Counter measure strategy construction method and system based on attack intelligence

Abstract

The invention belongs to the technical field of network security, and discloses a countering measure strategy construction method and system based on attack intelligence. According to the method, firstly, multi-source attack intelligence is fused, and a causal time sequence attack knowledge graph is constructed; then, mapping the atlas on a digital twinborn model based on the IEC 62443 standard, constructing a Bayesian attack graph, and quantifying the risk of each attack path; then, taking the risk, the cost and the operation influence as multiple targets, and adopting an NSGA-II algorithm to generate a Pareto optimal countering strategy set; further, an optimal robust strategy is selected from the strategy set by solving the Stackelberg safety game model; and finally, explaining the decision process by using an interpretable AI technology. According to the method, the problems of passive threat intelligence analysis, static risk assessment, sub-optimal strategy selection and opaque decision-making process in the prior art are solved, and active, quantitative, optimal and credible defense decision-making for the key infrastructure is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method and system for constructing a dynamic, optimal countermeasure strategy based on attack intelligence, applied to an industrial control system (ICS) environment, particularly a power system network. Background Art

[0002] With the deep integration of industrialization and informatization, critical infrastructure, particularly power systems, is increasingly reliant on complex industrial control systems (ICS) for monitoring and management. However, this increased interconnectedness also exposes them to increasingly severe and complex cybersecurity threats. Current ICS cybersecurity defense systems face several technical bottlenecks in combating complex attacks such as advanced persistent threats (APTs), resulting in ineffective defenses.

[0003] First, existing threat intelligence processing methods are mostly passive and fragmented. Security systems typically obtain threat information by subscribing to intelligence feeds in formats such as STIX / TAXII, or by having security analysts manually read and analyze unstructured threat reports such as PDF documents and technical blogs. The intelligence obtained in this way is often isolated, discrete indicators of compromise (IoCs), lacking a deep understanding of the underlying logic, causal relationships, and temporal evolution of attack activity. Analysts must expend considerable effort manually piecing together attack chains, resulting in delayed responses and difficulty predicting the attacker's next move, leaving defenders constantly playing catch-up. Secondly, risk assessment methods are static and divorced from actual operational scenarios. Currently, risk assessments in the ICS sector mostly employ qualitative or quantitative methods based on static models. These methods struggle to accurately simulate the dynamic characteristics of cyber-physical systems (CPSs) and are unable to effectively assess the real-world risks of complex, multi-stage, multi-path attack scenarios. In critical infrastructure, such as power systems, the criticality of assets is not static but rather changes dynamically based on their role in the grid's real-time operational state. Existing methods fail to fully account for the complex dependencies between IT and OT assets and struggle to accurately quantify the actual business impact of cyberattacks, such as production downtime and security risks. This results in significant deviations from actual risk assessment results and fails to provide an effective basis for the precise allocation of security resources. Third, the countermeasure selection mechanism is simplistic and suboptimal. In practice, defenders often select countermeasures based on simple heuristics, such as prioritizing vulnerabilities with the highest Common Vulnerability Scoring System (CVSS) scores, or based on a single objective, such as minimizing cost. This decision-making approach ignores the complex trade-offs between different objectives. For example, a measure with a high security benefit may be costly or severely impact normal system operations, such as requiring extended downtime for deployment. More importantly, this simple strategy fails to consider the attacker's intelligent response. A rational attacker, upon discovering that their original attack path has been blocked, will proactively seek out the next weakest link to launch an attack, resulting in diminishing marginal returns on defensive investment and failing to achieve an overall optimal defensive posture. Finally, advanced AI decision-making systems lack transparency and trustworthiness. While academics have proposed using AI and machine learning models to address these issues, these models typically operate in a "black box" mode, making their decision-making processes opaque to human operators. In high-risk, safety-critical environments like power systems, operators cannot fully delegate control to an automated system without understanding the underlying decision-making process. This lack of trust is a major obstacle to the practical application of advanced AI technologies in critical infrastructure security. Even if the system can generate a theoretically optimal solution, implementation is difficult due to a lack of understanding and trust. In summary, existing technologies have significant shortcomings in the deep utilization of threat intelligence, dynamic risk quantification, global optimization of strategies, and the credibility of decision-making. These interrelated shortcomings form a chain of difficulties that hinder the improvement of ICS security defense capabilities. Therefore, a new technical solution is urgently needed to comprehensively address these issues and achieve intelligent, optimized, and trustworthy full-process intelligence from intelligence to decision-making. Summary of the Invention

[0004] In response to the shortcomings of the above-mentioned technologies, the present invention aims to provide a method and system for constructing countermeasure strategies based on attack intelligence, so as to overcome the problems of passive threat intelligence analysis, static risk assessment, suboptimal strategy selection and opaque decision-making process in the existing technologies, and realize active, quantitative, optimal and reliable defense decisions for critical infrastructure.

[0005] In order to achieve the above technical effects, the present invention adopts the following technical solutions: A method for constructing a countermeasure strategy based on attack intelligence, including the following steps: Step 1: Intelligence fusion and knowledge graph construction: obtain network security attack intelligence including structured and unstructured sources, and build a causal temporal attack knowledge graph CT-KG.

[0006] Step 2: Risk quantification simulation. On a cyber-physical digital twin model, the constructed CT-KG is mapped to generate a Bayesian attack graph BAG, and simulation is performed to quantitatively calculate the risk value of potential attack paths.

[0007] Step 3: Generate a multi-objective optimization strategy. Define the risk value, countermeasure cost, and operational impact as a multi-objective optimization problem, solve it using a multi-objective evolutionary algorithm, and generate a Pareto optimal countermeasure strategy set.

[0008] Step 4: Game decision-making and strategy selection, construct the Stackelberg security game model, and select the optimal countermeasure strategy from the Pareto optimal set.

[0009] Step 5: Explainable decision support uses explainable artificial intelligence (XAI) technology to analyze the generation logic of the optimal strategy and provide transparent and reliable decision support to operation and maintenance personnel.

[0010] As a further embodiment of the present invention, the causal temporal attack knowledge graph CT-KG includes attack entities, relationships between entities, causal relationships, and temporal relationships.

[0011] As a further embodiment of the present invention, the cyber-physical digital twin model is constructed according to the IEC 62443 standard and integrates a dynamic asset criticality assessment unit.

[0012] As a further embodiment of the present invention, the multi-objective evolutionary algorithm is a non-dominated sorting genetic algorithm NSGA-II, and the Pareto optimal set consists of a series of non-dominated solutions.

[0013] As a further embodiment of the present invention, the Stackelberg security game model takes the defender as the leader and the attacker as the follower. By solving the game model, a strategy that can bring the greatest utility to the defender while considering the rational response of the attacker is selected from the Pareto optimal set.

[0014] As a further embodiment of the present invention, the explainable artificial intelligence XAI technology uses SHAP or LIME to generate visual charts and natural language explanations to explain the reasons, expected effects and cost-effectiveness of the recommended strategy.

[0015] The present invention also provides a system for implementing the above method, which includes: an intelligence fusion module, a risk simulation module, a strategy optimization module, a game decision module and a decision support module. These modules work together to complete the entire process from intelligence analysis to strategy output.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention achieves proactive and predictive intelligence analysis capabilities. By constructing a causal temporal attack knowledge graph, this invention goes beyond the event-correlation layer of traditional intelligence analysis and deeply explores the causal logic and temporal evolution patterns behind attack activities. This enables the system to not only understand attacks that have already occurred, but also predict the attacker's likely behavior and next attack targets in specific scenarios, thereby shifting the defense posture from passive response to proactive prediction and preemptive deployment.

[0017] 2. This invention combines a digital twin model built based on the IEC 62443 standard with a Bayesian attack graph powered by CT-KG to achieve high-fidelity simulation of cyber-physical system risks. Through dynamic asset criticality assessment and probabilistic calculations based on real intelligence data, the system accurately quantifies the potential damage of each attack path using financial metrics such as Annual Loss Expected (ALE), providing a solid data foundation for the optimal allocation of security resources.

[0018] 3. This invention uniquely utilizes a hybrid optimization decision engine. The NSGA-II algorithm first selects the most efficient set of strategies—the Pareto frontier—from a vast pool of possibilities, based on cost, risk, and impact, ensuring efficient resource utilization. Subsequently, the Stackelberg security game model further selects from this efficient set the strategies that are most effective against countermeasures from intelligent attackers. This dual optimization mechanism for efficiency and robustness ensures that the resulting defense strategy is both cost-effective and combat-resistant.

[0019] 4. This invention introduces an Explainable Artificial Intelligence (XAI) module, fundamentally resolving the "black box" problem of advanced AI systems in critical safety scenarios. The system not only provides instructions on what to do, but also provides clear explanations of why. This transparency significantly enhances operators' trust in the automated system, shortens decision-making time, and ensures that humans retain ultimate authority in the decision-making loop, enabling the safe and effective adoption and application of advanced technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive work, among which: Figure 1 A schematic diagram of a system architecture for constructing a countermeasure strategy based on attack intelligence according to the present invention; Figure 2 A schematic diagram of the process of constructing the causal temporal attack knowledge graph in the present invention; Figure 3 A schematic diagram of a Bayesian attack graph risk simulation process based on digital twinning in the present application; Figure 4 A flowchart of a hybrid optimization decision-making process based on NSGA-II and Stackelberg game in the present application; Figure 5 A schematic diagram of an explainable artificial intelligence decision support interface in the present application. DETAILED DESCRIPTION

[0021] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings, it should be understood that the embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0022] As shown in Figure 1 , the present application provides a countermeasure strategy construction system based on attack intelligence. The system is deployed on a high-performance server cluster at the hardware level, the server is equipped with a high-performance computing unit GPU for accelerating artificial intelligence model training and reasoning, a large-capacity high-speed memory VRAM for storing large-scale knowledge graph and digital twinning model, and a solid-state storage device SSD for quickly reading and writing threat intelligence and simulation data. The system is connected with the security information and event management SIEM system, threat intelligence platform and other data sources within the enterprise through a high-speed Ethernet interface.

[0023] The system logically includes the following modules: intelligence fusion module 101, risk simulation module 102, strategy optimization module 103, game decision-making module 104, decision support module 105, and a central data repository 106. The central data repository 106 is used to uniformly manage the causal time series attack knowledge graph, network physical digital twinning model, countermeasure library, and historical decision-making data, and provides data support for all other modules.

[0024] Step 1, intelligence fusion and knowledge graph construction, as shown in Figure 2 , this step is performed by the intelligence fusion module 101, and the goal is to build a dynamic, rich causal time series attack knowledge graph CT-KG 200.

[0025] First, multi-source intelligence acquisition 201 is performed. The system automatically subscribes and pulls structured threat intelligence from multiple internal and external threat intelligence sources, such as industry ISACs, through the built-in TAXII client. These intelligence usually follows the STIX standard, containing information about known attack indicators, malware, threat actors, etc. At the same time, the system obtains unstructured threat intelligence from security vendor reports, technical blogs, security forums, etc. sources, such as PDF and HTML documents, through web crawlers and API interfaces. Secondly, knowledge extraction based on a large language model is performed 202. For unstructured intelligence, the system uses a framework based on multi-agent and dual memory mechanism to process it. The specific process is as follows: Text segmentation, which divides long intelligence documents into several text segments that can be processed by large language models.

[0026] Triple extraction, deploys multiple worker agents, each of which independently extracts knowledge triples representing entities and their relations from a text segment, such as <malwareA, usage, vulnerabilityB>.

[0027] Triple integration,deploys an integrator agent, which is responsible for reviewing the extraction results of multiple worker agents on the same text segment,,merging triplets with the same semantics but different expressions, and outputting a most representative result.

[0028] Knowledge refinement involves deploying a refiner agent to standardize and resolve entities from the aggregated triples. For example, different names like "APT28," "FancyBear," and "SofacyGroup" are resolved and linked to a single, unique threat actor entity ID. The extracted triples are stored in a long-term memory, the initial knowledge graph.

[0029] Next, knowledge fusion and mapping are performed 203. The system parses the structured intelligence and incorporates its entities and relationships into the knowledge graph. A key step in this process is mapping the extracted attack techniques, tactics, and procedures (TTPs) with publicly available knowledge bases, particularly the MITRE ATT&CK® for ICS framework. For example, if intelligence describes an attacker modifying a function code in the DNP3 protocol, the system maps this to the technique T0858, "Unauthorized Command Message," in ATT&CK for ICS. This mapping provides a standardized semantic foundation for subsequent attack graph construction. Finally, causal and temporal relationships are enhanced 204. This is the core innovative step in building CT-KG, which transforms the static knowledge graph into a dynamic model with predictive capabilities.

[0030] For time series analysis, the system uses natural language processing technology to extract explicit timestamps or relative time descriptions from intelligence text, assigning time attributes to attack events in the knowledge graph, thereby constructing a timeline of attack activities. Each attack behavior is modeled as an event entity in the graph. Causal inference: The system uses event-centric modeling to run causal discovery algorithms, such as the PC algorithm or Granger causality test, based on time series data of a large number of events, to infer the causal relationship between events in a probabilistic form. For example, the system may infer that the exploitation of a specific vulnerability is the reason for deploying a specific backdoor, and calculate a causal strength probability. .

[0031] After the above steps, the causal temporal attack knowledge graph 205 is finally formed, which not only includes "who, what, and what is used", but also includes in-depth information on "when it happened" and "why it happened", providing high-quality input for subsequent risk simulation.

[0032] Step 2, risk quantification simulation, such as Figure 3 As shown, this step is performed by the risk simulation module 102 and aims to convert abstract threat intelligence into quantifiable risk values.

[0033] First, a cyber-physical digital twin is constructed. 301 The system maintains a cyber-physical digital twin model that is highly synchronized with the actual power system's operational (OT) network. This model includes not only network devices and control equipment, along with their configuration information, but also dynamic models of the physical processes they control, such as generators, transformers, and circuit breakers. The digital twin's architectural design adheres to the IEC 62443 series of standards, dividing the entire system into logically isolated security domains and controlled communication channels, or pipelines. This provides a clear structure for subsequently defining attack boundaries and assessing the scope of impact. In particular, a dynamic asset criticality assessment unit 302 is integrated into the digital twin model. This unit dynamically calculates the importance of each asset to the safe and stable operation of the entire system at the current moment based on the real-time power flow data, load conditions and operation mode of the power grid, and assigns a dynamic asset value to it. For example, during peak demand periods, a main transformer supplying electricity to a critical urban area may will be significantly higher than its low point at night. . Next, a Bayesian attack graph (BAG) 303 is constructed and calculated. The system projects attack knowledge from CT-KG 205 onto the digital twin model 301, identifying potential attack paths. A Bayesian attack graph is constructed, where each node represents a system state, such as a firewall rule being bypassed or malware being implanted in the human-machine interface. Directed edges represent transitions between states, i.e., a successful attack step. The innovation of the present invention lies in the calculation method of the conditional probability table in BAG. The probability of a state transition , not just relying on exploited vulnerabilities Instead of static properties like scores, it integrates dynamic intelligence from CT-KG through a function: Causal strength of the attack step in the attack graph, Frequency of the attack step in recent intelligence. This method combines static vulnerabilities with dynamic, real threat trends, greatly improving the accuracy of attack probability prediction.

[0034] The risk simulation module 102 calculates all possible paths from the initial attack node to each critical impact node and their end-to-end success probability by performing calculations on the BAG through standard probabilistic reasoning algorithms such as variable elimination. Finally, risk quantification 304 is performed. For each attack path leading to a high-impact consequence with a non-negligible probability, the system calculates its annual expected loss ALE as its risk value. Calculate the single loss expectation SLE, SLE = AV x EF. Where AV is the dynamic asset value of the target asset, provided by the dynamic asset criticality assessment unit 302; EF, the exposure factor, is a pre-set percentage representing the degree of value loss after the asset is damaged.

[0035] Calculate the annual occurrence rate ARO, ARO is the annual success probability of this attack path obtained by BAG simulation multiplied by the annual activity frequency of threat actors initiating this type of attack analyzed in CT-KG.

[0036] Calculate the annual expected loss .

[0037] Finally, the risk simulation module 102 outputs a list containing all potential attack paths and their corresponding quantified risk values ALE, providing accurate input for subsequent optimization decisions.

[0038] Steps 3 and 4, mixed optimization decision and strategy selection, as shown in Figure 4 These two steps are completed by the mixed optimization decision engine composed of the strategy optimization module 103 and the game decision module 104. The goal is to select an optimal strategy combination from a large pool of countermeasures.

[0039] First, define the multi-objective optimization problem 401. The selection of countermeasure strategies is modeled as a multi-objective optimization problem MOP. A strategy S is a set of one or more atomic countermeasures, such as patching device A, adding rule D to firewall C, and implementing application whitelisting for human-machine interface HMIE. The objective functions to be optimized simultaneously include: Minimize the risk (S). After deploying strategy S, the sum of the remaining total risk (ALE) of all attack paths in the system is minimized. This value is obtained by rerunning the BAG simulation on the digital twin with strategy S applied.

[0040] Minimize Cost (S). The total cost of deploying strategy S is minimized, including hardware, software, manpower, and outsourcing services.

[0041] Minimize Impact (S): Deployment strategy S has the least negative impact on the normal operation of the system. This impact is measured by indicators such as equivalent downtime hours.

[0042] These three objectives are often in conflict with each other; for example, the strategy with the lowest risk often has the highest cost and the greatest impact. Next, the NSGA-II algorithm is used to generate the Pareto optimal set 402. The strategy optimization module 103 uses the non-dominated sorting genetic algorithm NSGA-II to solve the above MOP. NSGA-II is an efficient evolutionary algorithm, and its workflow is as follows: Initialization: randomly generate an initial population containing N different countermeasures .

[0043] Evaluation: For each strategy individual in the population, the risk simulation module 102 calculates the corresponding three objective function values ​​of risk, cost and impact.

[0044] Non-dominated sorting, based on the Pareto dominance relationship, stratifies the entire population. Strategies that are not dominated by any other strategy constitute the first layer of Pareto frontiers. , only The strategies dominated by the middle strategy constitute the second layer , and so on. Crowding calculation: Within each level, the crowding distance of each strategy individual is calculated. This distance reflects the sparsity of the area surrounding the individual. A larger distance indicates that the individual is in a sparse area, which helps maintain solution diversity. Selection, crossover and mutation, using a binary tournament selection method based on rank and crowding distance, from the parent population Select individuals to perform crossover and mutation operations to generate offspring populations .

[0045] Elite retention and new population generation, merging parent generations and offspring Form a temporary population of size 2N .right Perform non-dominated sorting and fill the best individuals into the next generation population layer by layer In, until The size of the set reaches N. If the last layer cannot be completely put in, then according to the crowded distance from large to small, the optimal one is selected.

[0046] Iterate, repeat steps 2-6 until the preset number of iterations or the solution set converges.

[0047] After the algorithm ends, the first layer non-dominated solution set is the Pareto optimal set 403. Each strategy in this set is effective, that is, it cannot optimize any objective without sacrificing other objectives.

[0048] Then, the final decision 404 is made through the Stackelberg security game. The Pareto optimal set may contain dozens or even hundreds of solutions, which brings the selection paradox to human decision makers. To solve this problem, the game decision module 104 introduces the Stackelberg security game model. The model is set as a leader-follower model. The defender, i.e. the power grid, is the leader, which first commits and deploys a defense strategy. The attacker is the follower, who will detect the defense strategy of the defender and then choose the attack path that is most beneficial to itself to attack. In the game process, the system will simulate each strategy in the Pareto optimal set 403 as a possible action of the defender. For each , the system will simulate the optimal response of the attacker, i.e. after the strategy is deployed, recalculate the benefits of all attack paths, and choose the path with the highest benefit to attack.

[0049] Utility calculation and equilibrium solution, the final utility of the defender after deploying the strategy depends on the system state after the optimal response of the attacker. The system calculates the corresponding defender utility of each , and selects the strategy that can make the defender obtain the highest utility as the final output. This solution is called the strong Stackelberg equilibrium, which represents the most beneficial and robust strategy for the defender after considering the countermeasures of the rational attacker. To verify the superiority of the mixed optimization method of the application, a comparative experiment was conducted, and the results are shown in Table 1. In the table, the strategy robustness is measured by the maximum benefit that the attacker can still obtain after the deployment of the defense strategy. The smaller the value, the more robust the strategy.

[0050] Table 1: Comparison table of countermeasure optimization performance As can be seen from Table 1, the strategy of simply pursuing the lowest cost results in poor risk reduction effect, and the attacker still has a high potential return. The strategy of simply pursuing the lowest risk, although effective, has a huge cost and impact on operation, and is not feasible. The artificial expert strategy performs mediocrely. The hybrid optimization strategy of the present application achieves the best balance in all four dimensions, with reasonable cost and acceptable operational impact, achieving high-level risk reduction and strong strategy robustness, proving its significant technical advantages.

[0051] Step 5, explainable decision support, as shown, this step is performed by the decision support module 105, aiming to present the complex AI decision-making process in a human understandable way, and to establish the trust of the operator. Figure 5 When the optimal countermeasure strategy is selected, the system does not simply output an execution instruction. The decision support module 105 will call explainable artificial intelligence XAI technology, such as SHAP or LIME, to analyze the decision result. The system will generate a comprehensive decision support interface 500 and present it to the operation and maintenance personnel. The interface includes: Optimal strategy recommendation 501, which clearly lists the specific content of the final recommended strategy , such as: "apply rule set X on the firewall in region 5, and apply white list hardening to HMI-3".

[0052] Key decision factor analysis 502, which displays the contribution of each atomic measure in the strategy to the overall risk reduction through visualization such as bar charts or pie charts. For example, the chart will show that "rule set X" contributes 70% of the risk reduction, and "HMI hardening" contributes 30%. This is obtained by calculating the SHAP value of each measure. Expected effect quantification display 503, which displays the expected effect after deploying the strategy with intuitive numbers and charts, such as "the annual expected loss ALE will be reduced from 12 million yuan to 0.9 million yuan, with a risk reduction rate of 92.5%".

[0053] Pareto frontier visualization 504, which displays the entire Pareto optimal set in a three-dimensional scatter plot, with the three coordinate axes being cost, risk, and operational impact. Users can intuitively see the trade-off relationship between different strategies. The finally selected strategy will be highlighted on the graph.

[0054] ​In natural language interpretation 505, the system automatically generates a natural language text summarizing the decision logic. For example, "We recommend deploying Strategy A. This strategy reduces the expected annual loss from 12 million yuan to 900,000 yuan. The primary contribution comes from Rule Set X, which blocks the most probable lateral movement attack path associated with the 'APT-G' group. While Alternative Strategy B reduces the risk even further, it costs 1.5 million yuan more and requires 8 hours of planned downtime. Based on Stackelberg game analysis, Strategy A provides the highest overall security benefit, considering that attackers may switch to suboptimal attack paths." In this way, the present invention transforms a complex, multi-dimensional optimization decision-making process into a transparent, intuitive, and reliable human-computer interaction process, greatly improving the usability and effectiveness of the technology in actual production environments.

[0055] Although specific embodiments of the present invention have been described above, those skilled in the art will appreciate that these specific embodiments are merely illustrative, and that those skilled in the art may omit, substitute, and modify the details of the methods and systems described above without departing from the principles and spirit of the present invention. For example, combining the above method steps to perform substantially the same functions in substantially the same manner to achieve substantially the same results falls within the scope of the present invention. Accordingly, the scope of the present invention is limited solely by the appended claims.

Claims

1. A method for constructing a countermeasure strategy based on attack intelligence, characterized in that: The following steps are involved: Step 1: Intelligence fusion and knowledge graph construction: obtain structured and unstructured network security attack intelligence, and construct a causal temporal attack knowledge graph based on the attack intelligence. The causal temporal attack knowledge graph includes attack entities, relationships between entities, causal relationships, and temporal relationships. Step 2: Risk quantification simulation. Based on the cyber-physical digital twin model of the industrial control system, the causal temporal attack knowledge graph is mapped to the digital twin model, a Bayesian attack graph is constructed, and attack path risk simulation is performed to quantify the risk value of each attack path. Step 3: Generate a multi-objective optimization strategy, taking the risk value, the cost of countermeasures, and the impact of the countermeasures on system operation as a multi-objective optimization function, and using a multi-objective evolutionary algorithm to generate a set of non-dominated optimal countermeasure strategies to form a Pareto optimal set; Step 4: Game decision-making and strategy selection: Using the Pareto optimal set as the defender's strategy set, construct and solve a Stackelberg security game model with the defender as the leader and the attacker as the follower, and select and output the optimal countermeasure strategy from the Pareto optimal set; Step 5: Explainable decision support: Based on explainable artificial intelligence technology, the basis for generating the optimal countermeasure strategy is analyzed, and decision support information is presented to the user terminal.

2. The method for constructing a countermeasure strategy based on attack intelligence according to claim 1, characterized in that: In step 1, the specific method for constructing a causal temporal attack knowledge graph is to segment the unstructured threat intelligence, deploy multiple large-scale language model agents to extract security entity relationship triples, and integrate them with the attack entities and relationships parsed from the structured threat intelligence. Then, based on the event-centric modeling idea, temporal analysis and causal inference are performed to add temporal attributes and causal strength probabilities to the relationships between entities.

3. The method for constructing a countermeasure strategy based on attack intelligence according to claim 2, characterized in that: In step 2, the cyber-physical digital twin model is architecturally designed based on the IEC 62443 standard, divides the industrial control system into multiple security domains and pipelines, and includes a dynamic asset criticality assessment module for dynamically updating the asset value of each asset in the model based on real-time operating data.

4. The method for constructing a countermeasure strategy based on attack intelligence according to claim 3, characterized in that: In step 2, when constructing the Bayesian attack graph, the prior probability of the nodes in the graph is determined by the vulnerability data of the nodes, and the causal strength and temporal frequency of the corresponding attack mode in the causal temporal attack knowledge graph; the risk value of the attack path is the annual expected loss ALE, which is determined by the product of the single loss expectation SLE and the annual occurrence rate ARO.

5. The method for constructing a countermeasure strategy based on attack intelligence according to claim 1, characterized in that: In step 3, the multi-objective evolutionary algorithm is a non-dominated sorting genetic algorithm NSGA-II, which screens the strategy population through non-dominated sorting and crowding distance calculation, and generates a child population through selection, crossover and mutation operations, and finally obtains the Pareto optimal set.

6. The method for constructing a countermeasure strategy based on attack intelligence according to claim 1, characterized in that: In steps 4 and 5, the utility function of the defender in the Stackelberg security game model is the weighted sum of the multi-objective optimization function, and the model is solved to obtain a strong Stackelberg equilibrium solution as the optimal counter-strategy; and an explainable artificial intelligence technology such as SHAP or LIME is used to generate a feature importance score for the optimal counter-strategy, which is presented to the user in the form of a visual chart and natural language text.

7. A countermeasure strategy construction system based on attack intelligence, characterized in that: include: An intelligence fusion module, used to obtain network security attack intelligence and construct a causal temporal attack knowledge graph based on the attack intelligence; A risk simulation module is used to map the causal temporal attack knowledge graph to the cyber-physical digital twin model of the industrial control system, construct a Bayesian attack graph, perform attack path risk simulation, and quantify the risk value of each attack path; a strategy optimization module, configured to use the risk value, the cost of the countermeasures, and the impact of the countermeasures on the system operation as a multi-objective optimization function, and adopt a multi-objective evolutionary algorithm to generate a set of non-dominated optimal countermeasure strategies to form a Pareto optimal set; a game decision module, configured to use the Pareto optimal set as the defense strategy set, construct and solve the Stackelberg security game model, and select and output the optimal countermeasure strategy from the Pareto optimal set; The decision support module is used to analyze the basis for generating the optimal countermeasure strategy based on explainable artificial intelligence technology and present decision support information to the user terminal.

8. The system for constructing a countermeasure strategy based on attack intelligence according to claim 7, characterized in that: The intelligence fusion module includes a large language model agent cluster and a dual-memory knowledge repository for extracting entity relationship triples from unstructured threat intelligence; the risk simulation module includes a cyber-physical digital twin model that follows the IEC 62443 standard for security domain and pipeline division and has a built-in dynamic asset criticality assessment unit.

9. The system for constructing a countermeasure strategy based on attack intelligence according to claim 7, characterized in that: The strategy optimization module and the game decision module constitute a hybrid optimization decision engine, wherein the strategy optimization module uses the non-dominated sorting genetic algorithm NSGA-II to generate the Pareto optimal set, and the game decision module uses the Stackelberg security game model to make the optimal selection from the Pareto optimal set; the system also includes a central data repository for storing various types of data and interacting with each module.

Images