Industrial control asset vulnerability detection method, device, storage medium and apparatus
By acquiring a set of candidate CVE information and using a target ranking model to rank the CVE information, the problem of low efficiency and accuracy in detecting vulnerabilities in industrial control assets is solved, achieving efficient and accurate vulnerability identification and reducing the risk of industrial network attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SUZHOU 360 INTELLIGENT SECURITY TECH CO LTD
- Filing Date
- 2021-07-12
- Publication Date
- 2026-06-09
Smart Images
Figure CN115618350B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method, device, storage medium and apparatus for detecting vulnerabilities in industrial control assets. Background Technology
[0002] Currently, when performing vulnerability detection on industrial control assets in industrial control networks, it is often necessary to manually match the industrial control asset information with Common Vulnerabilities & Exposures (CVE) information and determine the vulnerabilities of the industrial control assets based on the matching results.
[0003] However, the above methods require manual information matching, resulting in low efficiency and accuracy in vulnerability detection.
[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention
[0005] The main objective of this invention is to provide a method, device, storage medium, and apparatus for detecting vulnerabilities in industrial control assets, aiming to solve the technical problems of low efficiency and accuracy in the detection of vulnerabilities in industrial control assets in the prior art.
[0006] To achieve the above objectives, the present invention provides a method for detecting vulnerabilities in industrial control system assets, the method comprising the following steps:
[0007] Obtain a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network;
[0008] The target ranking model is obtained by training the model based on the CVE information and the industrial control asset information.
[0009] The CVE information in the candidate CVE information set is sorted according to the target sorting model, and the target CVE information set is determined according to the sorting results;
[0010] Based on the target CVE information set, determine the vulnerability information of industrial control assets in the industrial control network.
[0011] Optionally, the step of training the model based on the CVE information and the industrial control asset information to obtain the target ranking model specifically includes:
[0012] Feature extraction is performed on the CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples;
[0013] The target ranking model is obtained by training the model based on the CVE feature samples and the industrial control asset feature samples.
[0014] Optionally, the step of training a model based on the CVE feature samples and the industrial control asset feature samples to obtain a target ranking model specifically includes:
[0015] Based on the CVE feature samples and the industrial control asset feature samples, the preset prediction model and the preset nonlinear model are trained to obtain the target prediction model and the target nonlinear model.
[0016] The target prediction model and the target nonlinear model are fused to obtain the target ranking model.
[0017] Optionally, the step of fusing the target prediction model and the target nonlinear model to obtain the target ranking model specifically includes:
[0018] The target prediction model and the target nonlinear model are fused to obtain the current ranking model;
[0019] The CVE information in the candidate CVE information set is sorted according to the current sorting model to obtain a sorting result sample;
[0020] The sorting result sample is sent to the target terminal device, and the verification result fed back by the target terminal device based on the sorting result sample is received;
[0021] When the verification result is successful, the current ranking model is used as the target ranking model.
[0022] Optionally, after the steps of sending the sorting result sample to the target terminal device and receiving the verification result fed back by the target terminal device based on the sorting result sample, the industrial control asset vulnerability detection method further includes:
[0023] When the verification result is that the verification failed, the error correction information fed back by the target terminal device based on the sorting result sample is received;
[0024] Training samples are generated based on the error correction information and the sorting result samples, and the current sorting model is trained based on the training samples;
[0025] Return to the step of sorting the CVE information in the candidate CVE information set according to the current sorting model to obtain the sorted result sample.
[0026] Optionally, the step of sorting the CVE information in the candidate CVE information set according to the target ranking model and determining the target CVE information set based on the ranking result specifically includes:
[0027] The CVE information in the candidate CVE information set is sorted according to the target sorting model to obtain the sorting result;
[0028] The CVE information in the candidate CVE information set is filtered according to the sorting results to obtain the target CVE information set.
[0029] Optionally, after the step of determining the industrial control asset vulnerability information in the industrial control network based on the target CVE information set, the industrial control asset vulnerability detection method further includes:
[0030] Obtain user terminal information and locate the information display template corresponding to the user terminal information;
[0031] Based on the information display template and the industrial control asset vulnerability information, an early warning message is generated and sent to the target terminal device.
[0032] Optionally, before the step of obtaining the candidate CVE information set, the industrial control asset vulnerability detection method further includes:
[0033] Obtain common vulnerability disclosure CVE information and industrial control asset information in the industrial control network, and generate CVE tags corresponding to the CVE information;
[0034] The industrial control asset information is matched with the CVE tags, and the CVE information is filtered according to the matching results to obtain a candidate CVE information set.
[0035] Optionally, the step of matching the industrial control asset information with the CVE tags and filtering the CVE information based on the matching results to obtain a candidate CVE information set specifically includes:
[0036] The industrial control asset information is fuzzy matched with the CVE tag to obtain the fuzzy matching result;
[0037] The text similarity between the CVE information and the industrial control asset information is determined according to a preset text similarity model;
[0038] The similarity coefficient between the CVE information and the industrial control asset information is determined according to a preset similarity coefficient model;
[0039] The CVE information is filtered based on the fuzzy matching results, the text similarity, and the similarity coefficient to obtain a candidate CVE information set.
[0040] Optionally, the step of performing a fuzzy match between the industrial control asset information and the CVE tag to obtain a fuzzy match result specifically includes:
[0041] Keyword extraction is performed on the industrial control asset information to obtain key industrial control asset information;
[0042] The key industrial control asset information is matched with the CVE tag to obtain the fuzzy matching result.
[0043] Optionally, the step of determining the text similarity between the CVE information and the industrial control asset information based on a preset text similarity model specifically includes:
[0044] The CVE word vectors corresponding to the CVE information and the industrial control asset word vectors corresponding to the industrial control asset information are determined according to the preset word vector model.
[0045] The text similarity between the CVE information and the industrial control asset information is determined based on a preset text similarity model, the CVE word vector, and the industrial control asset word vector.
[0046] Optionally, the step of filtering the CVE information based on the fuzzy matching result, the text similarity, and the similarity coefficient to obtain a candidate CVE information set specifically includes:
[0047] The CVE information is filtered based on the fuzzy matching results to obtain a first CVE information set;
[0048] The CVE information is filtered based on the text similarity to obtain a second CVE information set;
[0049] The CVE information is filtered based on the similarity coefficient to obtain a third CVE information set;
[0050] The candidate CVE information set is determined based on the first CVE information set, the second CVE information set, and the third CVE information set.
[0051] Furthermore, to achieve the above objectives, the present invention also proposes an industrial control asset vulnerability detection device, which includes a memory, a processor, and an industrial control asset vulnerability detection program stored in the memory and executable on the processor. The industrial control asset vulnerability detection program is configured to implement the steps of the industrial control asset vulnerability detection method described above.
[0052] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing an industrial control asset vulnerability detection program, wherein when the industrial control asset vulnerability detection program is executed by a processor, it implements the steps of the industrial control asset vulnerability detection method described above.
[0053] In addition, to achieve the above objectives, the present invention also proposes an industrial control asset vulnerability detection device, which includes: an acquisition module, a training module, a sorting module, and a determination module;
[0054] The acquisition module is used to acquire a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network.
[0055] The training module is used to train the model based on the CVE information and the industrial control asset information to obtain the target ranking model;
[0056] The sorting module is used to sort the CVE information in the candidate CVE information set according to the target sorting model, and to determine the target CVE information set based on the sorting result;
[0057] The determining module is used to determine the vulnerability information of industrial control assets in the industrial control network based on the target CVE information set.
[0058] Optionally, the training module is further configured to extract features from the CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples.
[0059] The training module is also used to train the model based on the CVE feature samples and the industrial control asset feature samples to obtain the target ranking model.
[0060] Optionally, the training module is further configured to train a preset prediction model and a preset nonlinear model based on the CVE feature samples and the industrial control asset feature samples to obtain a target prediction model and a target nonlinear model.
[0061] The training module is also used to fuse the target prediction model and the target nonlinear model to obtain a target ranking model.
[0062] Optionally, the training module is further configured to perform model fusion on the target prediction model and the target nonlinear model to obtain the current ranking model;
[0063] The training module is also used to sort the CVE information in the candidate CVE information set according to the current sorting model to obtain sorting result samples;
[0064] The training module is also used to send the sorting result sample to the target terminal device and receive the verification result fed back by the target terminal device based on the sorting result sample;
[0065] The training module is also used to use the current ranking model as the target ranking model when the verification result is that the verification is passed.
[0066] Optionally, the training module is further configured to receive error correction information fed back by the target terminal device based on the sorting result sample when the verification result is that the verification failed;
[0067] The training module is further configured to generate training samples based on the error correction information and the sorting result samples, and to train the current sorting model based on the training samples;
[0068] The training module is also used to return the step of sorting the CVE information in the candidate CVE information set according to the current sorting model to obtain the sorted result sample.
[0069] Optionally, the sorting module is further configured to sort the CVE information in the candidate CVE information set according to the target sorting model to obtain a sorting result;
[0070] The sorting module is further configured to filter the CVE information in the candidate CVE information set according to the sorting result, and obtain the target CVE information set.
[0071] This invention discloses a method for acquiring a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network. A model is trained using the CVE and industrial control asset information to obtain a target ranking model. The CVE information in the candidate CVE information set is ranked according to the target ranking model, and a target CVE information set is determined based on the ranking result. Finally, industrial control asset vulnerability information in the industrial control network is determined based on the target CVE information set. Compared to existing methods that manually match industrial control asset information with CVE information to determine industrial control asset vulnerabilities, this invention first acquires a candidate CVE information set generated based on CVE information and industrial control asset information in the industrial control network, then ranks the CVE information in the candidate CVE information set according to the target ranking model to obtain the target CVE information set, and finally determines industrial control asset vulnerability information in the industrial control network based on the target CVE information set. This method can accurately identify industrial control asset vulnerabilities in the industrial control network and reduce the risk of industrial networks being attacked. Attached Figure Description
[0072] Figure 1 This is a schematic diagram of the structure of the industrial control asset vulnerability detection device for the hardware operating environment involved in the embodiments of the present invention;
[0073] Figure 2 This is a flowchart illustrating the first embodiment of the industrial control asset vulnerability detection method of the present invention;
[0074] Figure 3 This is a flowchart illustrating the second embodiment of the industrial control asset vulnerability detection method of the present invention;
[0075] Figure 4 This is a flowchart illustrating the third embodiment of the industrial control asset vulnerability detection method of the present invention;
[0076] Figure 5 This is a flowchart illustrating the fourth embodiment of the industrial control asset vulnerability detection method of the present invention;
[0077] Figure 6 This is a flowchart illustrating the fifth embodiment of the industrial control asset vulnerability detection method of the present invention;
[0078] Figure 7 This is a structural block diagram of the first embodiment of the industrial control asset vulnerability detection device of the present invention.
[0079] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation
[0080] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
[0081] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of an industrial control asset vulnerability detection device for the hardware operating environment involved in the embodiments of the present invention.
[0082] like Figure 1As shown, the industrial control asset vulnerability detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen, and optionally, it may also include a standard wired interface or a wireless interface. In this invention, the wired interface of the user interface 1003 may be a USB interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed random access memory (RAM) or a non-volatile memory (NVM), such as a disk storage device. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.
[0083] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on industrial control asset vulnerability detection equipment, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.
[0084] like Figure 1 As shown, the memory 1005, which is identified as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an industrial control asset vulnerability detection program.
[0085] exist Figure 1 In the industrial control asset vulnerability detection device shown, the network interface 1004 is mainly used to connect to the backend server and communicate data with the backend server; the user interface 1003 is mainly used to connect to user equipment; the industrial control asset vulnerability detection device calls the industrial control asset vulnerability detection program stored in the memory 1005 through the processor 1001 and executes the industrial control asset vulnerability detection method provided in the embodiment of the present invention.
[0086] Based on the above hardware structure, an embodiment of the industrial control asset vulnerability detection method of the present invention is proposed.
[0087] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the industrial control asset vulnerability detection method of the present invention, which presents the first embodiment of the industrial control asset vulnerability detection method of the present invention.
[0088] In the first embodiment, the industrial control asset vulnerability detection method includes the following steps:
[0089] Step S10: Obtain a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network.
[0090] It should be understood that the execution subject of this embodiment is the industrial control asset vulnerability detection device. The industrial control asset vulnerability detection device may be an electronic device such as a personal computer or server, or other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment, the industrial control asset vulnerability detection device is used as an example for illustration.
[0091] It should be noted that Common Vulnerabilities & Exposures (CVE) information may include CVE descriptions, vendor information, permission information, and harm information, etc., and this embodiment does not impose any restrictions on this.
[0092] Industrial control asset information may include information such as the hardware, operating system, firmware version, and software version of the industrial control asset equipment. This embodiment does not limit this information.
[0093] It should be understood that the candidate CVE information set is generated based on CVE information and industrial control asset information in the industrial control network. This can be done by obtaining general vulnerability disclosure CVE information and industrial control asset information in the industrial control network, generating CVE tags corresponding to the CVE information, matching the industrial control asset information with the CVE tags, and filtering the CVE information according to the matching results to obtain the candidate CVE information set.
[0094] Step S20: Train the model based on the CVE information and the industrial control asset information to obtain the target ranking model.
[0095] It is understandable that training a model based on CVE information and industrial control asset information to obtain a target ranking model can be achieved by training a preset ranking model based on CVE information and industrial control asset information. The preset ranking model can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0096] Furthermore, to improve the efficiency of model training, the step of training the model based on CVE information and industrial control asset information to obtain the target ranking model includes:
[0097] Feature extraction is performed on CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples. The model is then trained based on the CVE feature samples and industrial control asset feature samples to obtain the target ranking model.
[0098] Furthermore, to avoid the low accuracy caused by a single ranking model, the step of training the model based on CVE feature samples and industrial control asset feature samples to obtain the target ranking model includes:
[0099] The preset prediction model and preset nonlinear model are trained based on CVE feature samples and industrial control asset feature samples to obtain the target prediction model and target nonlinear model. The target prediction model and target nonlinear model are then fused to obtain the target ranking model.
[0100] Step S30: Sort the CVE information in the candidate CVE information set according to the target sorting model, and determine the target CVE information set according to the sorting result.
[0101] It should be understood that sorting the CVE information in the candidate CVE information set according to the target ranking model and determining the target CVE information set based on the ranking results can be done by sorting the CVE information in the candidate CVE information set according to the target ranking model, obtaining the ranking results, and then filtering the CVE information in the candidate CVE information set based on the ranking results to obtain the target CVE information set.
[0102] Step S40: Determine the industrial control asset vulnerability information in the industrial control network based on the target CVE information set.
[0103] It is understandable that determining the vulnerability information of industrial control assets in the industrial control network based on the target CVE information set can be achieved by reading each CVE information in the target CVE information set to obtain the CVE description, vendor information, permission information, and hazard information, and then generating the industrial control asset vulnerability information based on the CVE description, vendor information, permission information, and hazard information.
[0104] In the first embodiment, a method for obtaining a candidate CVE information set is disclosed. This candidate CVE information set is generated based on CVE information and industrial control asset information in the industrial control network. A model is trained based on the CVE information and industrial control asset information to obtain a target ranking model. The CVE information in the candidate CVE information set is ranked according to the target ranking model, and a target CVE information set is determined based on the ranking result. Finally, industrial control asset vulnerability information in the industrial control network is determined based on the target CVE information set. Compared to the existing method of manually matching industrial control asset information with CVE information to determine industrial control asset vulnerabilities, this embodiment first obtains a candidate CVE information set generated based on CVE information and industrial control asset information in the industrial control network, then ranks the CVE information in the candidate CVE information set according to the target ranking model to obtain the target CVE information set, and finally determines industrial control asset vulnerability information in the industrial control network based on the target CVE information set. This method can accurately identify industrial control asset vulnerabilities in the industrial control network and reduce the risk of industrial networks being attacked.
[0105] Reference Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the industrial control asset vulnerability detection method of the present invention, based on the above. Figure 2 The first embodiment shown presents a second embodiment of the industrial control asset vulnerability detection method of the present invention.
[0106] In the second embodiment, step S20 includes:
[0107] Step S201: Extract features from the CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples.
[0108] It should be understood that feature extraction of CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples can be based on a preset feature extraction script. The preset feature extraction script can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0109] Step S202: Train the model based on the CVE feature samples and the industrial control asset feature samples to obtain the target ranking model.
[0110] It is understood that training a model based on CVE feature samples and industrial control asset feature samples to obtain a target ranking model can be achieved by training a preset ranking model based on CVE feature samples and industrial control asset feature samples. The preset ranking model can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0111] Furthermore, to avoid the low accuracy caused by a single ranking model, the step of training the model based on CVE feature samples and industrial control asset feature samples to obtain the target ranking model includes:
[0112] The preset prediction model and preset nonlinear model are trained based on CVE feature samples and industrial control asset feature samples to obtain the target prediction model and target nonlinear model. The target prediction model and target nonlinear model are then fused to obtain the target ranking model.
[0113] In the second embodiment, feature extraction is performed on CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples. Model training is then performed based on the CVE feature samples and industrial control asset feature samples to obtain a target ranking model. In this embodiment, model training is performed using CVE feature samples from CVE information and industrial control asset feature samples from industrial control asset information, thereby improving the efficiency of model training.
[0114] In the second embodiment, step S30 includes:
[0115] Step S301: Sort the CVE information in the candidate CVE information set according to the target sorting model to obtain the sorting result.
[0116] It should be understood that sorting the CVE information in the candidate CVE information set according to the target sorting model can be achieved by inputting the CVE information in the candidate CVE information set into the target sorting model to obtain the sorting result.
[0117] Step S302: Filter the CVE information in the candidate CVE information set according to the sorting result to obtain the target CVE information set.
[0118] It is understandable that the target CVE information set can be obtained by filtering the CVE information in the candidate CVE information set according to the ranking results. This can be achieved by selecting a pre-ordered number of CVE information from the top-ranked candidate CVE information set. The pre-ordered number can be preset by the administrator of the industrial control asset vulnerability detection equipment, and this embodiment does not impose any restrictions on it.
[0119] In the second embodiment, it is disclosed that the CVE information in the candidate CVE information set is sorted according to the target sorting model to obtain the sorting result, and the CVE information in the candidate CVE information set is filtered according to the sorting result to obtain the target CVE information set, thereby improving the accuracy of the target CVE information set.
[0120] Reference Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the industrial control asset vulnerability detection method of the present invention, based on the above. Figure 3 The second embodiment shown presents a third embodiment of the industrial control asset vulnerability detection method of the present invention.
[0121] In the third embodiment, step S202 includes:
[0122] Step S2021: Train the preset prediction model and the preset nonlinear model based on the CVE feature samples and the industrial control asset feature samples to obtain the target prediction model and the target nonlinear model.
[0123] It should be noted that the preset prediction model and the preset nonlinear model can be preset by the administrators of the industrial control asset vulnerability detection equipment, and this embodiment does not impose any restrictions on this.
[0124] Step S2022: Perform model fusion on the target prediction model and the target nonlinear model to obtain the target ranking model.
[0125] In practical implementation, for example, features are extracted from CVE information and industrial control asset information. Then, a prediction model is trained using logistic regression based on the CVE feature samples and industrial control asset feature samples to obtain the target prediction model. Since logistic regression is a linear model, a non-linear model is also needed to enhance the sample representation. XGBoost can be used to further train the CVE feature samples and industrial control asset features to obtain the target non-linear model. Finally, the GBDT recommendation strategy is used to fuse the target prediction model and the target non-linear model to obtain the target ranking model.
[0126] Furthermore, in order to further optimize the ranking model, step S2022 includes:
[0127] The target prediction model and the target nonlinear model are fused to obtain the current ranking model;
[0128] The CVE information in the candidate CVE information set is sorted according to the current sorting model to obtain a sorting result sample;
[0129] The sorting result sample is sent to the target terminal device, and the verification result fed back by the target terminal device based on the sorting result sample is received;
[0130] When the verification result is successful, the current ranking model is used as the target ranking model.
[0131] It should be noted that the target terminal device can be a terminal device pre-configured by the administrator of the industrial control system (ICS) vulnerability detection equipment and associated with the ICS vulnerability detection equipment. For example, a computer pre-associated with the ICS vulnerability detection equipment allows users to obtain information sent by the ICS vulnerability detection equipment through the target terminal device.
[0132] Understandably, after obtaining the sorting result sample through the target terminal device, the user can manually review the sorting result sample and generate a verification result based on the manual review result.
[0133] It should be noted that in this embodiment, the sorting result sample can also be obtained without the target terminal device. Users can also directly obtain the sorting result sample through the user interface of the industrial control asset vulnerability detection device. This embodiment does not impose any restrictions on this.
[0134] It should be understood that when the verification result is successful, it indicates that the accuracy of the current ranking model is relatively high. In this case, the current ranking model can be directly used as the target ranking model for subsequent processing.
[0135] Furthermore, to further optimize the ranking model, after sending the ranking result sample to the target terminal device and receiving the verification result fed back by the target terminal device based on the ranking result sample, the method further includes:
[0136] When the verification result is that the verification failed, the error correction information fed back by the target terminal device based on the sorting result sample is received;
[0137] Training samples are generated based on the error correction information and the sorting result samples, and the current sorting model is trained based on the training samples;
[0138] Return to the step of sorting the CVE information in the candidate CVE information set according to the current sorting model to obtain the sorted result sample.
[0139] Understandably, if the sorted result sample fails to pass manual review, users can correct the sorted result sample to generate correction information.
[0140] It should be understood that, in order to further optimize the ranking model, it is necessary to merge the error correction information and the ranking result samples to generate new training samples, and then use the training samples to train the current ranking model.
[0141] It is understandable that after training the current ranking model, it is necessary to return and sort the CVE information in the candidate CVE information set according to the current ranking model to obtain the ranking result sample, so as to re-verify whether the retrained ranking model meets the user's needs.
[0142] In the third embodiment, a method is disclosed to train a preset prediction model and a preset nonlinear model based on CVE feature samples and industrial control asset feature samples to obtain a target prediction model and a target nonlinear model, and to fuse the target prediction model and the target nonlinear model to obtain a target ranking model. Since this embodiment fuses the trained target prediction model and the target nonlinear model to obtain a target ranking model, it can avoid the defect of low accuracy caused by a single ranking model, thereby improving the reliability of the target ranking model.
[0143] Reference Figure 5 , Figure 5 This is a flowchart illustrating the fourth embodiment of the industrial control asset vulnerability detection method of the present invention, based on the above. Figure 2 The first embodiment shown presents a fourth embodiment of the industrial control asset vulnerability detection method of the present invention.
[0144] In the fourth embodiment, before step S10, the method further includes:
[0145] Step S01: Obtain general vulnerability disclosure CVE information and industrial control asset information in the industrial control network, and generate CVE tags corresponding to the CVE information.
[0146] It should be noted that Common Vulnerabilities & Exposures (CVE) information may include CVE descriptions, vendor information, permission information, and harm information, etc., and this embodiment does not impose any restrictions on this.
[0147] Industrial control asset information may include information such as the hardware, operating system, firmware version, and software version of the industrial control asset equipment. This embodiment does not limit this information.
[0148] It is understandable that generating CVE labels corresponding to CVE information can be achieved by extracting features from CVE information, obtaining CVE features, and generating CVE labels corresponding to CVE information based on CVE features.
[0149] Step S02: Match the industrial control asset information with the CVE tag, and filter the CVE information according to the matching result to obtain a candidate CVE information set.
[0150] It should be understood that matching industrial control asset information with CVE tags and filtering CVE information based on the matching results to obtain a candidate CVE information set can be achieved by matching industrial control asset information with CVE tags one by one and storing the CVE information corresponding to the successfully matched CVE tags into the candidate CVE information set.
[0151] Furthermore, considering that in practical applications, simply matching industrial control asset information with CVE tags to filter CVE information may result in overly simplistic filtering conditions, the following method is proposed to overcome this deficiency: matching industrial control asset information with CVE tags and filtering CVE information based on the matching results to obtain a candidate CVE information set, including:
[0152] The industrial control asset information is fuzzily matched with the CVE tag to obtain the fuzzy matching result. The text similarity between the CVE information and the industrial control asset information is determined according to the preset text similarity model. The similarity coefficient between the CVE information and the industrial control asset information is determined according to the preset similarity coefficient model. The CVE information is filtered according to the fuzzy matching result, text similarity and similarity coefficient to obtain a candidate CVE information set.
[0153] In the fourth embodiment, a method is disclosed for obtaining general vulnerability disclosure (CVE) information and industrial control asset information in the industrial control network, generating CVE tags corresponding to the CVE information, matching the industrial control asset information with the CVE tags, and filtering the CVE information based on the matching results to obtain a candidate CVE information set. Since this embodiment first generates CVE tags, then matches the industrial control asset information with the CVE tags, and finally determines the candidate CVE information set based on the matching results, it is possible to perform preliminary filtering of CVE information and improve the processing efficiency of industrial control asset vulnerability detection.
[0154] In the fourth embodiment, after step S40, the method further includes:
[0155] Step S50: Obtain user terminal information and find the information display template corresponding to the user terminal information.
[0156] It should be noted that the user terminal can be a terminal device pre-configured by the administrator of the industrial control asset vulnerability detection equipment to receive messages sent by the industrial control asset vulnerability detection equipment.
[0157] User terminal information may include terminal device model information, etc., and this embodiment does not limit this.
[0158] It is understandable that finding the information display template corresponding to the user terminal information can be done by searching for the corresponding information display template for the user terminal device in a preset template library. The preset template library contains the correspondence between user terminal information and information display templates, and this correspondence can be preset by the administrators of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0159] Step S60: Generate early warning information based on the information display template and the industrial control asset vulnerability information, and send the early warning information to the target terminal device.
[0160] It should be understood that generating early warning information based on the information display template and industrial control asset vulnerability information can be achieved by writing the industrial control asset vulnerability information into the information display template to obtain early warning information.
[0161] In the fourth embodiment, the method of obtaining user terminal information, finding the information display template corresponding to the user terminal information, generating early warning information based on the information display template and industrial control asset vulnerability information, and sending the early warning information to the target terminal device is disclosed. Since this embodiment will first find the information display template corresponding to the user terminal information when detecting industrial control asset vulnerabilities, and generate early warning information based on the information display template and industrial control asset vulnerability information, it can promptly notify the user of the existence of industrial control asset vulnerabilities.
[0162] Reference Figure 6 , Figure 6 This is a flowchart illustrating the fifth embodiment of the industrial control asset vulnerability detection method of the present invention, based on the above. Figure 5 The fourth embodiment shown presents a fifth embodiment of the industrial control asset vulnerability detection method of the present invention.
[0163] In the fifth embodiment, step S02 includes:
[0164] Step S021: Perform fuzzy matching between the industrial control asset information and the CVE tag to obtain the fuzzy matching result.
[0165] It should be understood that performing fuzzy matching between industrial control system (ICS) asset information and CVE tags to obtain fuzzy matching results can be based on a preset fuzzy matching script. This preset fuzzy matching script can be pre-set by the administrator of the ICS vulnerability detection equipment, and this embodiment does not impose any restrictions on it.
[0166] Furthermore, in order to reduce the computational load of fuzzy matching and improve its processing efficiency, step S021 includes:
[0167] Keyword extraction is performed on the industrial control asset information to obtain key industrial control asset information;
[0168] The key industrial control asset information is matched with the CVE tag to obtain the fuzzy matching result.
[0169] It should be understood that extracting keywords from industrial control asset information to obtain key industrial control asset information can involve extracting keywords from industrial control asset information to obtain specialized terms in the industrial control field, and then using these specialized terms as key industrial control asset information.
[0170] It is understandable that performing fuzzy matching between critical industrial control asset information and CVE tags to obtain fuzzy matching results can be based on a preset fuzzy matching script. This preset fuzzy matching script can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0171] Step S022: Determine the text similarity between the CVE information and the industrial control asset information according to the preset text similarity model.
[0172] It should be noted that the preset text similarity model can be pre-set by the administrator of the industrial control asset vulnerability detection equipment, and this embodiment does not impose any restrictions on it.
[0173] Furthermore, in order to improve the accuracy of text similarity, step S022 includes:
[0174] The CVE word vectors corresponding to the CVE information and the industrial control asset word vectors corresponding to the industrial control asset information are determined according to the preset word vector model.
[0175] The text similarity between the CVE information and the industrial control asset information is determined based on a preset text similarity model, the CVE word vector, and the industrial control asset word vector.
[0176] It should be noted that the preset word vector model can be pre-set by the administrator of the industrial control asset vulnerability detection equipment. In this embodiment and other embodiments, the Word2vec model is used as an example for illustration.
[0177] It should be understood that determining the text similarity between CVE word vectors and industrial control asset word vectors based on a preset text similarity model can be achieved by inputting the CVE word vectors and industrial control asset word vectors into the preset text similarity model to obtain the text similarity between the CVE word vectors and industrial control asset word vectors.
[0178] In practical implementations, for example, "Siemens" and "SIMATIC" often appear together, but their relationship is not fully reflected in plain text matching. Therefore, it is necessary to determine this relationship based on deeply trained word vectors.
[0179] Step S023: Determine the similarity coefficient between the CVE information and the industrial control asset information according to the preset similarity coefficient model.
[0180] It should be noted that the similarity coefficient can be the Jaccard similarity coefficient, used to compare the similarity and differences between a finite set of samples. The larger the Jaccard coefficient value, the higher the sample similarity.
[0181] The preset similarity coefficient model can be pre-set by the administrator of the industrial control asset vulnerability detection equipment, and this embodiment does not impose any restrictions on this.
[0182] Step S024: Filter the CVE information based on the fuzzy matching results, the text similarity, and the similarity coefficient to obtain a candidate CVE information set.
[0183] It is understandable that filtering CVE information based on fuzzy matching results, text similarity, and similarity coefficients to obtain a candidate CVE information set can be achieved by using fuzzy matching results, text similarity, and similarity coefficients as reference information, and then filtering CVE information based on the reference information to obtain a candidate CVE information set.
[0184] Furthermore, in order to improve the reliability of the target CVE information set, step S024 includes:
[0185] The CVE information is filtered based on the fuzzy matching results to obtain a first CVE information set;
[0186] The CVE information is filtered based on the text similarity to obtain a second CVE information set;
[0187] The CVE information is filtered based on the similarity coefficient to obtain a third CVE information set;
[0188] The candidate CVE information set is determined based on the first CVE information set, the second CVE information set, and the third CVE information set.
[0189] It should be understood that filtering CVE information based on fuzzy matching results to obtain the first CVE information set can be done by storing the CVE information corresponding to the CVE tags that have successfully matched the fuzzy matching results into the first CVE information set.
[0190] It is understandable that filtering CVE information based on text similarity to obtain a second CVE information set can be achieved by sorting the CVE information from highest to lowest text similarity, and selecting the top-ranked CVE information from the sorted results to form the second CVE information set. The preset first number can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0191] It should be understood that filtering CVE information based on similarity coefficients to obtain a third CVE information set can be achieved by sorting the CVE information from largest to smallest based on similarity coefficients, and selecting a predetermined second number of CVE information from the top-ranked results to form the third CVE information set. The predetermined second number can be pre-set by the administrator of the industrial control asset vulnerability detection equipment; this embodiment does not impose any restrictions on this.
[0192] It is understandable that determining the target CVE information set based on the first CVE information set, the second CVE information set, and the third CVE information set can be achieved by merging the first CVE information set, the second CVE information set, and the third CVE information set to obtain the candidate CVE information set.
[0193] In the fifth embodiment, a method is disclosed that fuzzy matching is performed between industrial control asset information and CVE tags to obtain fuzzy matching results. The text similarity between CVE information and industrial control asset information is determined according to a preset text similarity model, and the similarity coefficient between CVE information and industrial control asset information is determined according to a preset similarity coefficient model. The CVE information is then filtered based on the fuzzy matching results, text similarity, and similarity coefficient to obtain a candidate CVE information set. Compared to the method of matching industrial control asset information with CVE tags and filtering CVE information based on the matching results to obtain a candidate CVE information set, this embodiment uses fuzzy matching results, text similarity, and similarity coefficient to filter CVE information to obtain a candidate CVE information set. This allows for the retrieval of CVE information associated with industrial control asset information from multiple perspectives, thereby improving the reliability of the candidate CVE information set.
[0194] Furthermore, this embodiment of the invention also proposes a storage medium storing an industrial control asset vulnerability detection program, which, when executed by a processor, implements the steps of the industrial control asset vulnerability detection method described above.
[0195] In addition, refer to Figure 7 The present invention also proposes an industrial control asset vulnerability detection device, which includes: an acquisition module 10, a training module 20, a sorting module 30 and a determination module 40;
[0196] The acquisition module 10 is used to acquire a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network.
[0197] The training module 20 is used to train the model based on the CVE information and the industrial control asset information to obtain the target ranking model.
[0198] The sorting module 30 is used to sort the CVE information in the candidate CVE information set according to the target sorting model, and to determine the target CVE information set based on the sorting result.
[0199] The determining module 40 is used to determine the industrial control asset vulnerability information in the industrial control network based on the target CVE information set.
[0200] This embodiment discloses the acquisition of a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network. A model is trained based on the CVE information and industrial control asset information to obtain a target ranking model. The CVE information in the candidate CVE information set is ranked according to the target ranking model, and a target CVE information set is determined based on the ranking result. Finally, industrial control asset vulnerability information in the industrial control network is determined based on the target CVE information set. Compared to the existing method of manually matching industrial control asset information with CVE information to determine industrial control asset vulnerabilities, this embodiment first acquires a candidate CVE information set generated based on CVE information and industrial control asset information in the industrial control network, then ranks the CVE information in the candidate CVE information set according to the target ranking model to obtain the target CVE information set, and finally determines industrial control asset vulnerability information in the industrial control network based on the target CVE information set. This allows for accurate identification of industrial control asset vulnerabilities in the industrial control network, reducing the risk of industrial networks being attacked.
[0201] Other embodiments or specific implementations of the industrial control asset vulnerability detection device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.
[0202] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.
[0203] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. In the unit claims listing several devices, several of these devices may be embodied by the same hardware item. The use of the terms first, second, and third, etc., does not indicate any order and can be interpreted as names.
[0204] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.
[0205] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.
Claims
1. A method for detecting vulnerabilities in industrial control assets, characterized in that, The industrial control asset vulnerability detection method includes the following steps: Obtain a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network; The target ranking model is obtained by training the model based on the CVE information and the industrial control asset information. The CVE information in the candidate CVE information set is sorted according to the target sorting model, and the target CVE information set is determined according to the sorting results; Based on the target CVE information set, determine the vulnerability information of industrial control assets in the industrial control network.
2. The industrial control asset vulnerability detection method as described in claim 1, characterized in that, The step of training the model based on the CVE information and the industrial control asset information to obtain the target ranking model specifically includes: Feature extraction is performed on the CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples; The target ranking model is obtained by training the model based on the CVE feature samples and the industrial control asset feature samples.
3. The industrial control asset vulnerability detection method as described in claim 2, characterized in that, The step of training the model based on the CVE feature samples and the industrial control asset feature samples to obtain the target ranking model specifically includes: Based on the CVE feature samples and the industrial control asset feature samples, the preset prediction model and the preset nonlinear model are trained to obtain the target prediction model and the target nonlinear model. The target prediction model and the target nonlinear model are fused to obtain the target ranking model.
4. The industrial control asset vulnerability detection method as described in claim 3, characterized in that, The step of fusing the target prediction model and the target nonlinear model to obtain the target ranking model specifically includes: The target prediction model and the target nonlinear model are fused to obtain the current ranking model; The CVE information in the candidate CVE information set is sorted according to the current sorting model to obtain a sorting result sample; The sorting result sample is sent to the target terminal device, and the verification result fed back by the target terminal device based on the sorting result sample is received; When the verification result is successful, the current ranking model is used as the target ranking model.
5. The industrial control asset vulnerability detection method as described in claim 4, characterized in that, After the steps of sending the sorting result sample to the target terminal device and receiving the verification result fed back by the target terminal device based on the sorting result sample, the industrial control asset vulnerability detection method further includes: When the verification result is that the verification failed, the error correction information fed back by the target terminal device based on the sorting result sample is received; Training samples are generated based on the error correction information and the sorting result samples, and the current sorting model is trained based on the training samples; Return to the step of sorting the CVE information in the candidate CVE information set according to the current sorting model to obtain the sorted result sample.
6. The industrial control asset vulnerability detection method as described in claim 1, characterized in that, The step of sorting the CVE information in the candidate CVE information set according to the target sorting model and determining the target CVE information set based on the sorting results specifically includes: The CVE information in the candidate CVE information set is sorted according to the target sorting model to obtain the sorting result; The CVE information in the candidate CVE information set is filtered according to the sorting results to obtain the target CVE information set.
7. The industrial control asset vulnerability detection method as described in claim 1, characterized in that, After the step of determining the industrial control asset vulnerability information in the industrial control network based on the target CVE information set, the industrial control asset vulnerability detection method further includes: Obtain user terminal information and locate the information display template corresponding to the user terminal information; Based on the information display template and the industrial control asset vulnerability information, an early warning message is generated and sent to the target terminal device.
8. The industrial control asset vulnerability detection method as described in any one of claims 1-7, characterized in that, Before the step of obtaining the candidate CVE information set, the industrial control asset vulnerability detection method further includes: Obtain common vulnerability disclosure CVE information and industrial control asset information in the industrial control network, and generate CVE tags corresponding to the CVE information; The industrial control asset information is matched with the CVE tags, and the CVE information is filtered according to the matching results to obtain a candidate CVE information set.
9. The industrial control asset vulnerability detection method as described in claim 8, characterized in that, The step of matching the industrial control asset information with the CVE tags and filtering the CVE information based on the matching results to obtain a candidate CVE information set specifically includes: The industrial control asset information is fuzzy matched with the CVE tag to obtain the fuzzy matching result; The text similarity between the CVE information and the industrial control asset information is determined according to a preset text similarity model; The similarity coefficient between the CVE information and the industrial control asset information is determined according to a preset similarity coefficient model; The CVE information is filtered based on the fuzzy matching results, the text similarity, and the similarity coefficient to obtain a candidate CVE information set.
10. The industrial control asset vulnerability detection method as described in claim 9, characterized in that, The step of performing a fuzzy match between the industrial control asset information and the CVE tag to obtain a fuzzy match result specifically includes: Keyword extraction is performed on the industrial control asset information to obtain key industrial control asset information; The key industrial control asset information is matched with the CVE tag to obtain the fuzzy matching result.
11. The industrial control asset vulnerability detection method as described in claim 9, characterized in that, The step of determining the text similarity between the CVE information and the industrial control asset information based on a preset text similarity model specifically includes: The CVE word vectors corresponding to the CVE information and the industrial control asset word vectors corresponding to the industrial control asset information are determined according to the preset word vector model. The text similarity between the CVE information and the industrial control asset information is determined based on a preset text similarity model, the CVE word vector, and the industrial control asset word vector.
12. The industrial control asset vulnerability detection method as described in claim 9, characterized in that, The step of filtering the CVE information based on the fuzzy matching result, the text similarity, and the similarity coefficient to obtain a candidate CVE information set specifically includes: The CVE information is filtered based on the fuzzy matching results to obtain a first CVE information set; The CVE information is filtered based on the text similarity to obtain a second CVE information set; The CVE information is filtered based on the similarity coefficient to obtain a third CVE information set; The candidate CVE information set is determined based on the first CVE information set, the second CVE information set, and the third CVE information set.
13. An industrial control asset vulnerability detection device, characterized in that, The industrial control asset vulnerability detection device includes: a memory, a processor, and an industrial control asset vulnerability detection program stored in the memory and executable on the processor. When the industrial control asset vulnerability detection program is executed by the processor, it implements the steps of the industrial control asset vulnerability detection method as described in any one of claims 1 to 12.
14. A storage medium, characterized in that, The storage medium stores an industrial control asset vulnerability detection program, which, when executed by a processor, implements the steps of the industrial control asset vulnerability detection method as described in any one of claims 1 to 12.
15. An industrial control asset vulnerability detection device, characterized in that, The industrial control asset vulnerability detection device includes: an acquisition module, a training module, a sorting module, and a determination module; The acquisition module is used to acquire a candidate CVE information set, which is generated based on CVE information and industrial control asset information in the industrial control network. The training module is used to train the model based on the CVE information and the industrial control asset information to obtain the target ranking model; The sorting module is used to sort the CVE information in the candidate CVE information set according to the target sorting model, and to determine the target CVE information set based on the sorting result; The determining module is used to determine the vulnerability information of industrial control assets in the industrial control network based on the target CVE information set.
16. The industrial control asset vulnerability detection device as described in claim 15, characterized in that, The training module is also used to extract features from the CVE information and industrial control asset information to obtain CVE feature samples and industrial control asset feature samples. The training module is also used to train the model based on the CVE feature samples and the industrial control asset feature samples to obtain the target ranking model.
17. The industrial control asset vulnerability detection device as described in claim 16, characterized in that, The training module is also used to train the preset prediction model and the preset nonlinear model based on the CVE feature samples and the industrial control asset feature samples to obtain the target prediction model and the target nonlinear model. The training module is also used to fuse the target prediction model and the target nonlinear model to obtain a target ranking model.
18. The industrial control asset vulnerability detection device as described in claim 17, characterized in that, The training module is also used to fuse the target prediction model and the target nonlinear model to obtain the current ranking model; The training module is also used to sort the CVE information in the candidate CVE information set according to the current sorting model to obtain sorting result samples; The training module is also used to send the sorting result sample to the target terminal device and receive the verification result fed back by the target terminal device based on the sorting result sample; The training module is also used to use the current ranking model as the target ranking model when the verification result is that the verification is passed.
19. The industrial control asset vulnerability detection device as described in claim 18, characterized in that, The training module is also used to receive error correction information fed back by the target terminal device based on the sorting result sample when the verification result is that the verification failed. The training module is further configured to generate training samples based on the error correction information and the sorting result samples, and to train the current sorting model based on the training samples; The training module is also used to return the step of sorting the CVE information in the candidate CVE information set according to the current sorting model to obtain the sorted result sample.
20. The industrial control asset vulnerability detection device as described in claim 15, characterized in that, The sorting module is further configured to sort the CVE information in the candidate CVE information set according to the target sorting model to obtain a sorting result; The sorting module is further configured to filter the CVE information in the candidate CVE information set according to the sorting result, and obtain the target CVE information set.