Industrial control system attack clue discovery system based on knowledge graph

Abstract

The invention discloses an industrial control system attack clue discovery system based on a knowledge graph. Most industrial control systems are designed and developed before many years, lack corresponding security consideration, and inevitably have a lot of vulnerabilities endangering system security, and these vulnerabilities are likely to be utilized by intruders. Aiming at the fact that an industrial control intrusion detection system can only discover attacks but cannot provide clues related to the attacks, and the clues play an important role in rapid recovery of the system after the attacks, the industrial control system vulnerability utilization knowledge graph is constructed, and the related clues of the attacks are given from the perspective of vulnerability utilization. In theprocess of constructing the knowledge graph, an attack information named entity identification method based on a conditional random field, an entity alignment framework based on rule and character similarity calculation and a knowledge reasoning algorithm based on type limitation and pre-training model negative triple potential correct probability are provided. According to the method, the knowledge graph is visually displayed in a force-oriented graph mode according to the attack clues obtained through user input, and the method is more accurate and visual.

Description

technical field [0001] The invention belongs to the field of network security of industrial control systems, and in particular relates to a system for discovering attack clues of industrial control systems based on knowledge graphs. Background technique [0002] The industrial control system is composed of various automation control components and process control components for real-time data collection and monitoring, and is used in a very wide range of industrial fields. Most of the industrial control systems currently in use were designed and developed many years ago, lacking corresponding security considerations, and there are inevitably many loopholes that endanger system security. These loopholes are likely to be exploited by intruders and cause security incidents. With the continuous advancement of the integration of industrialization and industrialization, mature IT technology has broken the relative closure of industrial control systems, and the security problems an...

AI Technical Summary

Problems solved by technology

Most of the industrial control systems currently in use were designed and developed many years ago, lacking corresponding security considerations, and there are inevitably many loopholes that endanger system security. These loopholes are likely to be exploited by intruders and cause security incidents

With the continuous advancement of the integration of industrialization and industrialization, mature IT technology has broken the relative closure of industrial control systems, and the security problems and risks faced have become more prominent. Industrial control system network security accidents have seriously affected the safety of life and property in industrial production.

At present, intrusion detection technology is usually used to detect network attacks on industrial control systems, but intrusion detection technology can only detect attacks and give an alarm, and cannot provide relevant information such as the method used by the attack, the consequences caused, and handling opinions. This information can provide information for security personnel. Provide decision support, which plays an important role in the rapid recovery of the system after being attacked and the reduction of attack losses

Images