a knowledge unit relationship net corresponding to the first tracking analysis report may then be obtained.

In the embodiment of the invention, the first event capturing report can be adjusted through the priori capturing report indication of the digital intelligent production line, so that the association between the current cloud service interaction information and the priori cloud service interaction information can be created.

In some possible embodiments, the risk event classification annotation of the first event capture report may be determined based on an a priori capture report indication of the digital intelligent production line. And then, the first event capturing report can be adjusted according to the risk event classification annotation of the first event capturing report, so that a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information is obtained. Wherein risk event classification annotations are used to distinguish potential risk interaction events.

The risk event classification annotation of the first event capture report can be determined by using the prior capture report indication of the potential risk interaction event in the digital intelligent production line, for example, the potential risk interaction event indicated by the prior capture report indication and the potential risk interaction event indicated by the first event capture report can be considered to be the same potential risk interaction event on the basis that the constraint type content set indicated by the prior capture report indication coincides with the constraint type content set of the first event capture report, so that the risk event classification annotation indicated by the prior capture report can be used as the risk event classification annotation corresponding to the first event capture report.

For another example, on the basis that none of the constrained content sets indicated by one of the prior capture reports coincides with the constrained content set of the first event capture report, the potentially risky interactive event indicated by the first event capture report may be deemed to be an additionally captured potentially risky interactive event in the digital intelligent production line, so that a new risk event classification annotation can be created to reflect the potentially risky interactive event indicated by the first event capture report. By determining risk event classification annotations for the first event capture report, a correspondence between a priori capture report indications and the first event capture report may be generated, thereby improving the accuracy and reliability of risk event analysis.

In some embodiments, the a priori capture report indication of the digital intelligent production line may be paired with the first event capture report, and the risk event classification annotation indicated by the a priori capture report is taken as the risk event classification annotation of the first event capture report based on the pairing of the first event capture report with the a priori capture report indication.

For some embodiments, a priori capture report indication of the digital intelligent production line may be paired with the first event capture report, e.g., a constrained content set of the a priori capture report indication may be determined to be paired with a constrained content set of the first event capture report, and a pairing index of the a priori capture report indication with the first event capture report may be determined. For a first event capture report, the a priori capture report indication with the highest pairing index and greater than the pairing index determination value of the first event capture report can be used as the a priori capture report indication paired with the first event capture report, further the risk event classification annotation indicated by the a priori capture report paired with the first event capture report can be used as the risk event classification annotation of the first event capture report, so as to obtain a first tracking analysis report of potential risk interaction events, and the first tracking analysis report can be the first event capture report after the risk event classification annotation is adjusted. By pairing the a priori capture report indication of the digital intelligent production line with the first event capture report, the association between the first event capture report and the a priori capture report indication can be determined, and thus the first event capture report can be further adjusted to obtain a first tracking analysis report carrying accurate and reliable risk event classification annotations.

In the embodiment of the invention, the prior capture report indication of the digital intelligent production line is paired with the first event capture report, a first content window size, in which a constraint content set of the first event capture report coincides with a constraint content set indicated by the prior capture report, is determined, a global content window size, in which the constraint content set of the first event capture report and the constraint content set indicated by the prior capture report are overlaid together, is determined, and then a ratio of the first content window size to the global content window size is taken as a pairing index of the prior capture report indication and the first event capture report. In other words, the quantitative comparison between the constrained content set of a first event capture report and the constrained content set indicated by an a priori capture report (e.g., by comparison analysis based on intersection and union) may be used as a pairing index for the event capture report and the a priori capture report.

In some examples, a specified (new) risk event classification annotation is added to the first event capture report based on the first event capture report indicating unpairement with the prior capture report.

For some embodiments, if the pairing index indicated by the first event capture report and one of the prior capture reports is below the pairing index determination value, the first event capture report and one of the prior capture report indications are not paired, such that the first event capture report may be deemed to be an event capture report of a potentially risky interaction event additionally captured in the digital intelligent production line, thereby adding a specified risk event classification annotation to the first event capture report. The first event capture report may be made to correspond to an additionally captured potentially risk interaction event by adding a specified risk event classification annotation to the first event capture report based on the first event capture report indicating unpaired with the prior capture report in the current digital intelligent production line.

In another possible embodiment, based on the a priori capture report indication of the digital intelligent production line, on the basis of determining that the first event capture report does not capture the obtained risk interaction event in the information statistics range of the current cloud service interaction information, the a priori capture report indication of the risk interaction event which is not captured is used as the first tracking analysis report of the risk interaction event which is not captured in the current cloud service interaction information.

The prior capture report instructions may be obtained by capturing risk events based on prior cloud service interaction information of the digital intelligent production line, the same potential risk interaction event captured in the plurality of prior cloud service interaction information may correspond to one prior capture report instruction, the prior capture report instruction may include distribution tag information of the potential risk interaction event and risk event classification annotation, and the potential risk interaction event existing in the digital intelligent production line may be determined according to the prior capture report instruction of the prior cloud service interaction information. A potential risk interaction event can be captured in an information statistics range of the current cloud service interaction information according to the prior capture report indication, but a first event capture report of the current cloud service interaction information indicates that the potential risk interaction event is not captured in the current cloud service interaction information, the problem of capture omission of the current cloud service interaction information can be identified, and the prior capture report indication of the potential risk interaction event which is not captured can be used as a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information, so that capture omission is reduced, and the accuracy and reliability of event capture and analysis are improved.

In the NODE13, the first trace analysis report may be collated to obtain a first collated analysis report. The first collated analysis report has as accurate and reliable distribution tag information as possible compared to the first tracking analysis report to improve the accuracy and reliability of event capture and analysis.

In another possible embodiment, the knowledge unit relationship network indicated by the prior capture report of the same potential risk interaction event and the knowledge unit relationship network corresponding to the first tracking analysis report may be subjected to relationship network fusion, so as to obtain a fused knowledge unit relationship network. And then, based on the integrated knowledge unit relation network, obtaining a first calibrated analysis report for calibrating the first tracking analysis report.

Wherein the a priori capture report indication and the first trace analysis report belonging to the same potential risk interaction event may be determined from the risk event classification annotation of the a priori capture report indication and the first trace analysis report risk event classification annotation. Because the risk event classification annotation can label the potential risk interaction event, the prior capture report indication and the first tracking analysis report can be considered to belong to the same potential risk interaction event on the basis of the same risk event classification annotation. For the same potential risk interaction event, a knowledge unit relation network in the constraint type content set indicated by the prior capture report and a knowledge unit relation network in the constraint type content set of the first tracking analysis report can be obtained, and the relationship network fusion is carried out on the knowledge unit relation network corresponding to the prior capture report and the knowledge unit relation network corresponding to the first tracking analysis report, for example, the knowledge unit relation network corresponding to the prior capture report and the knowledge unit relation network corresponding to the first tracking analysis report are obtained and combined to obtain a fused knowledge unit relation network of the potential risk interaction event. And according to the integrated knowledge unit relation network, the first tracking analysis report can be proofreaded, and a first proofreaded analysis report of the potential risk interaction event is obtained.

For example, a fused knowledge unit relationship network of potential risk interaction events can be input into a deep learning model, and the deep learning model is utilized to correct the distribution label information of the first tracking analysis report, so as to obtain a first corrected analysis report derived by the deep learning model. Based on the method, a first calibrated analysis report with the distribution label information as accurate and reliable as possible can be obtained by utilizing the relation network of the integrated knowledge units of the same risk event, so that prior information (such as the distribution label information indicated by the prior capture report) of the same potential risk interaction event can be considered in the event capture analysis process, and the accuracy and the reliability of risk event analysis are improved.

In case of performing correction and improvement on the first tracking analysis report of each cloud service interaction information, each cloud service interaction information can correspond to a capture report indication of a potential risk interaction event, so that on the basis of performing correction and improvement on the first tracking analysis report of the current cloud service interaction information, for the same potential risk interaction event, a priori capture report indication of the previous group of cloud service interaction information of the current cloud service interaction information and a knowledge unit relationship network corresponding to the first tracking analysis report can be combined, the priori capture report indication of the previous group of cloud service interaction information of the current cloud service interaction information is utilized to perform correction on the first tracking analysis report of the current cloud service interaction information, and as the priori capture report indication of the previous group of cloud service interaction information of the current cloud service interaction information is the latest record, the priori capture report indication of the current cloud service interaction information is more accurate and reliable than the priori capture report indication corresponding to other prior cloud service interaction information, and therefore the first tracking analysis report of the current cloud service interaction information can be corrected by using the priori capture report indication of the previous group of the cloud service interaction information, and the obtained first tracking analysis report is more accurate and reliable.

In some embodiments, if the first tracking analysis report of the collected part of the cloud service interaction information is checked and improved, for example, the cloud service interaction information is checked and improved by selecting every set number of cloud service interaction information, so that not every cloud service interaction information corresponds to a capturing report indication of a potential risk interaction event. In this case, on the basis of the correction and improvement of the first tracking analysis report for the current cloud service interaction information, for the same risk potential interaction event, the prior capture report of the latest record of the risk potential interaction event may be selected to indicate the correction of the first tracking analysis report for the current cloud service interaction information.

In addition, to further increase the accuracy and reliability of the event capture analysis, the first collated analysis report of the potentially risky interactive event may be further refined after it is obtained.

In another possible embodiment, a calibrated analysis report of the potential risk interaction event may be obtained, wherein the calibrated analysis report includes a first calibrated analysis report and a second calibrated analysis report, the second calibrated analysis report resulting from risk event capture based on a priori cloud business interaction information of the digital intelligent production line. Based on the target analysis report in the calibrated analysis report, a current captured report indication of the potential risk interaction event may be determined.

The method can combine the first calibrated analysis report of the current cloud service interaction information with the second calibrated analysis report of the prior cloud service interaction information to further improve the first calibrated analysis report. The second collated analysis report may be a second event capture report based on a priori cloud business interaction information about the digital intelligent production line for risk event capture, the second event capture report may be a priori event capture report. The determined idea of the second collated analysis report may be similar to the determined idea of the first collated analysis report. Each priori cloud service interaction information may correspond to a second calibrated analysis report of the potential risk interaction event, and the same potential risk interaction event may correspond to a series of second calibrated analysis reports with continuous cloud service interaction information collection on the digital intelligent production line. To further improve the accuracy and reliability of risk event analysis, a calibrated analysis report may be obtained that includes a first calibrated analysis report and a second calibrated analysis report, thus enabling event capture analysis information (second calibrated analysis report) that incorporates a priori cloud business interaction information. The current captured report indication of the potential risk interaction event may then be determined based on the target analysis report of the calibrated analysis reports, e.g., one or several calibrated analysis reports may be selected from the calibrated analysis reports of one potential risk interaction event as target analysis report, target analysis report as current captured report indication, or global analysis results (such as distribution tag mean) of several target analysis reports as current captured report indication. Because the fluctuation of the distribution labels of the potential risk interaction events is smaller, the calibrated analysis reports of the potential risk interaction events obtained by different cloud service interaction information can be the same, and therefore the current capture report indication of the potential risk interaction events can be obtained by means of a plurality of calibrated analysis reports, and the event capture analysis is more accurate and reliable.

In some embodiments, a bias variable may be determined for a first one of the collated analysis reports from a number of second collated analysis reports, respectively, wherein the first collated analysis report is one of the collated analysis reports and the second collated analysis report is a collated analysis report other than the first collated analysis report. For one of the first collated analysis reports, determining a corresponding associated report number of the first collated analysis report, wherein the associated report number is the number of second collated analysis reports having a deviation variable less than a deviation variable determination value from the first collated analysis report. And determining a target analysis report in the calibrated analysis report according to the association report number corresponding to the first calibrated analysis report.

For some embodiments, an example of determining a target analysis report in a collated analysis report is provided. One of the proofed analysis reports may be used as a first proofed analysis report for several proofed analysis reports of one potentially risky interaction event, and the proofed analysis report other than the first proofed analysis report of the several proofed analysis reports may be used as a second proofed analysis report. For a first collated analysis report of a risk potential interaction event, a bias variable (report bias value) of the first collated analysis report and a plurality of second collated analysis reports may be determined, and an associated report number corresponding to the first collated analysis report may be determined based on the bias variable of the first collated analysis report and the plurality of second collated analysis reports. For example, a variance of the distribution tag information of the first calibrated analysis report and the distribution tag information of a second calibrated analysis report may be determined, and if the variance is less than the variance determination value, the second calibrated analysis report may be considered to be relatively close to the first calibrated analysis report, and the second calibrated analysis report may be considered to be a selected report of the first calibrated analysis report, the number of selected reports of the first calibrated analysis report may be the number of associated reports corresponding to the first calibrated analysis report, in other words, the number of second calibrated analysis reports having a variance less than the variance determination value of the first calibrated analysis report. After determining the number of associated reports corresponding to the first collated analysis report, a target analysis report in the collated analysis reports may be determined according to the number of associated reports corresponding to the first collated analysis report, for example, the first collated analysis report with the largest number of associated reports is used as the target analysis report in the collated analysis reports. Based on the method, the current capturing report indication of the potential risk interaction event can be determined according to the more accurate and reliable target analysis report in the calibrated analysis reports, and the calibrated analysis report with low accuracy is deleted, so that the accuracy and the reliability of risk event analysis can be further improved.

In some embodiments, a first collated analysis report having a largest number of associated reports among a number of first collated analysis reports is determined. And then taking the first calibrated analysis report with the largest associated report number and the second calibrated analysis report with the first calibrated analysis report with the largest associated report number and the deviation variable smaller than the deviation variable judgment value as target analysis reports in the calibrated analysis reports.

For some embodiments, the second collated analysis report having a deviation variable less than the deviation variable determination value from the first collated analysis report may be a selected report of the first collated analysis report, and the first collated analysis report having the largest number of associated reports may be the first collated analysis report having the largest number of associated reports. Further, the first collated analysis report and the selected report of the first collated analysis report are closer to the true distribution label of the potential risk interaction event on the basis that the distribution label of the potential risk interaction event does not fluctuate much, thereby enabling the selected report of the first collated analysis report and the first collated analysis report to be used as the target analysis report in the collated analysis report of the potential risk interaction event.

The method and the device can determine the current capturing report indication of the potential risk interaction event based on a plurality of target analysis reports in the calibrated analysis report of the potential risk interaction event, so that the first calibrated analysis report of the potential risk interaction event can be further improved, and the current capturing report indication obtained after the improvement can more accurately and reliably indicate the distribution label of the potential risk interaction event. For example, a desired label can be predicted according to the distribution label information of the potential risk interaction event in each target analysis report, so that the desired label is as close to a preset requirement as possible, and the desired label can be used as a current capturing report indication of the potential risk interaction event.

For some examples, for a risk potential interaction event, in predicting a current capture report indication according to the tag information of the risk potential interaction event distribution in each target analysis report, the sum of the degrees of difference between the current capture report indication and a plurality of target analysis reports may be made to meet a set condition, for example, the current capture report indication may be used as a pending member, an algorithm of the sum of the square results of the deviation variables between the pending member and each target analysis report is generated, then the value of the pending member with the minimum sum of the degrees of difference is determined, and then the current capture report indication of the risk potential interaction event is determined according to the determined value of the pending member. The resulting current capture report indicates that the sum of the degree of difference between the distribution tag information that can be reported with several target analyses meets the set condition. In this way, the current capture report may be indicated as the last event capture report of the potential risk interaction event, thereby improving the accuracy and reliability of risk event analysis.

In the embodiment of the invention, after obtaining the current capture report indication of a potentially risky interactive event, the current capture report indication of the potentially risky interactive event may be recorded, or the recorded prior capture report indication of the potentially risky interactive event may be adjusted to the obtained current capture report indication.

The following is an exemplary introduction to an event capture analysis scheme.

NODE201 obtains a dynamic constrained content set (first event capture report) of the current cloud business interaction information of the digital intelligent production line.

The NODE202 pairs a priori expected prediction window (a priori capture report indication) of a historical risk event in the digital intelligent production line with a dynamic constraint type content set of the current cloud service interaction information to obtain a current capture window (a first tracking analysis report) of a potential risk interaction event in the current cloud service interaction information.

The NODE203 disassembles the knowledge unit relation network of the digital intelligent production line by utilizing the expected prediction window of the potential risk interaction event and the current capturing window of the current cloud service interaction information aiming at each potential risk interaction event, and reserves the priori expected prediction window of the potential risk interaction event and/or the knowledge unit relation network in the current capturing window;

And the NODE204 records the expected prediction window and/or the knowledge unit relation network in the current capture window of each potential risk interaction event and the current capture window corresponding to the potential risk interaction event into a deep learning model, and performs proofreading on the current capture window of each potential risk interaction event by using the deep learning model to obtain a current proofreading window (a first proofreading analysis report) of each potential risk interaction event in the current cloud service interaction information.

NODE205 performs linkage improvement on the current collation window and the priori collation window of each potential risk interaction event to obtain a current expected prediction window (current capture report indication) of each potential risk interaction event.

The event capturing analysis technology provided by the embodiment of the invention can improve the accuracy and the credibility of risk event analysis, and even if certain noise interference exists in a digital intelligent production line, the obtained event capturing report has better anti-interference performance, thereby realizing stable event capturing analysis.

In some independent embodiments, after obtaining the first collated analysis report of the potential risk interaction event, the method may further include: performing risk trend mining on the first checked analysis report to obtain a risk trend mining result; determining a target data protection mechanism by using the risk tendency mining result; enabling the target data protection mechanism.

In some examples, the target data protection mechanism may be a data protection policy or a data protection rule, for example, different target data protection mechanisms may be customized for different risk tendency mining results, and may be deployed and activated differently according to system computing power and industrial internet equipment computing power, for example, complete deployment of the target data protection mechanism may be performed on a high computing power side, and deployment of a core protection project may be performed on a low computing power side, so as to ensure data interaction security in an industrial internet operation process.

In some independent embodiments, the risk trend mining is performed on the first calibrated analysis report, so as to obtain a risk trend mining result, which may include the following contents: carrying out knowledge detail extraction on the first checked analysis report to obtain an event behavior detail knowledge set to be mined; respectively carrying out intrusion attack tendency mining and data stealing tendency mining on a plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain an intrusion attack tendency mining result queue and a data stealing tendency mining result queue; performing a first filtering operation on the intrusion attack tendency mining result queue through a first tendency filtering algorithm to obtain a first intrusion attack tendency relation network with intrusion attack tendency; performing a second filtering operation on the data stealing tendency mining result queue through a second tendency filtering algorithm to obtain a second intrusion attack tendency relation network comprising data stealing tendency; combining the first intrusion attack tendency relation network and the second intrusion attack tendency relation network to obtain a reference relation network matched with the target tendency in the event behavior detail knowledge set; the target trend comprises at least one of invasion attack trend and data stealing trend, and risk trend prediction is carried out based on the reference relation network and a preset convolutional neural network to obtain a predicted risk trend field.

For example, the trend filtering algorithm can be determined by means of a long-term and short-term memory neural network and used for carrying out error correction and deletion processing on the trend mining result so as to reduce noise of the mining result, and thus risk trend prediction can be carried out on the basis of an intrusion attack trend relation network with high signal to noise ratio so as to obtain an accurate and reliable predicted risk trend field.

In some independent embodiments, the performing intrusion attack trend mining and data stealing trend mining on the plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain an intrusion attack trend mining result queue and a data stealing trend mining result queue respectively includes: respectively carrying out intrusion attack tendency mining on a plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain intrusion attack tendency mining information in each event behavior detail knowledge and basic tendency types corresponding to each intrusion attack tendency mining information; based on intrusion attack tendency mining information and corresponding basic tendency types in the event behavior detail knowledge, determining an intrusion attack tendency mining result queue; and respectively carrying out data stealing tendency mining on a plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain a data stealing tendency mining result queue.

In some independent embodiments, the data stealing tendency mining is performed on the plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain a data stealing tendency mining result queue, including: performing behavior node identification on a plurality of event behavior detail knowledge in the event behavior detail knowledge respectively to obtain behavior node analysis data corresponding to each event behavior detail knowledge respectively; respectively carrying out session environment recognition on a plurality of event behavior detail knowledge in the event behavior detail knowledge to obtain session environment analysis data respectively corresponding to each event behavior detail knowledge; correlating behavior node analysis data and session environment analysis data corresponding to the same potential risk interaction event; and carrying out data stealing tendency mining processing on the basis of session environment analysis data associated with the target behavior node analysis data in the event behavior detail knowledge, and obtaining a data stealing tendency mining result queue.

Based on the same or similar inventive concept, please refer to fig. 2 in combination, there is further provided a schematic architecture diagram of an application environment 30 of an industrial internet data processing method based on artificial intelligence, which includes an artificial intelligence service system 10 and an intelligent production device 20 that communicate with each other, where the artificial intelligence service system 10 and the intelligent production device 20 implement or partially implement the technical solutions described in the above method embodiments at runtime.

Further, there is also provided a readable storage medium having stored thereon a program which when executed by a processor implements the above-described method.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. The apparatus and method embodiments described above are merely illustrative, for example, flow diagrams and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present invention may be integrated together to form a single part, or each module may exist alone, or two or more modules may be integrated to form a single part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a media service server 10, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes. It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An industrial internet data processing method based on artificial intelligence, which is applied to an artificial intelligence service system, and at least comprises the following steps:

acquiring a first event capturing report obtained by capturing risk events according to current cloud service interaction information of a digital intelligent production line;

utilizing an priori capture report instruction of the digital intelligent production line to adjust the first event capture report to obtain a first tracking analysis report of a potential risk interaction event in the current cloud service interaction information;

the first tracking analysis report is checked by combining with a knowledge unit relation network corresponding to the first tracking analysis report, and a first checked analysis report of the potential risk interaction event is obtained;

the step of utilizing the prior capture report indication of the digital intelligent production line to adjust the first event capture report to obtain a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information comprises the following steps: determining, with the a priori capture report indication of the digital intelligent production line, a risk event classification annotation of the first event capture report, wherein the risk event classification annotation is used to distinguish the potential risk interaction event; adjusting the first event capturing report by combining the risk event classification annotation of the first event capturing report to obtain a first tracking analysis report of the potential risk interaction event in the current cloud service interaction information;

Wherein the determining risk event classification annotation of the first event capture report using the a priori capture report indication of the digital intelligent production line comprises: pairing an a priori capture report indication of the digital intelligent production line with the first event capture report; on the basis of pairing the first event capture report with the prior capture report indication, taking the risk event classification annotation indicated by the prior capture report as the risk event classification annotation of the first event capture report;

wherein the determining risk event classification annotation of the first event capture report using the a priori capture report indication of the digital intelligent production line comprises: adding a specified risk event classification annotation to the first event capture report based on the first event capture report indicating unpaired with the prior capture report;

wherein said pairing an a priori capture report indication of the digital intelligent production line with the first event capture report comprises: determining a first content window size where the first event capture report coincides with a constraint content set indicated by an a priori capture report, and determining a global content window size where the constraint content set of the first event capture report overlaps with the constraint content set indicated by the a priori capture report; determining a pairing index of the first event capture report and the a priori capture report indication in combination with a ratio of the first content window size to the global content window size;

The method comprises the steps of obtaining a calibrated analysis report of the potential risk interaction event, wherein the calibrated analysis report comprises a first calibrated analysis report and a second calibrated analysis report, and the second calibrated analysis report is obtained by capturing the risk event based on prior cloud service interaction information of a digital intelligent production line; determining a current captured report indication of the potential risk interaction event using a target analysis report of the collated analysis reports; wherein the current capture report indicates that a sum of bias variables from a number of the target analysis reports meets a set condition;

wherein the method further comprises: determining deviation variables of a first proofed analysis report and a plurality of second proofed analysis reports in the proofed analysis reports, wherein the first proofed analysis report is one of the proofed analysis reports, and the second proofed analysis report is a proofed content set outside the first proofed analysis report; determining a correlation report number corresponding to the first calibrated analysis report, wherein the correlation report number is the number of second calibrated analysis reports with the deviation variable of the first calibrated analysis report smaller than the deviation variable determination value; determining a target analysis report in the calibrated analysis report according to the association report number corresponding to the first calibrated analysis report; wherein the determining a target analysis report in the calibrated analysis report according to the association report number corresponding to the first calibrated analysis report includes: determining a first collated analysis report with the largest association report number in a plurality of first collated analysis reports; taking the first calibrated analysis report with the largest associated report number and the second calibrated analysis report with the first calibrated analysis report with the largest associated report number, wherein the deviation variable of the second calibrated analysis report is smaller than the deviation variable judgment value, as target analysis reports in the calibrated analysis reports;

Wherein after obtaining the first collated analysis report of the potential risk interaction event, the method further comprises: performing risk trend mining on the first checked analysis report to obtain a risk trend mining result; determining a target data protection mechanism by using the risk tendency mining result; enabling the target data protection mechanism;

the risk trend mining is carried out on the first checked analysis report to obtain a risk trend mining result, and the risk trend mining method comprises the following steps: carrying out knowledge detail extraction on the first checked analysis report to obtain an event behavior detail knowledge set to be mined; respectively carrying out intrusion attack tendency mining and data stealing tendency mining on a plurality of event behavior detail knowledge in the event behavior detail knowledge set to obtain an intrusion attack tendency mining result queue and a data stealing tendency mining result queue; performing a first filtering operation on the intrusion attack tendency mining result queue through a first tendency filtering algorithm to obtain a first intrusion attack tendency relation network with intrusion attack tendency; performing a second filtering operation on the data stealing tendency mining result queue through a second tendency filtering algorithm to obtain a second intrusion attack tendency relation network comprising data stealing tendency; combining the first intrusion attack tendency relation network and the second intrusion attack tendency relation network to obtain a reference relation network matched with the target tendency in the event behavior detail knowledge set; the target trend comprises at least one of invasion attack trend and data stealing trend, and risk trend prediction is carried out based on the reference relation network and a preset convolutional neural network to obtain a predicted risk trend field.

2. The method of claim 1, wherein the utilizing the a priori capture report of the digital intelligent production line to indicate the adjustment of the first event capture report results in a first tracking analysis report of potential risk interaction events in the current cloud business interaction information, comprises:

3. The method of claim 1, wherein the collating the first tracking analysis report in conjunction with the knowledge unit relationship network to which the first tracking analysis report corresponds to obtain a first collated analysis report of the potential risk interaction event comprises:

Obtaining a first corrected analysis report for correcting the first tracking analysis report by using the integrated knowledge unit relation network;

the prior capturing report of the same potential risk interaction event indicates that the corresponding knowledge unit relationship network and the knowledge unit relationship network corresponding to the first tracking analysis report are subjected to relationship network fusion, which comprises the following steps: and for the same potential risk interaction event, carrying out relationship network fusion on a knowledge unit relationship network corresponding to the prior capture report indication of the cloud service interaction information of the last group of the current cloud service interaction information and a knowledge unit relationship network corresponding to the first tracking analysis report.

4. An artificial intelligence service system, comprising a processor and a memory; the processor being communicatively connected to the memory, the processor being adapted to read a computer program from the memory and execute it to carry out the method of any of the preceding claims 1-3.