Attack graph generation method and system for industrial control systems

Abstract

This invention provides a method and system for generating attack graphs for industrial control systems. The method includes: extracting comprehensive risk data of the industrial control system to generate ATT&CK initial attack tactic probabilities, ATT&CK attack technique selection probabilities, ATT&CK attack tactic jump probabilities, and the system topology of the industrial control system; generating optimal attack sequences between devices in the industrial control system based on a hidden Markov model according to the ATT&CK initial attack tactic probabilities, ATT&CK attack technique selection probabilities, and ATT&CK attack tactic jump probabilities; and generating an attack graph based on the system topology and optimal attack sequences of the industrial control system. This invention improves the efficiency and comprehensiveness of risk assessment for industrial control systems by comprehensively extracting comprehensive risk data and generating optimal attack sequences between devices to produce attack graphs for assessing the risks of industrial control systems.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, and in particular to an attack graph generation method and system for industrial control systems. Background Technology

[0002] The intelligent and information-based development of Industrial Control Systems (ICS) has become a new form of future industry, widely applied across various sectors, bringing more efficient and intelligent solutions to production and management. With the close interaction between the cyberspace and physical space of industrial control systems, various attack methods have become possible for intruding into industrial control networks. Furthermore, as a major component of national critical infrastructure, attacks on industrial control systems can cause significant losses to physical assets, personnel safety, and national security.

[0003] Risk assessment is a crucial part of the information security lifecycle, primarily involving the identification, analysis, and evaluation of risks in industrial control systems. Through risk assessment, security analysts gain a direct understanding of system vulnerabilities, threats, and risk status, enabling them to deploy corresponding security protection strategies. However, compared to traditional IT systems, industrial control systems involve a wide variety of equipment, complex operational processes, and tight coupling between cyber-physical systems, making traditional risk assessment methods difficult to apply directly.

[0004] Attack graphs are a classic risk assessment method used to evaluate the network vulnerability of industrial control systems, visually illustrating all attack paths the system faces. However, traditional attack graph generation methods for industrial control system risk assessment have the following drawbacks: Firstly, they primarily rely on the topological vulnerability of the industrial control system, depending on its topology and vulnerability information. This is because not all attacks on industrial control systems rely on vulnerabilities; for example, attackers might not exploit any recent vulnerabilities but instead install malware on a computer to attack the power grid. Secondly, traditional attack graph generation methods do not consider the defensive capabilities of the industrial control system, relying solely on static information, thus failing to provide a comprehensive and rapid risk assessment. Summary of the Invention

[0005] The attack graph generation method and system for industrial control systems provided by this invention are used to solve the problem that existing technologies cannot comprehensively and quickly assess the risks of industrial control systems.

[0006] This invention provides a method for generating attack graphs for industrial control systems, comprising:

[0007] Extract comprehensive risk data from the industrial control system to generate the initial ATT&CK attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability, and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data.

[0008] Based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, and ATT&CK attack tactic jump probability, the optimal attack sequence between devices in the industrial control system is generated based on the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0009] An attack graph is generated based on the system topology of the industrial control system and the optimal attack sequence.

[0010] According to the present invention, an attack graph generation method for industrial control systems is provided, wherein the generation of the initial attack tactic probability of ATT&CK, the attack technique selection probability of ATT&CK, the attack tactic switching probability of ATT&CK, and the system topology of the industrial control system is based on the comprehensive risk data of the industrial control system, including:

[0011] Based on the device classification in the security standard data, generate the initial attack tactical probability of ATT&CK;

[0012] Based on the first set of attack techniques corresponding to the device classification, generate the first probability of attacking the device using any attack technique in the first set of attack techniques.

[0013] Based on the vulnerability set of the device and the second attack technique set corresponding to the vulnerabilities in the vulnerability set, a second probability of attacking the device by any attack technique in the second attack technique set is generated, wherein the vulnerability set is determined based on the vulnerability information;

[0014] Based on the mapping relationship between the security control measures and ATT&CK attack techniques, a third probability is generated for the security control measures to prevent any attack technique in the first set of attack techniques and the second set of attack techniques from successfully attacking the device.

[0015] Based on the alarm data generated by the industrial control system defense device, a fourth probability is generated that any one of the attack techniques in the first attack technique set and the second attack technique set is used to attack the device.

[0016] The ATT&CK attack technique selection probability is generated based on the first probability, the second probability, the third probability, and the fourth probability.

[0017] The ATT&CK attack tactical jump probability is generated based on the historical global persistent threat attack data.

[0018] According to the present invention, an attack graph generation method for industrial control systems is provided, wherein generating an attack graph based on the system topology of the industrial control system and the optimal attack sequence includes:

[0019] Generate a graph structure based on the system topology;

[0020] The device information, device connection relationships, and optimal attack sequence in the industrial control system are filled into the graph structure to generate an initial attack graph;

[0021] Eliminate the loops in the initial attack graph;

[0022] The initial attack graph after eliminating loops is traversed using a depth-first approach to generate the attack graph.

[0023] According to the attack graph generation method for industrial control systems provided by the present invention, the step of generating the ATT&CK attack tactical jump probability based on the historical global persistent threat attack data includes:

[0024] Traverse the ATT&CK dataset and extract the first set of APT attack groups or malware.

[0025] For any APT attack organization or malware in the first set, extract the corresponding set of attack techniques;

[0026] For any attack technique in the set of attack techniques, extract the corresponding attack tactics;

[0027] The attack techniques in the attack technique set are sorted according to the attack order of the attack tactics. A second set is formed by extracting the next-hop techniques corresponding to each attack technique in the sorted attack technique set. The next-hop techniques are determined according to the attack tactics and the next-order attack tactics corresponding to each attack technique in the sorted attack technique set. The next-order attack tactics are the attack tactics corresponding to the next-order attack techniques.

[0028] The ATT&CK attack tactic jump probability is generated based on the probability distribution of the next attack tactic following any attack tactic in the attack tactic set.

[0029] According to the attack graph generation method for industrial control systems provided by the present invention, the elimination of loops in the initial attack graph includes:

[0030] A depth-first traversal is performed from the root node of the initial attack graph, and the visited child nodes are marked and pushed onto the stack until all child nodes have been visited or the visited attack child nodes have appeared on the stack. The root node is the attacker of the industrial control system, and all child nodes include the device child nodes corresponding to the devices in the industrial control system and the attack child nodes corresponding to the attack tactics in the optimal attack sequence.

[0031] If the visited attack child node has already appeared in the stack, delete the attack child node that appeared last in the stack to eliminate the loop in the initial attack graph.

[0032] According to the attack graph generation method for industrial control systems provided by the present invention, the step of performing a depth-first traversal on the initial attack graph after loop elimination to generate the attack graph includes:

[0033] A depth-first traversal is performed on the initial attack graph after loop elimination to split the target optimal attack path. The target optimal attack path is the optimal attack path that includes the target sub-node in the optimal attack sequence. The target sub-node is the attack sub-node in the optimal attack sequence whose attack techniques belong to the ATT&CK for ICS database and affect the Impact tactics.

[0034] The attack graph is generated based on the split initial attack graph.

[0035] The present invention also provides an attack graph generation system for industrial control systems, comprising: a first generation module, a second generation module, and a third generation module;

[0036] The first generation module is used to extract comprehensive risk data of the industrial control system and generate the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data and historical global persistent threat attack data.

[0037] The second generation module is used to generate the optimal attack sequence between devices in the industrial control system based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability and ATT&CK attack tactic jump probability, according to the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0038] The third generation module is used to generate an attack graph based on the system topology of the industrial control system and the optimal attack sequence.

[0039] The present invention also provides an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the attack graph generation method for industrial control systems as described above.

[0040] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the attack graph generation method for industrial control systems as described above.

[0041] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the attack graph generation method for industrial control systems as described above.

[0042] The attack graph generation method and system for industrial control systems provided by this invention, when extracting comprehensive risk data of industrial control systems, not only considers the impact of static information of the industrial control system (such as system topology and vulnerability information) on system security, but also considers the dynamic information of the constantly changing network environment faced by the industrial control system (such as alarm data) and the impact of the industrial control system's defense capabilities on the interference of attack behavior (such as security control measures and security standard data) on system security. This makes it possible to improve the efficiency and comprehensiveness of risk assessment of industrial control systems by generating the optimal attack sequence between devices based on the comprehensive risk data, and the attack graph generated based on the optimal attack sequence and system topology. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0044] Figure 1 This is one of the flowcharts illustrating the attack graph generation method for industrial control systems provided by the present invention.

[0045] Figure 2 This is the second flowchart of the attack graph generation method for industrial control systems provided by the present invention;

[0046] Figure 3 This is a schematic diagram of the comprehensive risk data extraction architecture provided by the present invention;

[0047] Figure 4 This is a schematic diagram of the algorithm code for the optimal attack sequence between devices provided by this invention;

[0048] Figure 5This is a schematic diagram of the method for generating optimal attack sequences between devices provided by the present invention;

[0049] Figure 6 This is a schematic diagram of the system topology for an industrial control scenario in a smart manufacturing enterprise, provided by the present invention.

[0050] Figure 7 This is a business-based equipment classification diagram for industrial control scenarios in intelligent manufacturing enterprises, provided by the present invention.

[0051] Figure 8 This is an example diagram of the optimal attack sequence between devices in the industrial control scenario of an intelligent manufacturing enterprise, provided by the present invention.

[0052] Figure 9 This is an example attack diagram of an industrial control scenario in a smart manufacturing enterprise, provided by the present invention.

[0053] Figure 10 This is a schematic diagram of the attack graph generation system for industrial control systems provided by the present invention;

[0054] Figure 11 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0056] The attack graph generation method for industrial control systems provided by this invention differs from traditional attack graph generation methods based on topology vulnerability. It replaces the vulnerability nodes in traditional attack graphs with attack techniques from ATT&CK for ICS, more intuitively reflecting the attack techniques that attackers might employ rather than the vulnerabilities they exploit. This improves the efficiency and comprehensiveness of risk assessment for industrial control systems. The specific implementation is as follows:

[0057] Figure 1 This is one of the flowcharts illustrating the attack graph generation method for industrial control systems provided by the present invention, such as... Figure 1 As shown, the method includes:

[0058] Step 110: Extract comprehensive risk data of the industrial control system to generate the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability, and system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data.

[0059] Step 120: Based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, and ATT&CK attack tactic jump probability, generate the optimal attack sequence between devices in the industrial control system based on the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0060] Step 130: Generate an attack graph based on the system topology of the industrial control system and the optimal attack sequence.

[0061] It should be noted that the above method can be implemented by computer equipment.

[0062] Optionally, the comprehensive risk data may specifically include security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data for industrial control systems. The industrial control systems may specifically include process control systems, discrete control systems, power systems, nuclear industry, etc.

[0063] Figure 2 This is the second flowchart illustrating the attack graph generation method for industrial control systems provided by this invention, as shown below. Figure 2 As shown, this includes: extracting comprehensive risk data and automatically generating attack graphs. Specifically, extracting comprehensive risk data can include the following steps:

[0064] (1) Extraction of security standard data; (2) Extraction of vulnerability information;

[0065] (3) Extraction of the mapping relationship between security control measures and ATT&CK attack techniques; (4) Extraction of alarm data; (5) Extraction of historical global advanced persistent threat (APT) attack data.

[0066] The automated generation of attack graphs includes the following steps: (1) generation of optimal attack sequences between devices; (2) generation of global attack graphs.

[0067] The core task of comprehensive risk data extraction is to filter, quantify, map, and utilize information such as network threat intelligence. The information requiring quantification includes: Adversarial Tactics, Techniques and Common Knowledge Base (ATT&CK) data, Common Vulnerabilities and Exposures (CVE) data, Common Attack Pattern Enumeration and Classification (CAPEC) data, Common Weakness Enumeration (CWE) data, NIST 800-53 security controls, alarm data from industrial control systems, and relevant security standards. Quantitative relationships need to be established between different risk data sets. The solution uses ATT&CK attack techniques as the core, maps them to other expert experience, and assigns quantified values.

[0068] Figure 3 This is a schematic diagram of the comprehensive risk data extraction architecture provided by the present invention, as shown below. Figure 3 As shown, the first step in the comprehensive risk data extraction process is the extraction of security standard data. This step, based on the requirements of industrial control security standards and the actual situation of the industrial control system, completes the classification and identification of assets within the industrial control system, and the identification and extraction of threats and vulnerabilities. Risk assessment standards (ISO31000 / NIST SP800-30 / IEC 62443, etc.), industrial control system databases (asset lists and equipment parameter manuals), historical operation databases, and ATT&CK databases are input into the attack graph generation model for industrial control systems provided by this invention (hereinafter referred to as the attack graph generation model). The output is a mapping table of equipment type / management vulnerability and ATT&CK attack techniques in the industrial control system, i.e., security standard data. This attack graph generation model can be specifically used to execute the attack graph generation method for industrial control systems provided by this invention. The historical operation database stores data on equipment operating status, which can be understood as equipment maintenance / fault data, such as "the equipment failed / repaired at XXXX-XX-XX time".

[0069] Step 2 of the comprehensive risk data extraction process involves vulnerability information extraction. This step uses CWE and CAPEC data as intermediate links to establish a mapping relationship between CVE data and ATT&CK attack techniques. Details are as follows:

[0070] (1) Extract and traverse the National Vulnerability Database (NVD) and store the mapping relationship between CVE and CWE vulnerability types;

[0071] (2) Extract and traverse the CWE database to store the mapping relationship between CWE and CAPEC attack types;

[0072] (3) Extract and traverse the CAPEC database, store the mapping relationship between CAPEC and ATT&CK attack techniques, and establish a similar mapping based on ATT&CK for ICS.

[0073] (4) Based on the above mapping relationship, establish a CVE data-ATT&CK attack technology mapping database to store the mapping relationship between CVE data and ATT&CK attack technology and complete the extraction of vulnerability information.

[0074] Step 3 of the comprehensive risk data extraction process involves extracting the mapping relationship between security control measures and ATT&CK attack techniques. NIST SP800-53 provides a comprehensive security control catalog that can be used to manage risks in organizations of any size and department. This step establishes the mapping relationship between NIST security control items and ATT&CK attack techniques using a process-oriented approach. Specifically:

[0075] (1) ATT&CK mitigation measures are parsed, and the mapping relationship between ATT&CK mitigation measures and ATT&CK attack techniques is stored.

[0076] (2) ATT&CK attack technique analysis: traverse the attack techniques and corresponding strategies corresponding to the mitigation measures, analyze the text descriptions corresponding to the attack techniques, and extract the security context (domain, platform, configuration and tools) corresponding to the attack techniques.

[0077] (3) Analysis of SP800-53 security control measures: NIST SP800-53R5 has 20 major categories of security control items, 11 of which can establish mitigation measures for ATT&CK attacks (access control, configuration management, contingency planning, identification and authentication, media protection, risk assessment, security assessment and authorization, system and communication protection, system and information integrity, and supply chain risk management). For a single attack technique, based on the extracted security context and mitigation measures mapped to keywords of security control measures, i.e., the mapping relationship between ATT&CK attack techniques and major categories of NIST SP800-53R5 security control items, the security control item to which the security control measure belongs can be determined based on the keyword.

[0078] (4) Based on the mapping relationship between ATT&CK attack techniques and the major categories of security control items in NIST SP800-53R5, examine the details of the security control items, delete the security control items that do not conform to the definition of mitigation measures, and extract the mapping relationship between security control measures and ATT&CK attack techniques.

[0079] Step 4 of the comprehensive risk data extraction process involves extracting alarm data. This step iterates through the alarm data and identifies malicious payloads based on known attack signatures. Upon successful identification, the attacker's IP address, the victim's IP address, and the timestamp are stored. Then, the attack type is retrieved based on the known attack signature, allowing real-time acquisition of the attacker's current attack tactics, thus completing the alarm data extraction.

[0080] Step 5 of the comprehensive risk data extraction process involves extracting historical APT attack data. This step analyzes the APT organization data in the ATT&CK dataset, extracts the attack tactics distribution of individual attack organizations and malware, analyzes the attack tactics used by attackers and their interdependencies, and completes the extraction of historical APT attack data.

[0081] The automated attack graph generation is based on the comprehensive risk data obtained from the comprehensive risk data extraction step. It generates the initial attack tactic probability of ATT&CK, the attack technique selection probability of ATT&CK, the attack tactic jump probability of ATT&CK, and the system topology of the industrial control system. It automatically generates the optimal attack link from the attack entry point (i.e., the entry device) to the attack target (target device), that is, the optimal attack path between devices. Based on the optimal attack path between each device in the industrial control system, the optimal attack sequence is obtained.

[0082] The first step in the automated attack graph generation process, based on a hidden Markov model, utilizes dynamic programming to reduce redundant computations and generate the optimal attack sequence between devices. This step, using the comprehensive risk data obtained from the comprehensive risk data extraction step, combined with the industrial control system's own attributes (equipment type, the set of attack techniques corresponding to the equipment, etc.), generates the initial attack tactical probability P of ATT&CK. a ATT&CK attack tactical jump probability P v The probability of choosing ATT&CK attack techniques, P b Then, the attacker's potential attack techniques between devices are determined, and the optimal attack sequence is generated.

[0083] Optionally, Figure 4 This is a schematic diagram of the algorithm code for the optimal attack sequence between devices provided by this invention. See [link / reference]. Figure 4(1) Initialize a two-dimensional array V to store the maximum probability of time and state s; initialize a two-dimensional array back to correspond to the predecessor state of time t and state s. V[s][t] represents the maximum probability of being in state s at time t, and back[s][t] represents the previous state of the path with the maximum probability of being in state s at time t. When t=1, initialize V[s][1] and back[s][1] for each state s from 1 to N. Specifically, v[s][1] is equal to the transition probability from state 0 to state s a[0][s] multiplied by the emission probability of event o_t observed in state s b[o_t][s], and back[s][1] is equal to 0.

[0084] (2) For each time step t from 2 to T (T is the length of the observation sequence), and for each state s from 1 to N (N is the number of hidden states), calculate v[s][t] and back[s][t]. Specifically, v[s][t] is equal to v[i][t-1] multiplied by the transition probability from state i to state s, a[i][s] multiplied by the emission probability of observing event o_t in state s, b[o_t][s], where i iterates from 1 to N and takes the maximum value. back[s][t] is equal to the i that makes v[s][t] take the maximum value.

[0085] (3) Find the element with the highest probability from v[T] and use it as the last state of the final optimal attack path. Then, backtrack based on its predecessor state to obtain the entire optimal attack path.

[0086] Step 2 of the automated attack graph generation process: Global Attack Graph Generation. This step generates a global attack graph for the industrial control system, i.e., the final attack graph, based on the optimal attack sequence between devices and the device topology relationships. The device topology relationships can be determined according to the system topology structure.

[0087] The attack graph generation method for industrial control systems provided by this invention considers not only the impact of static information (such as system topology and vulnerability information) on system security when extracting comprehensive risk data of industrial control systems, but also the dynamic information of the constantly changing network environment faced by the industrial control system (such as alarm data) and the impact of the industrial control system's defense capabilities on the interference of attack behavior (such as security control measures and security standard data). This results in the generation of the optimal attack sequence between devices based on the comprehensive risk data, as well as the attack graph generated based on the optimal attack sequence and system topology, thus improving the efficiency and comprehensiveness of risk assessment for industrial control systems.

[0088] Furthermore, in one embodiment, generating the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic switching probability, and the system topology of the industrial control system based on the comprehensive risk data of the industrial control system may specifically include:

[0089] Based on the device classification in the security standard data, generate the initial attack tactical probability of ATT&CK;

[0090] Based on the first set of attack techniques corresponding to the device classification, generate the first probability of attacking the device using any attack technique in the first set of attack techniques.

[0091] Based on the vulnerability set of the device and the second attack technique set corresponding to the vulnerabilities in the vulnerability set, a second probability of attacking the device by any attack technique in the second attack technique set is generated, wherein the vulnerability set is determined based on the vulnerability information;

[0092] Based on the mapping relationship between the security control measures and ATT&CK attack techniques, a third probability is generated for the security control measures to prevent any attack technique in the first set of attack techniques and the second set of attack techniques from successfully attacking the device.

[0093] Based on the alarm data generated by the industrial control system defense device, a fourth probability is generated that any one of the attack techniques in the first attack technique set and the second attack technique set is used to attack the device.

[0094] The ATT&CK attack technique selection probability is generated based on the first probability, the second probability, the third probability, and the fourth probability.

[0095] The ATT&CK attack tactical jump probability is generated based on the historical global persistent threat attack data.

[0096] Optionally, Figure 5 This is a schematic diagram of the optimal attack sequence generation method between devices provided by the present invention, as shown below. Figure 5 As shown, based on the extracted security standard data of the industrial control system, the classification of any device in the industrial control system can be obtained. Based on the classification of any device (e.g., device B), the initial attack tactical probability P of ATT&CK is generated. a Equipment B is classified into four main categories: entry equipment, information equipment, industrial control equipment, and target equipment, corresponding to four different P types. a Distribution, where the initial attack tactical probability P of ATT&CK is... a It is a preset probability, extracted from historical attack data. For different device types, P... aThe distributions are different, and specific information can be obtained by querying the database.

[0097] P, categorized by equipment type as industrial control equipment a-ics For example.

[0098]

[0099] Based on the set of attack techniques corresponding to the type of device B (i.e., the first set of attack techniques), generate the probability that any attack technique in the first set of attack techniques can be used to attack the device, i.e., the first probability P. device .

[0100]

[0101] Among them, device type matching means that the device type corresponding to the first attack technology set matches the device, and device type mismatch means that the device type corresponding to the first attack technology set does not match the device.

[0102] Based on the vulnerability set on device B and the attack technique set corresponding to the vulnerabilities in the vulnerability set (i.e., the vulnerability associated with device B) (i.e., the second attack technique set), generate the probability that any attack technique in the second attack technique set can be used to attack the device, i.e., the second probability P. vul .

[0103]

[0104] Based on the mapping relationship between the identified security control measures and ATT&CK attack techniques, the probability that the security control measure will prevent any attack technique from the first set of attack techniques and the second set of attack techniques from successfully attacking the device is generated, i.e., the third probability P. defense .

[0105]

[0106] Among these, security controls can be understood as defensive measures. Vulnerabilities / alarms and other elements represent that attackers are more likely to launch attacks on the device, while defensive measures represent that attackers are less likely to launch attacks on the device. Therefore, P defense It is a negative value.

[0107] Using any attack technique from the first and second attack technique sets to attack device B, the probability that any attack technique from the first and second attack technique sets was used (i.e., used to attack the device) is generated based on whether the alarm data generated in real time by the industrial control system defense equipment (IP matching in the alarm information) matches the alarm rule corresponding to the attack technique when attacking the device (rule matching is used in actual detection). This probability is the fourth probability P.alert .

[0108]

[0109] The final probability P of selecting the ATT&CK attack technique is generated. b P b =P device +P vul +P defense +P alert .

[0110] Based on historical APT attack data, generate the ATT&CK attack tactical jump probability P. v .

[0111] Furthermore, in one embodiment, generating the ATT&CK attack tactical jump probability based on the historical global persistent threat attack data may specifically include:

[0112] Traverse the ATT&CK dataset and extract the first set of APT attack groups or malware.

[0113] For any APT attack organization or malware in the first set, extract the corresponding set of attack techniques;

[0114] For any attack technique in the set of attack techniques, extract the corresponding attack tactics;

[0115] The attack techniques in the attack technique set are sorted according to the attack order of the attack tactics. A second set is formed by extracting the next-hop techniques corresponding to each attack technique in the sorted attack technique set. The next-hop techniques are determined according to the attack tactics and the next-order attack tactics corresponding to each attack technique in the sorted attack technique set. The next-order attack tactics are the attack tactics corresponding to the next-order attack techniques.

[0116] The ATT&CK attack tactic jump probability is generated based on the probability distribution of the next attack tactic following any attack tactic in the attack tactic set.

[0117] Optionally, the ATT&CK database is traversed to extract the set consisting of attack organizations / malware, i.e., the first set G; for any attack organization / malware G in the first set G... i Extract its corresponding attack technique set Tec i For the attack technique set Tec i Any of the attack techniques Tec ij Extract its corresponding attack tactics. j .

[0118] For any attacking organization / malware G i Select its corresponding attack technology set Tec i According to the attack sequence of the attack tactics, the attack technology set Tec i Sort the attack techniques in the list and extract any attack technique Tec ij The corresponding next-hop technique (current attack technique Tec) ij (The corresponding attack tactics and the next attack tactics are determined), and the attack technology set Tec is extracted. i The next-hop technique corresponding to each attack technique in the set constitutes the second set, TecNext. ij .

[0119] For any attack technique, the corresponding attack tactic j Extract the TecNext corresponding to all its attack techniques. ij The set, based on its attack techniques and corresponding TecNext ij Set, extract Tactic j The corresponding next-order attack tactic, TacticNext. j The probability distribution is used to obtain the dependencies between attacker tactics.

[0120] Tactics obtained from historical APT attack data j Corresponding to TacticNext j The probability distribution generates the ATT&CK attack tactical jump probability P. v .

[0121] Furthermore, in one embodiment, generating the attack graph based on the system topology of the industrial control system and the optimal attack sequence may specifically include:

[0122] Generate a graph structure based on the system topology;

[0123] The device information, device connection relationships, and optimal attack sequence in the industrial control system are filled into the graph structure to generate an initial attack graph;

[0124] Eliminate the loops in the initial attack graph;

[0125] The initial attack graph after eliminating loops is traversed using a depth-first approach to generate the attack graph.

[0126] Optionally, a graph structure is created based on the system topology of the industrial control system, and the text information, logical information, and optimal attack sequence of the nodes in the graph structure are filled into the graph based on a comprehensive analysis of the graph content to generate an initial attack graph. The text information can specifically be the device information of the industrial control system, and the logical information can specifically be the connection relationship between the devices.

[0127] The initial attack graph generated based on the automatically created graph structure may contain loops. However, attackers will not repeatedly gain access to already compromised devices, so it is necessary to eliminate these loops in the initial attack graph. The final attack graph is generated by performing a depth-first traversal on the initial attack graph after loop elimination.

[0128] Furthermore, in one embodiment, eliminating loops in the initial attack graph may specifically include:

[0129] A depth-first traversal is performed from the root node of the initial attack graph, and the visited child nodes are marked and pushed onto the stack until all child nodes have been visited or the visited attack child nodes have appeared on the stack. The root node is the attacker of the industrial control system, and all child nodes include the device child nodes corresponding to the devices in the industrial control system and the attack child nodes corresponding to the attack tactics in the optimal attack sequence.

[0130] If the visited attack child node has already appeared in the stack, delete the attack child node that appeared last in the stack to eliminate the loop in the initial attack graph.

[0131] Furthermore, in one embodiment, the step of performing a depth-first traversal on the initial attack graph after eliminating loops to generate the attack graph may specifically include:

[0132] A depth-first traversal is performed on the initial attack graph after loop elimination to split the target optimal attack path. The target optimal attack path is the optimal attack path that includes the target sub-node in the optimal attack sequence. The target sub-node is the attack sub-node in the optimal attack sequence whose attack techniques belong to the ATT&CK for ICS database and affect the Impact tactics.

[0133] The attack graph is generated based on the split initial attack graph.

[0134] Optionally, eliminating loops in the initial attack graph may specifically include: the initial attack graph is composed of a root node and child nodes, and the child nodes may specifically include device child nodes corresponding to the equipment in the industrial control system and attack child nodes corresponding to the attack tactics in the optimal attack sequence.

[0135] Maintain an array to store the root node and a stack to store loops. The root node corresponds to the entry device. Perform a depth-first traversal from the root node, continuously visiting its child nodes. Mark the visited child nodes and push them onto the stack until there are no more child nodes (all child nodes have been visited) or the visited attacking child node has appeared on the stack. When the visited attacking child node has appeared on the stack, it means that a loop exists in the stack. At this point, delete the attacking child node that appeared last on the stack to eliminate the loop.

[0136] Optionally, performing a depth-first traversal on the initial attack graph after eliminating loops to generate the attack graph can specifically include:

[0137] A depth-first traversal is performed on the initial attack graph after loop elimination to decompose the optimal attack path of the target. When the target sub-node is reached, it is considered that an optimal attack path has been found. The optimal attack path of the target can be specifically the optimal attack path that includes the target sub-node in the optimal attack sequence. The target sub-node specifically refers to the attack sub-node in the optimal attack sequence between devices that includes attack techniques that belong to the ATT&CK for ICS data and affect the Impact tactic.

[0138] Integrate all optimal attack paths from the node information of the split initial attack graph to generate a global attack graph.

[0139] For example, the attack graph generation method for industrial control systems provided by this invention is used to generate attack graphs for industrial control scenarios in smart manufacturing enterprises. The system topology of the industrial control scenario in a smart manufacturing enterprise is as follows: Figure 6 As shown.

[0140] Step 1, extracting comprehensive risk data, involves asset identification in three layers, taking into account the characteristics of intelligent manufacturing scenarios. First, from the business level, intelligent manufacturing scenarios can be divided into production and processing, production assembly, production support, and product testing. Second, from the asset representation level, assets can be categorized into soft assets, hard assets, and human resources. Finally, detailed identification is performed based on the unit asset classification. The specific classification method is as follows... Figure 7 As shown.

[0141] The mapping relationship between the classification method and the attack techniques is shown in Table 1.

[0142] Table 1

[0143]

[0144]

[0145] In this context, RTU stands for Remote Terminal Unit, PLC stands for Programmable Logic Controller, IED stands for Intelligent Electronic Device, and Windows stands for Computer.

[0146] Step 2 of the comprehensive risk data extraction process uses CAPEC and CWE as intermediate relationships to establish a mapping between CVEs and attack techniques. The latest CAPEC, CWE, CVE, and ATT&CK data are imported in JSON format. The data is then traversed to obtain and store the mapping data for capecCwe, cweCve, tacticTechnique, and techniqueCapec, ultimately yielding the mapping relationship between CVEs and attack techniques, as shown in Table 2.

[0147] Table 2:

[0148]

[0149]

[0150] Step 3 of the comprehensive risk data extraction process involves analyzing the relationship between ATT&CK's official mitigation measures and NIST 800-53 security control measures to extract the mapping relationship between security control measures and ATT&CK attack techniques, as shown in Table 3.

[0151] Table 3

[0152] Control Control Name Technique Name AC-4 Information Flow Enforcement Drive-by Compromise AC-6 Least Privilege Drive-by Compromise CA-7 Continuous Monitoring Drive-by Compromise CM-2 Baseline Configuration Drive-by Compromise CM-6 Configuration Settings Drive-by Compromise CM-8 System Component Inventory Drive-by Compromise SA-22 Unsupported System Components Drive-by Compromise SC-18 Mobile Code Drive-by Compromise SC-2 Separation of System and User Functionality Drive-by Compromise SC-29 Heterogeneity Drive-by Compromise SC-3 Security Function Isolation Drive-by Compromise SC-30 Concealment and Misdirection Drive-by Compromise SC-39 Process Isolation Drive-by Compromise SC-7 Boundary Protection Drive-by Compromise SI-2 Flaw Remediation Drive-by Compromise SI-3 Malicious Code Protection Drive-by Compromise SI-4 System Monitoring Drive-by Compromise SI-7 Software,Firmware,and Information Integrity Drive-by Compromise

[0153] Step 4 of the comprehensive risk data extraction process identifies the attacker's attack type by retrieving attack signatures from the alarm data. Taking attack technique T1046 as an example, the query method for retrieving the attack signature is as follows:

[0154] destination_port=*|chart distinct_count(destination_port)as CNT bysource_address,destination_address|search CNT>50

[0155] If the retrieval is successful, it confirms that the attacker is using the T1046 attack technique in real time.

[0156] Step 5 of the comprehensive risk data extraction process involves analyzing the attack tactics used by the aforementioned APT attack organizations / malware and their hop relationships to obtain the probability distribution of the next-hop techniques corresponding to different attack tactics.

[0157] The first step in the automated attack graph generation process is the generation of the optimal attack sequence between devices. This step generates the initial attack tactical probability P of ATT&CK based on comprehensive risk data and the system's own attributes. a ATT&CK attack tactical jump probability P v (As shown in Table 4, the first row of Table 4 represents the next-hop technique, and the first column of Table 4 represents the current attack tactic.) ATT&CK attack technique selection probability P b Then, based on the optimal attack sequence generation algorithm between devices, an optimal attack sequence is generated. Figure 8 For example, the entry device is the host computer (information device), the target device is the PLC (target device), and the corresponding P... a Let P(taticNext=TA006)=1. Based on the next-hop tactical distribution corresponding to different tactics obtained in step 5 of extracting comprehensive risk data, P can be obtained. v The distribution is shown in Table 4. Finally, taking tactical TA006 as an example, P is explained. b The generation of this vulnerability set is assumed to be as follows: the host computer is a Windows computer, the PLC is a Siemens S7-1200, and the corresponding vulnerability set is VUL. ex (Including 14 vulnerabilities such as CVE-2021-37172), the corresponding defense suite is DEFENSE. ex (A set of 28 safety control items, including AC-16), with corresponding real-time alarm data in ALERT. ex (T0888). TA006 includes five attack techniques (T0840, T0842, T0846, T0888, T0887), P b =P device +P vul +P defense +P alert The final result is as follows Figure 8 As shown.

[0158] Table 4

[0159]

[0160]

[0161] Step 2 of the automated attack graph generation process: Global Attack Graph Generation. This step first generates a graph structure based on the system topology of the industrial control scenario in a smart manufacturing enterprise and the optimal attack sequence between devices generated in Step 1. Then, through loop elimination and depth-first traversal, the global attack graph is generated. An example attack graph is shown below. Figure 9 As shown.

[0162] The attack graph generation method for industrial control systems provided by this invention generates an attack graph for assessing the risks of industrial control systems by comprehensively extracting the integrated risk data of the industrial control system and generating the optimal attack sequence between devices, thereby improving the efficiency and comprehensiveness of risk assessment for industrial control systems.

[0163] The attack graph generation system for industrial control systems provided by this invention will be described below. The attack graph generation system for industrial control systems described below can be referred to in correspondence with the attack graph generation method for industrial control systems described above.

[0164] Figure 10 This is a schematic diagram of the attack graph generation system for industrial control systems provided by the present invention, as shown below. Figure 10 As shown, it includes:

[0165] First generation module 1010, second generation module 1011 and third generation module 1012;

[0166] The first generation module 1010 is used to extract comprehensive risk data of the industrial control system and generate the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data and historical global persistent threat attack data.

[0167] The second generation module 1011 is used to generate the optimal attack sequence between devices in the industrial control system based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability and ATT&CK attack tactic jump probability, according to the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0168] The third generation module 1012 is used to generate an attack graph based on the system topology of the industrial control system and the optimal attack sequence.

[0169] The attack graph generation system for industrial control systems provided by this invention, when extracting comprehensive risk data of industrial control systems, not only considers the impact of static information of the industrial control system (such as system topology and vulnerability information) on system security, but also the dynamic information of the constantly changing network environment faced by the industrial control system (such as alarm data) and the impact of the industrial control system's defense capabilities on the interference of attack behavior (such as security control measures and security standard data) on system security. This results in the generation of the optimal attack sequence between the generated devices based on the comprehensive risk data, as well as the attack graph generated based on the optimal attack sequence and system topology, thus improving the efficiency and comprehensiveness of risk assessment for industrial control systems.

[0170] Figure 11 This is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as... Figure 11 As shown, the electronic device may include a processor 1110, a communication interface 1111, a memory 1112, and a bus 1113, wherein the processor 1110, the communication interface 1111, and the memory 1112 communicate with each other via the bus 1113. The processor 1110 can call logical instructions in the memory 1112 to execute the following methods:

[0171] Extract comprehensive risk data from the industrial control system to generate the initial ATT&CK attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability, and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data.

[0172] Based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, and ATT&CK attack tactic jump probability, the optimal attack sequence between devices in the industrial control system is generated based on the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0173] An attack graph is generated based on the system topology of the industrial control system and the optimal attack sequence.

[0174] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer power supply (which may be a personal computer, server, or network power supply, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0175] Furthermore, this invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when these instructions are executed by a computer, the computer can execute the attack graph generation method for industrial control systems provided in the above-described method embodiments, for example including:

[0176] Extract comprehensive risk data from the industrial control system to generate the initial ATT&CK attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability, and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data.

[0177] Based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, and ATT&CK attack tactic jump probability, the optimal attack sequence between devices in the industrial control system is generated based on the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0178] An attack graph is generated based on the system topology of the industrial control system and the optimal attack sequence.

[0179] On the other hand, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the attack graph generation method for industrial control systems provided in the above embodiments, including, for example:

[0180] Extract comprehensive risk data from the industrial control system to generate the initial ATT&CK attack tactic probability, ATT&CK attack technique selection probability, ATT&CK attack tactic jump probability, and the system topology of the industrial control system. The comprehensive risk data includes security standard data, vulnerability information, mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data.

[0181] Based on the ATT&CK initial attack tactic probability, ATT&CK attack technique selection probability, and ATT&CK attack tactic jump probability, the optimal attack sequence between devices in the industrial control system is generated based on the hidden Markov model. The optimal attack sequence is composed of the optimal attack paths between devices.

[0182] An attack graph is generated based on the system topology of the industrial control system and the optimal attack sequence.

[0183] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer power supply (which may be a personal computer, server, or network power supply, etc.) to execute the methods described in various embodiments or some parts of the embodiments.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An attack graph generation method for an industrial control system, characterized by, The method comprises the following steps: extracting comprehensive risk data of an industrial control system to generate an ATT&CK initial attack tactic probability, an ATT&CK attack technique selection probability, an ATT&CK attack tactic jump probability and a system topology of the industrial control system, wherein the comprehensive risk data comprises security standard data, vulnerability information, a mapping relationship between security control measures and ATT&CK attack techniques, alarm data and historical global persistent threat attack data; generating an optimal attack sequence between devices in the industrial control system based on an implicit Markov model according to the ATT&CK initial attack tactic probability, the ATT&CK attack technique selection probability and the ATT&CK attack tactic jump probability, wherein the optimal attack sequence is composed of an optimal attack path between devices; generating an attack graph according to the system topology of the industrial control system and the optimal attack sequence; The method comprises the following steps: generating an ATT&CK initial attack tactic probability according to a device classification in the security standard data; generating a first probability that any attack technique in a first attack technique set corresponding to the device classification attacks a device according to the first attack technique set; generating a second probability that any attack technique in a second attack technique set corresponding to a vulnerability set of the device attacks the device according to the vulnerability set and the second attack technique set, wherein the vulnerability set is determined according to the vulnerability information; generating a third probability that the security control measures prevent any attack technique in the first attack technique set and the second attack technique set from successfully attacking the device according to the mapping relationship between the security control measures and the ATT&CK attack techniques, wherein the third probability is a negative value; generating a fourth probability that any attack technique in the first attack technique set and the second attack technique set is used to attack the device according to alarm data generated by a defense device of the industrial control system; generating the ATT&CK attack technique selection probability according to the first probability, the second probability, the third probability and the fourth probability; generating the ATT&CK attack tactic jump probability according to the historical global persistent threat attack data; The method comprises the following steps: generating a graph structure according to the system topology; filling device information, device connection relationships and the optimal attack sequence in the industrial control system into the graph structure to generate an initial attack graph; eliminating loops in the initial attack graph; performing depth-first traversal on the initial attack graph after the loops are eliminated to generate the attack graph.

2. The attack graph generation method for industrial control systems according to claim 1, wherein, The method comprises the following steps: traversing an ATT&CK dataset to extract a first set of APT attack organizations or malware; for any APT attack organization or malware in the first set, extracting a corresponding attack technique set; for any attack technique in the attack technique set, extracting a corresponding attack tactic; ordering the attack techniques in the attack technique set according to an attack order of the attack tactics, extracting a second set of next-hop techniques corresponding to each attack technique in the ordered attack technique set, the next-hop techniques being determined according to the attack tactic corresponding to each attack technique in the ordered attack technique set and a next-order attack tactic corresponding to a next-order attack technique; generating an ATT&CK attack tactic jump probability according to a probability distribution of the next-order attack tactic of the attack tactic corresponding to any attack technique in the attack technique set.

3. The attack graph generation method for industrial control systems according to claim 1, wherein, the eliminating loops in the initial attack graph comprises: performing a depth-first traversal from a root node of the initial attack graph, marking and pushing into a stack any accessed child node until all child nodes are accessed or any accessed attack child node has appeared in the stack, the root node being an attacker of the industrial control system, the all child nodes including device child nodes corresponding to devices in the industrial control system and attack child nodes corresponding to attack tactics in the optimal attack sequence; in the case where any accessed attack child node has appeared in the stack, deleting the attack child node appearing in the stack for the last time to eliminate loops in the initial attack graph.

4. The attack graph generation method for industrial control systems according to claim 1, wherein, the performing a depth-first traversal on the initial attack graph after eliminating loops to generate the attack graph comprises: performing a depth-first traversal on the initial attack graph after eliminating loops to split a target optimal attack path, the target optimal attack path being an optimal attack path in the optimal attack sequence including a target child node, the target child node being an attack child node in the optimal attack sequence including an attack technique belonging to an Impact tactic in an ATT&CK for ICS database; generating the attack graph according to the split initial attack graph.

5. An attack graph generation system for an industrial control system, characterized by, comprises: a first generation module, a second generation module, and a third generation module; the first generation module is configured to extract comprehensive risk data of an industrial control system to generate an ATT&CK initial attack tactic probability, an ATT&CK attack technique selection probability, an ATT&CK attack tactic jump probability, and a system topology of the industrial control system, the comprehensive risk data including security standard data, vulnerability information, a mapping relationship between security control measures and ATT&CK attack techniques, alarm data, and historical global persistent threat attack data; the second generation module is configured to generate an optimal attack sequence between devices in the industrial control system based on a hidden Markov model according to the ATT&CK initial attack tactic probability, the ATT&CK attack technique selection probability, and the ATT&CK attack tactic jump probability, the optimal attack sequence being composed of optimal attack paths between devices; The third generation module is configured to generate an attack graph according to the system topology of the industrial control system and the optimal attack sequence. The extracting of the comprehensive risk data of the industrial control system, the generation of the ATT&CK initial attack tactic probability, the ATT&CK attack technique selection probability, the ATT&CK attack tactic jump probability, and the system topology of the industrial control system, comprises: According to the device classification in the security standard data, an ATT&CK initial attack tactic probability is generated. According to the first attack technique set corresponding to the device classification, a first probability of an attack device being attacked by any attack technique in the first attack technique set is generated. According to the vulnerability set of the device and the second attack technique set corresponding to the vulnerabilities in the vulnerability set, a second probability of an attack device being attacked by any attack technique in the second attack technique set is generated, wherein the vulnerability set is determined according to the vulnerability information. According to the mapping relationship between the security control measures and the ATT&CK attack techniques, a third probability of the security control measures preventing any attack technique in the first attack technique set and the second attack technique set from successfully attacking the attack device is generated, wherein the third probability is a negative value. According to the alarm data generated by the defense device of the industrial control system, a fourth probability of any attack technique in the first attack technique set and the second attack technique set being used to attack the attack device is generated. According to the first probability, the second probability, the third probability, and the fourth probability, the ATT&CK attack technique selection probability is generated. According to the historical global persistent threat attack data, the ATT&CK attack tactic jump probability is generated. The generation of the attack graph according to the system topology of the industrial control system and the optimal attack sequence comprises: According to the system topology, a graph structure is generated. The device information, the device connection relationship in the industrial control system, and the optimal attack sequence are filled into the graph structure to generate an initial attack graph. Loops in the initial attack graph are eliminated. The initial attack graph after the elimination of the loops is subjected to a depth-first traversal to generate the attack graph.

6. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that The processor executes the computer program to realize the attack graph generation method for the industrial control system according to any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the attack graph generation method for the industrial control system according to any one of claims 1 to 4.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the attack graph generation method for the industrial control system according to any one of claims 1 to 4.

Images