The invention provides a Bayesian
attack graph-based semi-passive industrial
control network security analysis tool and a Bayesian
attack graph-based semi-passive industrial
control network security analysis method, which relate to the technical field of
network security, and comprise a semi-passive
information acquisition module for acquiring a combination of an active scanning report, network message data and administrator correction suggestions and taking the combination as an input file; an asset
list establishing module: establishing an asset
list, and generating. P files as input files of the attribute
attack graph generation module and the Bayesian
attack graph generation module; an attribute
attack graph generation module which is used for inputting template
network topology information and node information and generating an attack path; and a Bayesian
attack graph generation module which is used for comprehensively analyzing the information of the whole network based on the network information and logic rules recorded by the
Datalog statement, and finally generating all possible attack graphs. The method has high compatibility for an industrial
control network, comprehensively utilizes multiple charts to visually assist
network security analysis, and can achieve dynamic analysis and hidden danger prevention and control.