Industrial control network dynamic threat path and weakness discovery method

Abstract

The invention discloses an industrial control network dynamic threat path and weakness discovery method, which relates to the technical field of industrial control network security and comprises the following steps: constructing an industrial control network practical training scene; generating a network topology structure through topology discovery; all network nodes are subjected to full-flow monitoring and health condition monitoring, and flow auditing results are stored in an associated mode; performing vulnerability analysis and threat mining on the nodes, and forming a network threat and weakness attack set model in combination with a threat path technology; and simulating an attack sequence according to the model combination, detecting a threat path and weakness, and generating a threat path and weakness report. By dynamically simulating an industrial control network practical training scene and combining technologies of full-flow monitoring, health scoring, weakness analysis, multi-level attack simulation, threat intelligence fusion and the like, accurate detection and real-time evaluation of threat paths and weakness in the industrial control network are realized, scientific and real-time decision support is provided for a security protection strategy, and the safety of the industrial control network is improved. And the anti-attack capability and the protection decision-making efficiency are obviously improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and in particular to a method for discovering dynamic threat paths and vulnerabilities of industrial control networks. Background Art

[0002] As industrial control systems (ICS) gradually develop towards networking and intelligence, the security threats faced by industrial control networks are becoming increasingly severe. Traditional industrial control systems are mainly composed of information management layer, industrial monitoring layer, industrial control layer and field equipment layer, and each layer is connected through network devices. However, the openness and complexity of industrial control networks make them easy targets for cyber attacks. Attackers can bypass traditional protection measures through complex threat paths and directly attack industrial control systems, which in turn has a serious impact on the safe operation of critical infrastructure.

[0003] In the existing technology, the security protection for industrial control networks mainly focuses on static defense measures such as firewalls, intrusion detection systems and vulnerability patching. These measures have certain protection capabilities against known attacks, but are powerless against complex and changeable attack paths and unidentified vulnerabilities. At the same time, there is a lack of effective monitoring and evaluation methods for the node health status, real-time traffic characteristics and their dynamic changes in the industrial control network, making it difficult to discover potential threat paths and system vulnerabilities in real time, resulting in security protection measures lagging behind the actual attack behavior of attackers. Summary of the invention

[0004] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a dynamic threat path and vulnerability discovery method for an industrial control network to solve the above-mentioned technical problems.

[0005] To achieve the above object, the present invention provides the following technical solution: a method for discovering dynamic threat paths and vulnerabilities of industrial control networks, comprising:

[0006] S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected through a router or a switch, and the network assets of each layer are connected through a switch.

[0007] S2: Automatically discover and generate network topology through network asset topology discovery;

[0008] S3: Perform full traffic monitoring and audit on all network nodes in the network topology structure of the industrial control network training scenario, and store the traffic audit results in a time series.

[0009] S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results;

[0010] S5: Perform vulnerability analysis and threat mining on all network nodes and terminal devices in the network topology structure under the industrial control network training scenario, combine information network threat path technology to form a network threat and vulnerability attack set model, and simulate the attack sequence under the industrial control network training scenario based on the network threat and vulnerability attack set model combination;

[0011] S6: Detect threat paths and path weaknesses in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate network threat paths and path weakness reports.

[0012] The present invention is further configured as follows: the information management layer includes monitoring equipment, a management server and a database server, which are used to obtain industrial control field data through the monitoring equipment; the industrial monitoring layer includes an engineer station and an operator station, which are used to monitor the industrial control process; the industrial control layer includes a programmable logic controller device and a distributed control system device, which are used to directly control the operating status and data interaction of the field equipment; the field equipment layer includes production equipment and sensors, which are used to execute control commands and collect data in the production process.

[0013] The present invention is further configured that step S3 comprises:

[0014] Deploy traffic collection equipment and probe nodes in the network topology structure, capture the communication data of the network nodes in real time, and record the attribute parameters of the communication data packets, wherein the attribute parameters include sequence number, length, timestamp, source address and destination address;

[0015] Reconstructing the communication data packets in the order of timestamps to form communication association links sorted in time series;

[0016] The communication data packets and the communication associated links are audited in real time to generate flow audit results, which are stored in association with the communication data packets in time series.

[0017] The present invention is further configured that step S4 comprises:

[0018] Obtaining network asset status parameters of all network nodes and terminal devices, and setting the network asset status parameters as a feature matrix;

[0019] The network nodes, terminal devices and corresponding feature matrices are mapped into graph nodes, and the communication relationships between network nodes and terminal devices are mapped into graph edges to construct a health status monitoring graph structure.

[0020] The feature matrix is ​​encoded and decoded through self-supervised reconstruction to obtain the reconstructed feature matrix and deviation measure;

[0021] The abnormality is calculated according to the reconstructed feature matrix and the deviation measure, the health score of the node is calculated according to the abnormality of the node, and a health status monitoring result is generated.

[0022] The present invention is further configured that step S5 comprises:

[0023] Perform vulnerability scans and risk annotations on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario;

[0024] Based on the identified vulnerabilities, a threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records, wherein the threat intelligence fusion model is used to define the vulnerability parameters of network nodes and terminal devices;

[0025] A multi-level attack simulation environment is constructed based on the threat intelligence fusion model to simulate the attacker's attack behavior in the industrial control network training scenario, and a combination of simulated attack sequences in the industrial control network training scenario is used.

[0026] The present invention is further configured such that the quantification logic of the weakness parameters of the network nodes and the terminal devices is:

[0027] Quantify the severity of the vulnerability based on the CVSS standard to obtain the vulnerability severity score;

[0028] Quantify and score external threat intelligence based on the attack frequency and vulnerability utilization rate of external threats to obtain an external threat score;

[0029] Calculate the vulnerability parameters of network nodes and terminal devices based on vulnerability severity scores, external threat scores, and internal historical attack success rates.

[0030] The present invention is further configured to combine and simulate attack sequences in industrial control network training scenarios, and the generation logic includes:

[0031] Obtain attack action sets and vulnerability parameters of network nodes and terminal devices;

[0032] Calculate the attack effect on the node through the association function according to the attack action set and vulnerability parameters;

[0033] Calculate the transfer cost of attacking slave nodes based on the state transfer function;

[0034] An attack sequence is generated based on the attack effect on the node and the transfer cost of the node transfer.

[0035] The present invention is further configured that the attack action set is represented by: A = {a1, a2, ...a N}, where A is a set of attack actions, a Nis the quantitative representation of the Nth attack action, and the quantitative index is the intensity of the attack action;

[0036] The calculation logic of the attack effect is: in, is the correlation function, a i is the attack action of the ith node, v i is the weakness parameter of the i-th node, ρ is the sensitivity coefficient, λ is the adjustment coefficient, which is used to control the influence of the node weakness parameter on the attack effect, and σ(·) is the Sigmoid function, which is used to smooth the influence of the weakness parameter on the attack effect;

[0037] The calculation logic of transfer cost is: Among them, Ω(c i-1 , c i ) is the state transfer function, d(c i-1 , c i ) is the transfer distance from the i-1th node to the i-th node, γ is the distance influence factor, which is used to adjust the degree of inhibition of distance on transfer success, R trans (c i-1 , c i ) is the difference in health scores from the i-1th node to the i-th node, ξ is the health sensitivity coefficient, which is used to control the impact of health status on the transfer process;

[0038] The attack sequence generation logic is: Among them, S attack For the attack sequence.

[0039] The present invention is further configured that step S6 comprises:

[0040] The threat path health status score is calculated based on the threat path in the generated attack sequence according to the preset threat path health propagation formula;

[0041] Calculating a threat path vulnerability score according to the threat path health status score and a preset path vulnerability calculation formula;

[0042] Arrange the threat paths in descending order according to the threat path vulnerability scores, and generate a network threat path and path vulnerability report.

[0043] The present invention is further configured as follows: a preset threat path health propagation formula: Among them, H path Score the threat path health status, W(H i , v i ) is the health weight function, and the calculation logic is: H iis the health score of the node, α is the adjustment coefficient, which is used to control the impact of the health score on the health weight, Φ(H i , H i+1 ) is the health state propagation function, and the calculation logic is: Φ(H i , H i+1 )=tanh(β·(H i -H i+1 )), β is the difference amplification coefficient, which is used to control the amplification or suppression of the health status difference between nodes;

[0044] The preset path weakness calculation formula is: Among them, L path is the threat path vulnerability score, M is the number of nodes in the path, Γ(H path，j , V j ) is the interactive function between health status and node weakness, and the calculation logic is: H path，j is the health status score of the jth node in the path, δ is the adjustment coefficient, which is used to control the influence of weakness on health status, κ is the adjustment parameter, which is used to control the contribution of node health status to path weakness, η is the adjustment parameter, which controls the contribution of node weakness to path weakness, and θ is the adjustment factor, which is used to balance the comprehensive influence of health status and weakness on path weakness.

[0045] The present invention provides a method for discovering dynamic threat paths and vulnerabilities of industrial control networks. The method constructs an industrial control network training scenario, wherein the industrial control network training scenario includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer, wherein each layer is connected through a router or a switch, and the network assets of each layer are connected through a switch; a network topology structure is automatically discovered and generated through network asset topology discovery; a full flow monitoring audit is performed on all network nodes in the network topology structure of the industrial control network training scenario, and the flow audit results are stored in association according to a time series; and all network nodes in the network topology structure of the industrial control network training scenario are automatically discovered and generated through a network asset topology discovery; and a full flow monitoring audit is performed on all network nodes in the network topology structure of the industrial control network training scenario, and the flow audit results are stored in association according to a time series; and a full flow monitoring audit is performed on all network nodes in the network topology structure of the industrial control network training scenario. The network nodes and terminal devices are subjected to network asset identification health monitoring to generate health status monitoring results; all network nodes and terminal devices in the network topology structure under the industrial control network training scenario are subjected to self-vulnerability analysis and threat mining, and a network threat and vulnerability attack set model is formed in combination with information network threat path technology. The attack sequence under the industrial control network training scenario is simulated according to the network threat and vulnerability attack set model; the threat path and path weakness under the industrial control network training scenario are detected by combining and simulating the attack sequence under the industrial control network training scenario, and a network threat path and path weakness report is generated. The beneficial effects produced include:

[0046] 1. Improve the accuracy of threat detection: This invention achieves a high degree of simulation of the real operating environment of the industrial control network by constructing an industrial control network training scenario including the information management layer, industrial monitoring layer, industrial control layer and field equipment layer. Combined with full-flow monitoring audit, network asset identification and health status monitoring, the real-time status of all network nodes and terminal devices in the industrial control network can be dynamically discovered, thereby improving the accuracy of threat path detection;

[0047] 2. Comprehensively evaluate the security status of the system: This invention evaluates the health status of network nodes and terminal devices through self-supervision reconstruction, generates health scores, and quantifies the vulnerability parameters of nodes by combining the severity of node vulnerabilities, external threat intelligence, and historical attack records. This method can comprehensively reflect the health status and potential vulnerabilities of nodes, provides a scientific basis for risk assessment, and effectively makes up for the inadequacy of traditional protection measures in dynamic threat assessment capabilities;

[0048] 3. Accurately identify threat paths and path weaknesses: This invention builds a threat intelligence fusion model and a multi-level attack simulation environment based on it, which can realistically simulate the attacker's attack behavior in the industrial control network. By calculating the correlation between attack actions and node weaknesses and the state transfer cost of the attack path, an attack sequence with high authenticity and complexity is generated, and then the threat path and path weakness are accurately identified, providing a reliable basis for the security protection strategy of the industrial control network;

[0049] 4. Improve the efficiency of protection decision-making: The present invention detects threat paths and vulnerabilities in industrial control networks by combining simulated attack sequences, and generates threat path and vulnerability reports. The report content can reflect the risk status and vulnerability distribution of each node in the current industrial control network in real time, providing real-time and dynamic decision-making support for security managers, significantly improving the response speed and accuracy of network protection strategies.

[0050] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0052] Figure 1The present invention is a flowchart of a method for discovering dynamic threat paths and vulnerabilities in an industrial control network, showing an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0054] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0055] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0056] A method for discovering dynamic threat paths and vulnerabilities in industrial control networks, such as Figure 1 As shown, including:

[0057] S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected through a router or a switch, and the network assets of each layer are connected through a switch.

[0058] S2: Automatically discover and generate network topology through network asset topology discovery;

[0059] S3: Perform full traffic monitoring and audit on all network nodes in the network topology structure of the industrial control network training scenario, and store the traffic audit results in a time series.

[0060] S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results;

[0061] S5: Perform vulnerability analysis and threat mining on all network nodes and terminal devices in the network topology structure under the industrial control network training scenario, combine information network threat path technology to form a network threat and vulnerability attack set model, and simulate the attack sequence under the industrial control network training scenario based on the network threat and vulnerability attack set model combination;

[0062] S6: Detect threat paths and path weaknesses in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate network threat paths and path weakness reports.

[0063] Specifically, the industrial control network training scenario is a virtual environment that simulates an industrial control system (ICS), which aims to replicate the hierarchical structure and communication mode of an actual industrial control network. The scenario consists of an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected through a network device (such as a router or a switch), and the network assets of each layer are also internally connected through a switch. The present invention is further configured such that the information management layer includes monitoring equipment, a management server, and a database server, which are used to obtain industrial control field data through monitoring equipment; the industrial monitoring layer includes an engineer station and an operator station, which are used to monitor the industrial control process; the industrial control layer includes a programmable logic controller device and a distributed control system device, which are used to directly control the operating status and data interaction of field equipment; the field device layer includes production equipment and sensors, which are used to execute control commands and collect data in the production process.

[0064] Specifically, in step S2, when the network asset supports topology discovery, the topology is automatically discovered and generated through the network asset topology discovery. In the case where topology discovery is not supported, the topology is also generated by manually inputting asset relationships. The topology is generated using the relationship triple knowledge graph.

[0065] The present invention is further configured that step S3 comprises:

[0066] Traffic collection equipment and probe nodes are deployed in the network topology structure to capture the communication data of the network nodes in real time and record the attribute parameters of the communication data packets, wherein the attribute parameters include the sequence number, length, timestamp, source address and destination address; specifically, traffic collection equipment and probe nodes are deployed at key positions of the network topology structure to capture the communication data between nodes in the network in real time, and to obtain detailed data packet information without interrupting the normal operation of the network; the captured data packet attribute parameters include key information such as the sequence number, length, timestamp, source address and destination address, which can fully reflect the transmission path, time, source and destination of the data packet, and provide a complete perspective on the data flow; sequence number: identifies the order of the data packet in the communication sequence, and is used to analyze the transmission order and integrity of the data packet; length: the size of the data packet, which is used to determine the data flow and bandwidth occupancy; timestamp: records the time point when the data packet is captured, and is used to reconstruct the communication link and timing analysis; source address and destination address: identifies the sending and receiving devices of the data packet, and helps determine the source and end point of the data flow;

[0067] The communication data packets are reconstructed in the order of timestamps to form a communication association link sorted in time series; specifically, the captured data packets are reconstructed in the order of timestamps to form a complete communication association link, which can rearrange scattered data packets and restore the original communication order to help identify possible abnormal connections or unauthorized data flows;

[0068] The communication data packets and the communication-related links are audited in real time to generate traffic audit results, which are stored in association with the communication data packets in time series; specifically, the reconstructed data packets and communication-related links are audited in real time, and the audit content includes data packet legitimacy check, traffic analysis, abnormal behavior detection, etc. The generated traffic audit results are stored in association with the original communication data packets in time series to form a detailed traffic audit database.

[0069] Specifically, in step S4, the present invention obtains network asset status parameters of network nodes and terminal devices, sets these parameters as feature matrices, and further maps these matrices into graph structures to monitor health status and detect anomalies. The process includes constructing a health status monitoring graph, self-supervised reconstruction, calculating anomaly degrees and health scores, aiming to accurately identify the health status and potential anomalies of each node and device in the network. The present invention is further configured such that step S4 includes:

[0070] Obtain the network asset status parameters of all network nodes and terminal devices, and set the network asset status parameters as a feature matrix; specifically, collect the network asset status parameters of all network nodes and terminal devices, including key indicators such as CPU utilization, memory usage, network traffic characteristics, and error rate, which reflect the operating status of nodes and devices; integrate the collected status parameters into a feature matrix, where each row or column represents a multi-dimensional state parameter combination of a node or device. The feature matrix is ​​the basic data for subsequent graph structure construction and health assessment.

[0071] The network nodes, terminal devices and corresponding feature matrices are mapped as graph nodes, and the communication relationships between network nodes and terminal devices are mapped as graph edges to construct a health status monitoring graph structure. Specifically, each network node, terminal device and its feature matrix are mapped as a node in the graph, so that each graph node not only represents a device or node, but also contains its corresponding status information. The communication relationship between network nodes and terminal devices is mapped as a graph edge, and the weight of the edge can represent the frequency, bandwidth, delay and other network characteristics of the communication. This graph structure construction makes health monitoring not limited to a single node, but also takes into account the interaction relationship between nodes.

[0072] The feature matrix is ​​encoded and decoded through self-supervised reconstruction to obtain a reconstructed feature matrix and a deviation measure; the constructed feature matrix is ​​reconstructed through self-supervision, that is, by encoding and decoding the feature matrix, a reconstructed feature matrix similar to the original feature matrix is ​​reconstructed. The self-supervised nature of the reconstruction process does not rely on external labels or supervisory signals, and is only trained through the data itself; the difference between the reconstructed feature matrix and the original feature matrix is ​​used to calculate the deviation measure, which reflects the gap between the actual operating state of the node or device and the ideal state, and is an important basis for anomaly detection.

[0073] The degree of abnormality is calculated according to the reconstructed feature matrix and the deviation measure, and the health score of the node is calculated according to the abnormality of the node to generate a health status monitoring result. Specifically, self-supervised reconstruction measures the degree of deviation of health features by encoding and decoding features. The greater the deviation, the higher the degree of abnormality. The abnormality measurement function calculates the relative deviation of the node, and calculates the abnormality of each node or device according to the deviation measure. The abnormality indicates the degree to which the behavior or state of the node deviates from normal operation. This is a prior art and will not be described in detail here. The abnormality is further converted into a health score. The health score reflects the overall operating status of the node or device. The higher the score, the healthier the node, and vice versa. The health score ultimately forms a health status monitoring result to help identify potential security issues. Furthermore, the calculation logic of the health score is: S i is the health score of the ith node, w is the impact of the control anomaly on the score, Ab i is the abnormality degree of the ith node, Indicates that the jth node is the neighbor node of the i-th node, β ij The impact factor for neighbor scoring reflects the impact of neighbor nodes on the health of the current node.

[0074] In step S5, by performing vulnerability scanning and risk labeling on network nodes and terminal devices in the industrial control network training scenario, combining external threat intelligence and internal historical attack records, a threat intelligence fusion model is constructed, and the attacker's multi-level attack behavior is simulated based on the model. This step aims to comprehensively evaluate the potential risks in the industrial control network, identify weaknesses and simulate real attack scenarios, and provide data support for improving network security protection; the present invention is further configured that step S5 includes:

[0075] Perform vulnerability scans and risk annotations on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario; Perform comprehensive vulnerability scans on all network nodes and terminal devices in the industrial control network topology structure to identify security vulnerabilities in devices and nodes, such as unpatched vulnerabilities, configuration errors, weak passwords, etc. Perform risk annotations on identified vulnerabilities, which include assessing the severity of the vulnerability, the scope of impact, and the exploitability of the vulnerability, to form a comprehensive risk view.

[0076] Based on the identified vulnerabilities, a threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records. The threat intelligence fusion model is used to define the vulnerability parameters of network nodes and terminal devices. The external threat intelligence and internal historical attack records are combined. The external threat intelligence includes the current popular attack methods, attack frequency, known vulnerability exploits, etc. The internal historical attack records include the previous attack events and their patterns suffered by the industrial control network. The external and internal intelligence are comprehensively analyzed through the fusion model to define the vulnerability parameters of each network node and terminal device. The vulnerability parameters reflect the vulnerability of the node in the current threat scenario.

[0077] According to the threat intelligence fusion model, a multi-level attack simulation environment is constructed to simulate the attacker's attack behavior in the industrial control network training scenario, and the attack sequence in the industrial control network training scenario is combined and simulated. Specifically, according to the threat intelligence fusion model, a multi-level attack simulation environment is constructed. This environment can simulate the multi-step attack process of the attacker from the external network to the internal network, including initial access, lateral movement, privilege escalation, data theft and other attack steps; the simulation environment dynamically generates multiple attack scenarios according to different attack paths and attack methods, and generates corresponding attack strategies for nodes with different vulnerability parameters to ensure the authenticity and diversity of the attack simulation. In the attack simulation environment, according to the vulnerability parameters generated by the threat intelligence fusion model, the attack sequence is combined and simulated. Each attack sequence consists of multiple attack actions, simulating the potential behavior of the attacker in the industrial control network. The simulated attack sequence reflects the attacker's possible intrusion path, the exploited vulnerabilities, the attack methods and their impact on nodes and devices.

[0078] Specifically, by quantifying the vulnerability parameters of network nodes and terminal devices, the scientificity and accuracy of vulnerability assessment are improved. The specific quantification logic includes three main steps: comprehensive analysis and calculation of vulnerability severity scores, external threat scores, and internal historical attack success rates, and finally obtaining the vulnerability parameters of nodes and devices; the present invention is further configured such that the quantification logic of the vulnerability parameters of network nodes and terminal devices is:

[0079] The severity of the vulnerability is quantified based on the CVSS standard to obtain the vulnerability severity score; specifically, CVSS (Common Vulnerability Scoring System) is an internationally accepted vulnerability assessment standard used to quantify the severity of vulnerabilities. The CVSS score takes into account multiple dimensions such as the exploitability of the vulnerability, the scope of impact, the complexity of the attack, and the user interaction requirements, and reflects the potential threat level of the vulnerability to the system through a comprehensive score.

[0080] The external threat intelligence is quantitatively scored based on the attack frequency and vulnerability utilization rate of external threats to obtain the external threat score; the external threat intelligence is analyzed and scored to specifically evaluate the attack frequency and vulnerability utilization rate of external threats. The attack frequency indicates the frequency of the threat occurring in the current network, and the vulnerability utilization rate reflects the actual degree of exploitation of the vulnerability by the attacker;

[0081] The vulnerability parameters of network nodes and terminal devices are calculated based on the vulnerability severity score, external threat score, and internal historical attack success rate. The vulnerability parameters of network nodes and terminal devices are calculated by combining the vulnerability severity score, external threat score, and internal historical attack success rate. The internal historical attack success rate refers to the success rate of similar nodes or devices in the network when they were attacked in the past, reflecting the historical vulnerability of the node; combining these scores, the vulnerability parameter reflects the vulnerability of the node in the current threat environment in a quantitative form; the vulnerability parameter is calculated by weighted summation of the vulnerability severity score, external threat score, and internal historical attack success rate. The larger the vulnerability parameter, the weaker the node.

[0082] The present invention is further configured to combine and simulate attack sequences in industrial control network training scenarios, and the generation logic includes:

[0083] Obtain the attack action set and vulnerability parameters of the network node and the terminal device; the present invention is further configured that the attack action set is represented by: A = {a1, a2, ...a N}, where A is a set of attack actions, a N is the quantitative representation of the Nth attack action, and the quantitative index is the intensity of the attack action;

[0084] The attack effect on the node is calculated through the association function according to the attack action set and the vulnerability parameter; the calculation logic of the attack effect is: in, is the correlation function, a i is the attack action of the ith node, v i is the weakness parameter of the i-th node, ρ is the sensitivity coefficient, λ is the adjustment coefficient, which is used to control the influence of the node weakness parameter on the attack effect, σ(·) is the Sigmoid function, which is used to smooth the influence of the weakness parameter on the attack effect; specifically, the above calculation logic aims to quantify the attack effect on the node, and calculates the actual effect of the attack action on a specific node by combining the attack action set and the node weakness parameter; the sensitivity coefficient ρ ranges from 0.1 to 10, which is used to adjust the influence of weakness on the attack effect. The higher the value, the greater the influence of weakness on the attack effect. λ is the adjustment coefficient ranges from 0.1 to 5, which is used to control the weight of weakness in the attack effect. The larger the λ, the higher the proportion of weakness.

[0085] The transfer cost of attacking the slave node is calculated based on the state transfer function; the calculation logic of the transfer cost is: Among them, Ω(c i-1 , c i ) is the state transfer function, d(c i-1 , c i) is the transfer distance from the i-1th node to the i-th node, γ is the distance influence factor, which is used to adjust the degree of inhibition of distance on transfer success, R trans (c i-1 , c i ) is the difference in health scores from the i-1th node to the i-th node, ξ is the health sensitivity coefficient, which is used to control the impact of the health status on the transfer process; the above calculation logic calculates the transfer cost of the attack when it transfers between nodes through the state transfer function. The transfer cost reflects the actual movement difficulty and cost of the attacker in the industrial control network, taking into account factors such as the physical distance between nodes and the difference in health status. The distance influence factor γ ranges from 0.1 to 10. The higher the value, the more significant the impact of distance on the transfer cost; the health sensitivity coefficient ξ ranges from 0.1 to 5; by comprehensively considering the distance and health status differences, the present invention can accurately quantify the difficulty of attack transfer between nodes, so that the simulated attack path is more in line with the real attack scenario.

[0086] The attack sequence is generated according to the attack effect on the node and the transfer cost of the node transfer; the generation logic of the attack sequence is: Among them, S attack is the attack sequence; specifically, the calculation logic is used to generate the attack sequence, and a complete attack path sequence is constructed by combining the attack effect on the node and the transfer cost between nodes. The formula represents the process in which the attacker performs a series of attack actions in the industrial control network and moves between nodes, comprehensively considering the impact of the attack behavior on the node and the feasibility of the attack path.

[0087] The present invention is further configured that step S6 comprises:

[0088] The threat path health status score is calculated according to the preset threat path health propagation formula based on the threat path in the generated attack sequence; the present invention is further configured as follows: Among them, H path Score the threat path health status, W(H i , v i ) is the health weight function, and the calculation logic is: H i is the health score of the node, α is the adjustment coefficient, which is used to control the impact of the health score on the health weight, Φ(H i , H i+1 ) is the health state propagation function, and the calculation logic is: Φ(H i , H i+1 )=tanh(β·(H i -H i+1)), β is the difference magnification coefficient, which is used to control the amplification or suppression of the difference in health status between nodes; specifically, the above calculation logic is used to evaluate the health status of the threat path, and the overall health status score of the threat path is calculated according to the health scores of each node in the generated attack sequence and their differences. By considering the health weight of each node and the health status transfer function between nodes, the overall health status of each node in the path can be comprehensively evaluated, thereby identifying the weak links in the threat path; the adjustment coefficient α is usually in the range of 0.1 to 10, which is used to adjust the impact of the health score on the weight, and a larger value increases the influence of the health score; the difference magnification coefficient β ranges from 0.1 to 5, which is used to control the impact of the difference in health status between nodes, and a larger value enhances the transfer effect of the difference on the health status. By combining the health weight and the state transfer function, the present invention can comprehensively evaluate the health status in the threat path and accurately identify the weak nodes in the path.

[0089] The threat path vulnerability score is calculated according to the threat path health status score according to the preset path vulnerability calculation formula; the preset path vulnerability calculation formula is: Among them, L path is the threat path vulnerability score, M is the number of nodes in the path, Γ(H path，j , V j ) is the interactive function between health status and node weakness, and the calculation logic is: H path，j is the health status score of the jth node in the path, δ is the adjustment coefficient, which is used to control the influence of weakness on health status, κ is the adjustment parameter, which is used to control the contribution of node health status to path weakness, η is the adjustment parameter, which controls the contribution of node weakness to path weakness, and θ is the adjustment factor, which is used to balance the comprehensive influence of health status and weakness on path weakness; Specifically, the above calculation logic aims to evaluate the overall weakness of the threat path. By combining the health status score of each node in the path and the interactive influence of node weakness, the path weakness score is calculated, which comprehensively considers the health status and weakness parameters. The complex relationship between them is used to determine the contribution of each node in the threat path to the overall vulnerability; the adjustment coefficient δ ranges from 0.1 to 5, which is used to adjust the degree of influence of the vulnerability on the health state, and a higher value will enhance the influence of the vulnerability on the health state; the adjustment parameters κ and η range from 0.1 to 10, which control the influence of the health state and vulnerability on the path vulnerability score; the adjustment factor θ ranges from 0.1 to 3, which is used to balance the comprehensive influence of the health state and vulnerability on the path vulnerability. Through the comprehensive application of the interaction function and the adjustment coefficient, the present invention can accurately quantify the path vulnerability and help identify the key weak nodes in the path.

[0090] The threat paths are sorted in descending order according to the threat path vulnerability score to generate a network threat path and path vulnerability report. Specifically, by sorting by vulnerability score, managers can quickly identify the weakest and most in-need-to-protect paths in the network, optimize resource allocation, and improve overall protection efficiency.

[0091] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0092] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0093] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0094] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0095] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0096] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0097] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0098] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0099] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0101] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks, characterized in that: include: S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected through a router or a switch, and the network assets of each layer are connected through a switch. S2: Automatically discover and generate network topology through network asset topology discovery; S3: Perform full traffic monitoring and audit on all network nodes in the network topology structure of the industrial control network training scenario, and store the traffic audit results in a time series. S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results; S5: Perform vulnerability analysis and threat mining on all network nodes and terminal devices in the network topology structure under the industrial control network training scenario, combine information network threat path technology to form a network threat and vulnerability attack set model, and simulate the attack sequence under the industrial control network training scenario based on the network threat and vulnerability attack set model combination; S6: Detect threat paths and path weaknesses in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate network threat paths and path weakness reports.

2. According to claim 1, a method for discovering dynamic threat paths and vulnerabilities of industrial control networks is characterized in that: The information management layer includes monitoring equipment, management servers and database servers, which are used to obtain industrial control field data through monitoring equipment; the industrial monitoring layer includes engineer stations and operator stations, which are used to monitor industrial control processes; the industrial control layer includes programmable logic controller devices and distributed control system devices, which are used to directly control the operating status and data interaction of field equipment; the field equipment layer includes production equipment and sensors, which are used to execute control commands and collect data in the production process.

3. According to claim 1, a method for discovering dynamic threat paths and vulnerabilities of industrial control networks is characterized in that: Step S3 includes: Deploy traffic collection equipment and probe nodes in the network topology structure, capture the communication data of the network nodes in real time, and record the attribute parameters of the communication data packets, wherein the attribute parameters include sequence number, length, timestamp, source address and destination address; Reconstructing the communication data packets in the order of timestamps to form communication association links sorted in time series; The communication data packets and the communication associated links are audited in real time to generate flow audit results, which are stored in association with the communication data packets in time series.

4. According to claim 1, a method for discovering dynamic threat paths and vulnerabilities of industrial control networks is characterized in that: Step S4 includes: Obtaining network asset status parameters of all network nodes and terminal devices, and setting the network asset status parameters as a feature matrix; The network nodes, terminal devices and corresponding feature matrices are mapped into graph nodes, and the communication relationships between network nodes and terminal devices are mapped into graph edges to construct a health status monitoring graph structure. The feature matrix is ​​encoded and decoded through self-supervised reconstruction to obtain the reconstructed feature matrix and deviation measure; The abnormality is calculated according to the reconstructed feature matrix and the deviation measure, the health score of the node is calculated according to the abnormality of the node, and a health status monitoring result is generated.

5. The method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 1, characterized in that: Step S5 includes: Perform vulnerability scans and risk annotations on all network nodes and terminal devices in the network topology structure in the industrial control network training scenario; Based on the identified vulnerabilities, a threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records, wherein the threat intelligence fusion model is used to define the vulnerability parameters of network nodes and terminal devices; A multi-level attack simulation environment is constructed based on the threat intelligence fusion model to simulate the attacker's attack behavior in the industrial control network training scenario, and a combination of simulated attack sequences in the industrial control network training scenario is used.

6. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 5, characterized in that: The quantitative logic of the vulnerability parameters of network nodes and terminal devices is: Quantify the severity of the vulnerability based on the CVSS standard to obtain the vulnerability severity score; Quantify and score external threat intelligence based on the attack frequency and vulnerability utilization rate of external threats to obtain an external threat score; Calculate the vulnerability parameters of network nodes and terminal devices based on vulnerability severity scores, external threat scores, and internal historical attack success rates.

7. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 6, characterized in that: Combined simulated attack sequence in industrial control network training scenario, the generation logic includes: Obtain attack action sets and vulnerability parameters of network nodes and terminal devices; Calculate the attack effect on the node through the association function according to the attack action set and vulnerability parameters; Calculate the transfer cost of attacking slave nodes based on the state transfer function; An attack sequence is generated based on the attack effect on the node and the transfer cost of the node transfer.

8. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 7, characterized in that: The attack action set is expressed as: A = {a1, a2, ...a N }, where A is a set of attack actions, a N is the quantitative representation of the Nth attack action, and the quantitative index is the intensity of the attack action; The calculation logic of the attack effect is: in, is the correlation function, a i is the attack action of the ith node, v i is the weakness parameter of the i-th node, ρ is the sensitivity coefficient, λ is the adjustment coefficient, which is used to control the influence of the node weakness parameter on the attack effect, and σ(·) is the Sigmoid function, which is used to smooth the influence of the weakness parameter on the attack effect; The calculation logic of transfer cost is: Among them, Ω(c i-1 , c i ) is the state transfer function, d(c i-1 , c i ) is the transfer distance from the i-1th node to the i-th node, γ is the distance influence factor, which is used to adjust the degree of inhibition of distance on transfer success, R trans (c i-1 , c i ) is the difference in health scores from the i-1th node to the i-th node, ξ is the health sensitivity coefficient, which is used to control the impact of health status on the transfer process; The attack sequence generation logic is: Among them, S attack For the attack sequence.

9. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 8, characterized in that: Step S6 includes: The threat path health status score is calculated based on the threat path in the generated attack sequence according to the preset threat path health propagation formula; Calculating a threat path vulnerability score according to the threat path health status score and a preset path vulnerability calculation formula; Arrange the threat paths in descending order according to the threat path vulnerability scores, and generate a network threat path and path vulnerability report.

10. A method for discovering dynamic threat paths and vulnerabilities of industrial control networks according to claim 9, characterized in that: Preset threat path health communication formula: Among them, H path Score the threat path health status, W(H i , v i ) is the health weight function, and the calculation logic is: H i is the health score of the node, α is the adjustment coefficient, which is used to control the impact of the health score on the health weight, Φ(H i , H i+1 ) is the health state propagation function, and the calculation logic is: Φ(H i , H i+1 )=tanh(β·(H i -H i+1 )), β is the difference amplification coefficient, which is used to control the amplification or suppression of the health status difference between nodes; The preset path weakness calculation formula is: Among them, L path is the threat path vulnerability score, M is the number of nodes in the path, Γ(H path，j , V j ) is the interactive function between health status and node weakness, and the calculation logic is: H path，j is the health status score of the jth node in the path, δ is the adjustment coefficient, which is used to control the influence of weakness on health status, κ is the adjustment parameter, which is used to control the contribution of node health status to path weakness, η is the adjustment parameter, which controls the contribution of node weakness to path weakness, and θ is the adjustment factor, which is used to balance the comprehensive influence of health status and weakness on path weakness.

Images