Industrial control system network vulnerability scanning preprocessing method and system

Abstract

The invention belongs to the technical field of industrial control network vulnerability scanning, and relates to an industrial control system network vulnerability scanning preprocessing method and system. Determining a system scanning boundary according to the network configuration information and the real-time flow data of the industrial control system, and obtaining a survival IP address list, an open port list and a scanning tolerance degree based on the system scanning boundary; obtaining a scanning task workload and scanning load intensity based on the survival IP address list, the open port list and the scanning tolerance degree, and generating a scanning task based on the scanning task workload and the scanning load intensity; and carrying out network vulnerability scanning according to the scanning task and obtaining an unverified vulnerability list, obtaining a vulnerability set according to the unverified vulnerability list and the threat score, and verifying the vulnerability set by utilizing POC. Invalid scanning and over-scanning can be avoided, the scanning range can be narrowed according to the characteristics of the industrial control system, and a reasonable scanning load is generated, so that the scanning time is effectively shortened. The false alarm rate of vulnerability detection can be reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control network vulnerability scanning, and relates to an industrial control system network vulnerability scanning preprocessing method and system. BACKGROUND

[0002] Industrial control systems are widely used in production and manufacturing industries such as energy, transportation, and water conservancy. In recent years, they have gradually become the focus of hacker attacks. To reduce the network security risks of production enterprises and improve the security protection capabilities of industrial control systems, network security detection is needed, and automatic scanning tools are often used for vulnerability scanning. However, industrial control systems need to run stably for a long time, and to avoid affecting production, vulnerability scanning is generally performed during production maintenance.

[0003] Existing vulnerability scanning tools do not accurately estimate the scanning range based on the specific situation of industrial control systems during actual use, and there is a situation of brute force scanning. Therefore, it leads to invalid scanning, increases the resource consumption of the industrial control system itself, does not consider the tolerance of the industrial control system, increases the scanning time, and greatly reduces the scanning efficiency.

[0004] At the same time, vulnerability scanning uses asset fingerprint comparison to retrieve the existing vulnerability list from the database, which may have false positives and unreliable results. To verify that the vulnerability really exists, the scanning tool provides a POC (Proof of Concept) for vulnerability verification, but abnormal situations such as system crashes may occur during the verification process, which may affect production. Therefore, the scanning process itself has certain risks, and many risks in the scanning process cannot be timely informed to production enterprises, causing uncontrollable losses to production. SUMMARY

[0005] The purpose of the present application is to provide an industrial control system network vulnerability scanning preprocessing method and system to solve the technical problems of inaccurate scanning range estimation by vulnerability scanning tools, unreliable scanning results, and high risk in the verification process.

[0006] In order to achieve the above-mentioned purpose, the technical scheme is adopted as follows: In a first aspect, the present application provides an industrial control system network vulnerability scanning preprocessing method, comprising the following steps: determining the system scanning boundary according to the network configuration information and real-time traffic data of the industrial control system, obtaining the list of live IP addresses, the list of open ports, and the scanning tolerance degree based on the system scanning boundary; obtaining the scanning task workload and scanning load intensity based on the list of live IP addresses, the list of open ports, and the scanning tolerance degree, and generating a scanning task based on the scanning task workload and scanning load intensity; According to the scanning task, network vulnerability scanning is performed and an unverified vulnerability list is obtained, and a vulnerability set is obtained according to the unverified vulnerability list and a threat score, and the vulnerability set is verified by using a POC.

[0007] Further, the network configuration information of the industrial control system includes an IP address, a username, and a password table of the industrial control system.

[0008] Further, the living IP address list, the open port list, and the scanning tolerance degree are obtained based on the system scanning boundary, including: Based on the system scanning boundary, network reachability testing is performed on the network nodes of the industrial control system to generate a living IP address list. Based on the living IP address list, port opening testing is performed on each living IP address list to generate an open port list. Based on the living IP address list, the CPU usage, the memory usage, and the video memory usage of the network nodes are obtained, and the scanning tolerance degree corresponding to the industrial control system is obtained according to the CPU usage, the memory usage, and the video memory usage of the network nodes.

[0009] Further, the scanning tolerance degree corresponding to the industrial control system is obtained according to the CPU usage, the memory usage, and the video memory usage of the network nodes, including: According to the CPU usage, the memory usage, and the video memory usage of each network node, the hardware performance score of a single device is obtained in combination with the weight of a single resource. According to the hardware performance score of a single device, the hardware performance score of the overall industrial control system is obtained. According to the hardware performance score of the overall industrial control system, the scanning tolerance degree corresponding to the industrial control system is obtained.

[0010] Further, the scanning task workload and the scanning load intensity are obtained based on the living IP address list, the open port list, and the scanning tolerance degree, and the scanning task is generated based on the scanning task workload and the scanning load intensity, including: The IP scanning range is determined according to the living IP address list. The port scanning range is determined according to the open port list. The configuration scanning list is generated based on the username and password table. The current scanning task workload is estimated based on historical scanning traffic data. In combination with the scanning tolerance degree and the scanning task workload, the scanning load intensity is determined. The scanning intensity parameter is set. The scanning task is generated according to the IP scanning range, the port scanning range, the configuration scanning list, and the scanning intensity parameter.

[0011] Furthermore, the IP scanning range, the port scanning range, and the configuration scanning list are obtained by integrating static configuration information and real-time traffic information during the acquisition process; The scan load intensity is obtained by integrating static configuration information and real-time traffic information.

[0012] Furthermore, the estimation of the current scanning task workload based on historical scan traffic data includes: The workload of the scanning task is calculated and summarized from three levels: remote scanning, configuration scanning, and weak password guessing.

[0013] Furthermore, the configuration scan list is a list of systems and programs configured for risk scanning; The set scan intensity parameters include: setting the scan duration and the number of concurrent processes.

[0014] Furthermore, the process of performing network vulnerability scanning based on the scanning task and obtaining a list of unverified vulnerabilities, obtaining a vulnerability set based on the list of unverified vulnerabilities and threat scores, and verifying the vulnerability set using a Proof-of-Concept (POC) includes: The vulnerabilities in the unverified vulnerability list are sorted from highest to lowest threat score; Vulnerabilities with threat scores higher than a threshold value are filtered out, and a vulnerability set is generated. Based on historical verification statistics, obtain the verification risk value of each vulnerability in a vulnerability set; From the first set of vulnerabilities, vulnerabilities whose verification risk values ​​are lower than the verification risk threshold are filtered out to generate a second set of vulnerabilities; For a single vulnerability in the set of secondary vulnerabilities, a Proof-of-Concept (POC) is used for verification.

[0015] Secondly, the present invention provides a network vulnerability scanning preprocessing system for industrial control systems, comprising: The information collection module is used to determine the system scanning boundary based on the network configuration information and real-time traffic data of the industrial control system, and to obtain the list of live IP addresses, the list of open ports, and the scanning tolerance based on the system scanning boundary; The task generation module is used to obtain the scanning task workload and scanning load intensity based on the list of live IP addresses, the list of open ports and the scanning tolerance level, and to generate scanning tasks based on the scanning task workload and scanning load intensity. The risk interaction module is used to perform network vulnerability scanning based on scanning tasks and obtain a list of unverified vulnerabilities. Based on the list of unverified vulnerabilities and threat scores, a vulnerability set is obtained, and the vulnerability set is verified using a Proof of Concept (POC).

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention determines the system scan boundary based on the network configuration information and real-time traffic data of the industrial control system (ICS), enabling more precise definition of the scan range, avoiding brute-force scanning, and reducing the consumption of ICS resources by invalid scans. Based on the system scan boundary, a list of live IP addresses, a list of open ports, and scan tolerance are obtained. The list of live IP addresses and open ports clarifies the specific scan targets, while the scan tolerance considers the ICS's own capacity, providing basic data for generating reasonable scan tasks. The scan task workload and scan load intensity are obtained based on the live IP address list, open port list, and scan tolerance, making the calculation of scan task workload and load intensity more closely reflect the actual situation of the ICS. Generating scan tasks based on scan task workload and scan load intensity allows for setting appropriate scan parameters by considering factors such as the ICS's equipment performance, improving scan efficiency. A vulnerability set is obtained based on the list of unverified vulnerabilities and threat scores, facilitating targeted verification later. The vulnerability set is verified using Proof-of-Concept (POC). This verifies critical vulnerabilities while avoiding downtime, system crashes, or other abnormal situations that could impact production during the verification process, reducing the risk of the scanning process. This invention avoids invalid and excessive scanning by accurately determining scan boundaries and rationally calculating scan workload and load intensity. It can narrow the scan range according to the characteristics of the industrial control system, generating a reasonable scan load and thus effectively shortening the scan time. This invention verifies vulnerabilities by screening vulnerabilities based on threat scores and calculating risk values ​​using verification statistics. This changes the previous reliance on asset fingerprint comparison, which could lead to false positives, and reduces the false positive rate of vulnerability detection. During the scanning process, the tolerance of the industrial control system and the potential risks of vulnerability verification are fully considered.

[0017] This invention's system includes an information collection module, a task generation module, and a risk interaction module. The information collection module determines the system scanning boundary based on the industrial control system's network configuration information and real-time traffic data, and obtains a list of live IP addresses, a list of open ports, and scan tolerance levels based on these boundaries. The task generation module obtains the scanning task workload and scan load intensity based on the live IP address list, open port list, and scan tolerance levels, and generates scanning tasks based on these workloads and load intensity. The risk interaction module performs network vulnerability scanning based on the scanning tasks and obtains a list of unverified vulnerabilities. It then obtains a vulnerability set based on the unverified vulnerability list and threat scores, and verifies the vulnerability set using Proof-of-Concept (POC). These modules work together to avoid invalid and excessive scanning, narrow the scanning scope according to the characteristics of the industrial control system, generate a reasonable scanning load, and effectively shorten the scanning time. This also reduces the false positive rate of vulnerability detection. Attached Figure Description

[0018] Figure 1 This is a flowchart of a method according to an embodiment of the present invention; Figure 2 This is a system block diagram of an embodiment of the present invention; Figure 3 This is a system module connection diagram according to another embodiment of the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first," "second," etc., in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1: See Figure 1 This embodiment discloses a preprocessing method for scanning network vulnerabilities in industrial control systems, including the following steps: S1 determines the system scan boundary based on the network configuration information and real-time traffic data of the industrial control system. This allows for a more precise definition of the scan range, avoiding brute-force scans and reducing the consumption of industrial control system resources by invalid scans. Based on the system scan boundary, a list of live IP addresses, a list of open ports, and scan tolerance are obtained. The list of live IP addresses and open ports clarifies the specific targets of the scan, while the scan tolerance considers the industrial control system's own capacity, providing basic data for generating reasonable scan tasks subsequently.

[0022] In this embodiment of the invention, the network configuration information of the industrial control system includes the IP address, username, and password table of the industrial control system.

[0023] In this embodiment of the invention, obtaining the list of live IP addresses, the list of open ports, and the scan tolerance level based on the system scan boundary includes: Based on the system scan boundary, network reachability tests are performed on the network nodes of the industrial control system to generate a list of live IP addresses; Based on the list of surviving IP addresses, perform port opening tests on each surviving IP address and generate a list of open ports; Based on the list of surviving IP addresses, the CPU utilization, memory utilization, and video memory utilization of network nodes are obtained, and the scan tolerance of the industrial control system is obtained according to the CPU utilization, memory utilization, and video memory utilization of the network nodes.

[0024] In this embodiment of the invention, obtaining the scan tolerance level of the industrial control system based on the CPU utilization, memory utilization, and video memory utilization of the network nodes includes: The hardware performance score of a single device is obtained by combining the CPU utilization, memory utilization, and video memory utilization of each network node with the weight of each individual resource. The overall hardware performance score of the industrial control system is obtained by calculating the hardware performance score of each individual device. The scan tolerance level of the industrial control system is obtained by calculating the overall hardware performance score of the industrial control system.

[0025] S2, based on the list of live IP addresses, the list of open ports, and the scan tolerance level, the workload and load intensity of the scanning task are obtained, making the calculation of the workload and load intensity of the scanning task more closely reflect the actual situation of the industrial control system. Generating scanning tasks based on the workload and load intensity allows for the setting of appropriate scanning parameters, taking into account factors such as the equipment performance of the industrial control system. This ensures that the scanning task will not affect the normal operation of the industrial control system due to excessive load, while effectively completing the vulnerability scanning work and improving scanning efficiency. Specifically: Determine the IP scanning range based on the list of live IP addresses; Determine the port scanning range based on the open port list; Generate a configuration scan list based on the username and password table; Estimate the workload of the current scanning task based on historical scan traffic data; The scanning load intensity is determined by combining the scanning tolerance level with the scanning task workload; Set the scan intensity parameters; A scanning task is generated based on the IP scanning range, port scanning range, configured scan list, and scan intensity parameters.

[0026] In this embodiment of the invention, the IP scanning range, the port scanning range, and the configuration scanning list are obtained by integrating static configuration information and real-time traffic information. The scan load intensity is obtained by integrating static configuration information and real-time traffic information.

[0027] In this embodiment of the invention, estimating the workload of the current scanning task based on historical scan traffic data includes: The workload of the scanning task is calculated and summarized from three levels: remote scanning, configuration scanning, and weak password guessing.

[0028] In this embodiment of the invention, the configuration scan list is a list of systems and programs configured for risk scanning; The set scan intensity parameters include: setting the scan duration and the number of concurrent processes.

[0029] S3 performs network vulnerability scanning based on the scanning task and obtains a list of unverified vulnerabilities. Based on the list of unverified vulnerabilities and threat scores, it obtains a vulnerability set, which helps in subsequent targeted verification. A Proof-of-Concept (POC) is used to verify the vulnerability set. This approach verifies critical vulnerabilities while avoiding disruptions to production caused by downtime or system crashes during the verification process, thus reducing the risk of the scanning process. Details are as follows: The vulnerabilities in the unverified vulnerability list are sorted from highest to lowest threat score; Vulnerabilities with threat scores higher than a threshold value are filtered out, and a vulnerability set is generated. Based on historical verification statistics, obtain the verification risk value of each vulnerability in a vulnerability set; From the first set of vulnerabilities, vulnerabilities whose verification risk values ​​are lower than the verification risk threshold are filtered out to generate a second set of vulnerabilities; For a single vulnerability in the set of secondary vulnerabilities, a Proof-of-Concept (POC) is used for verification.

[0030] This invention avoids invalid and excessive scanning by accurately determining scan boundaries and rationally calculating scan workload and load intensity. It can narrow the scan range according to the characteristics of the industrial control system, generating a reasonable scan load and thus effectively shortening the scan time. This invention verifies vulnerabilities by screening vulnerabilities based on threat scores and calculating risk values ​​using verification statistics. This changes the previous reliance on asset fingerprint comparison, which could lead to false positives, and reduces the false positive rate of vulnerability detection. During the scanning process, the tolerance of the industrial control system and the potential risks of vulnerability verification are fully considered.

[0031] See Figure 2 Based on the above method, the present invention also discloses a network vulnerability scanning preprocessing system for industrial control systems, comprising: The information collection module is used to determine the system scanning boundary based on the network configuration information and real-time traffic data of the industrial control system, and to obtain the list of live IP addresses, the list of open ports, and the scanning tolerance based on the system scanning boundary; The task generation module is used to obtain the scanning task workload and scanning load intensity based on the list of live IP addresses, the list of open ports and the scanning tolerance level, and to generate scanning tasks based on the scanning task workload and scanning load intensity. The risk interaction module is used to perform network vulnerability scanning based on scanning tasks and obtain a list of unverified vulnerabilities. Based on the list of unverified vulnerabilities and threat scores, a vulnerability set is obtained, and the vulnerability set is verified using a Proof of Concept (POC).

[0032] The various modules work together to avoid invalid and excessive scanning, and can narrow the scanning range according to the characteristics of the industrial control system, generating a reasonable scanning load, thereby effectively shortening the scanning time. This can reduce the false positive rate of vulnerability detection.

[0033] Example 2: See Figure 1 To address the challenges faced by manufacturing enterprises in network vulnerability scanning, this invention proposes a preprocessing method for industrial control system (ICS) network vulnerability scanning. Based on the characteristics of the ICS, this method accurately sets the parameters for vulnerability scanning tasks and determines the scope of vulnerability verification by combining the threat value of the vulnerability and the risk of vulnerability verification. This significantly improves vulnerability scanning efficiency while reducing the risks associated with scanning. The method includes the following steps: S1. Based on the IP address, username, and password table of the industrial control system, collect basic data of the industrial control system, perform network reachability tests on the network nodes of the industrial control system, perform port opening tests on each surviving IP address, determine the boundary of the industrial control system by combining the traffic of the industrial control system, obtain the list of surviving IP addresses and the list of open ports by parsing data packets, extract the CPU utilization, memory utilization, and video memory utilization of each network node, calculate the hardware performance score of a single device by combining the weight of a single resource, calculate the overall hardware performance score of the industrial control system by combining the weight of a single device, and determine the scan tolerance level of the industrial control system based on the overall hardware performance score of the industrial control system. S2, based on the collected information, precisely sets the relevant parameters of the scanning task workload, including IP address range and port range; determines the list of systems and programs to be configured for risk scanning based on the usernames and passwords obtained, and accurately narrows down the scanning scope of the scanning task; calculates the workload of the current vulnerability scan based on the traffic of historical scan tasks, determines the scanning load intensity in combination with the scanning tolerance of the industrial control system, sets the relevant parameters of the scanning intensity, including scanning time and the number of concurrent scanning processes, and generates the scanning task. S3. After the scan task is completed, a list of unverified vulnerabilities is obtained. The vulnerabilities in the unverified vulnerability list are sorted from high to low according to their threat scores. Vulnerabilities with threats exceeding the threshold are filtered to obtain a primary vulnerability set. Based on the vulnerability verification statistics, the probability of an anomaly occurring in the verification of a single vulnerability in the primary vulnerability set is calculated to obtain the verification risk value of a single vulnerability. The vulnerabilities in the primary vulnerability set are sorted from low to high according to their verification risk values. Vulnerabilities with threats below the threshold are filtered to obtain a secondary vulnerability set. For a single vulnerability in the secondary vulnerability set, a Proof-of-Concept (POC) is used for verification.

[0034] In this embodiment of the invention, the scanning range and scanning intensity are determined by combining static data information and dynamic traffic information from the industrial control system.

[0035] In this embodiment of the invention, the workload of the scanning task is calculated from three levels: remote scanning, configuration scanning, and weak password guessing.

[0036] See Figure 3 Based on the above method, the present invention also discloses a network vulnerability scanning preprocessing system for industrial control systems, comprising: Information collection module: Based on the data of the industrial control system, verify the network reachability and port openness, determine the boundaries and communication model of the industrial control system through traffic packet capture analysis, organize the IP range and port range, and calculate and determine the scanning tolerance of the industrial control system.

[0037] Task generation module: Set parameters related to scan task workload, including IP address, port list, and scan type such as remote scan, configuration scan, and weak password scan. Based on the host task workload and host performance, set the scan task intensity and generate scan tasks.

[0038] Risk interaction module: Calculates vulnerability verification risk, combines vulnerability threat score, and calls POC to verify the vulnerability.

[0039] This invention can combine static data and dynamic traffic information from industrial control systems to accurately narrow down the scanning scope, determine a reasonable scanning intensity based on the performance of the industrial control system, and determine the scope of vulnerability verification by combining the threat value of the vulnerability and the risk of vulnerability verification. This greatly improves the efficiency of vulnerability scanning while reducing the risks associated with the scanning itself.

[0040] Example 3: like Figure 1As shown, this embodiment discloses a preprocessing method for scanning network vulnerabilities in industrial control systems. Taking a power plant's DCS (Distributed Control System) system and a vulnerability scanning tool as an example, the method reduces the workload of the scanning task by collecting system information, determines the scanning intensity based on the performance of the DCS system, and determines the set of vulnerabilities to be verified using Proof-of-Concept (POC) based on the threat value and risk value of vulnerability verification. The vulnerability scanning and verification are completed according to the following steps: Step 1: Based on the IP address, username, and password table of the industrial control system, collect basic data of the industrial control system, perform network reachability tests on the network nodes of the industrial control system, perform port opening tests on each surviving IP address, determine the boundaries of the industrial control system by combining the traffic of the industrial control system, obtain the list of surviving IP addresses and the list of open ports by parsing the data packets, as shown in Table 1; extract the CPU, memory, and video memory of each network node, calculate the hardware performance score of individual devices by combining the weight of individual resources, calculate the overall hardware performance score of the industrial control system by combining the weight of individual devices, and determine the scan tolerance level of the industrial control system based on the overall hardware performance score of the industrial control system. Table 1. List of active IPs and open ports:

[0041] Step 2: Based on the collected information, accurately set the relevant parameters of the scanning task workload, including IP address range and port range. Based on the usernames and passwords you have, determine the list of systems and programs to be configured for risk scanning, and accurately narrow down the scanning scope of the scanning task. Calculate the workload of this vulnerability scan based on the traffic of historical scan tasks, determine the scanning load intensity in combination with the scanning tolerance of the industrial control system, set the relevant parameters of the scanning intensity, including scanning time and the number of concurrent scanning processes, and generate the scanning task. Step 3: After the scanning task is completed, a list of unverified vulnerabilities is obtained. The vulnerabilities in the list are sorted from highest to lowest threat score, as shown in Table 2. According to the vulnerability threat threshold, vulnerabilities with a threat score greater than the threshold of 2.0 are filtered to obtain a primary vulnerability set, which consists of vulnerabilities numbered 1-16 in Table 2. Based on the vulnerability verification statistics, the probability of an anomaly occurring in the verification of a single vulnerability in the primary vulnerability set is calculated to obtain the verification risk value of a single vulnerability, as shown in Table 3. The vulnerabilities in the primary vulnerability set are sorted from lowest to highest verification risk value. According to the vulnerability verification threshold, vulnerabilities with a threat score less than the threshold of 2.0 are filtered to obtain a secondary vulnerability set, as shown in Table 4. For a single vulnerability in the secondary vulnerability set, a Proof-of-Concept (POC) is used for verification.

[0042] Table 2. List of Vulnerability Threat Values:

[0043] Table 3. List of Vulnerability Verification Risk Values:

[0044] Table 4. Set of Secondary Vulnerabilities:

[0045] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of this invention.

Claims

1. An industrial control system network vulnerability scan preprocessing method, characterized in that, The method comprises the following steps: According to the network configuration information and real-time traffic data of the industrial control system, the system scanning boundary is determined, and the list of live IP addresses, the list of open ports and the scanning tolerance degree are obtained based on the system scanning boundary; Based on the list of live IP addresses, the list of open ports and the scanning tolerance degree, the scanning task workload and the scanning load intensity are obtained, and the scanning task is generated based on the scanning task workload and the scanning load intensity; According to the scanning task, network vulnerability scanning is performed and the unverified vulnerability list is obtained, and the vulnerability set is obtained according to the unverified vulnerability list and the threat score, and the vulnerability set is verified by using POC.

2. The method of claim 1, wherein the method further comprises: The network configuration information of the industrial control system includes the IP address, username and password table of the industrial control system.

3. The method of claim 1, wherein the method further comprises: The list of live IP addresses, the list of open ports and the scanning tolerance degree are obtained based on the system scanning boundary, which comprises: Based on the system scanning boundary, the network node of the industrial control system is tested for network accessibility, and the list of live IP addresses is generated; Based on the list of live IP addresses, the port opening test is performed on each live IP address list, and the list of open ports is generated; Based on the list of live IP addresses, the CPU usage, memory usage and video memory usage of the network node are obtained, and the scanning tolerance degree corresponding to the industrial control system is obtained according to the CPU usage, memory usage and video memory usage of the network node.

4. The method of claim 3, wherein the method further comprises: The scanning tolerance degree corresponding to the industrial control system is obtained according to the CPU usage, memory usage and video memory usage of the network node, which comprises: According to the CPU usage, memory usage and video memory usage of each network node, the hardware performance score of a single device is obtained by combining the weight of a single resource; According to the hardware performance score of a single device, the hardware performance score of the overall industrial control system is obtained; According to the hardware performance score of the overall industrial control system, the scanning tolerance degree corresponding to the industrial control system is obtained.

5. The method of claim 1, wherein the method further comprises: Based on the list of live IP addresses, the list of open ports and the scanning tolerance degree, the scanning task workload and the scanning load intensity are obtained, and the scanning task is generated based on the scanning task workload and the scanning load intensity, which comprises: According to the list of live IP addresses, the IP scanning range is determined; According to the list of open ports, the port scanning range is determined; Based on the username and password table, the configuration scanning list is generated; Based on the historical scanning traffic data, the current scanning task workload is estimated; Combined with the scanning tolerance degree and the scanning task workload, the scanning load intensity is determined; The scanning intensity parameter is set; According to the IP scanning range, the port scanning range, the configuration scanning list and the scanning intensity parameter, the scanning task is generated.

6. The method of claim 5, wherein the method further comprises: The IP scanning range, the port scanning range and the configuration scanning list are fused with static configuration information and real-time traffic information in the acquisition process; The scanning load intensity is fused with static configuration information and real-time traffic information in the acquisition process.

7. The method of claim 5, wherein the method further comprises: Based on the historical scanning traffic data, the current scanning task workload is estimated, which comprises: The scanning task workload is calculated and summarized from three aspects of remote scanning, configuration scanning and weak password guessing.

8. The method of claim 5, wherein the method further comprises: The configuration scanning list is the system and program list for configuration risk scanning; The setting scanning intensity parameter comprises setting scanning duration and concurrent process quantity.

9. The method of claim 1, wherein the method further comprises: The network vulnerability scanning according to the scanning task and obtaining the unverified vulnerability list, obtaining the vulnerability set according to the unverified vulnerability list and the threat score, and verifying the vulnerability set by using the POC, comprises: The vulnerabilities in the unverified vulnerability list are sorted according to the threat score from high to low; The vulnerabilities with the threat score higher than the threat score limit setting value are screened, and a primary vulnerability set is generated; Based on historical verification statistical data, the verification risk value of each vulnerability in the primary vulnerability set is obtained; In the primary vulnerability set, the vulnerabilities with the verification risk value lower than the verification risk limit setting value are screened, and a secondary vulnerability set is generated; For a single vulnerability in the secondary vulnerability set, the POC is used for verification.

10. An industrial control system network vulnerability scan pre-processing system, comprising: Comprise: The information collection module is used for determining system scanning boundary according to network configuration information and real-time traffic data of the industrial control system, obtaining a list of live IP addresses, a list of open ports and a scanning tolerance degree based on the system scanning boundary; The task generation module is used for obtaining scanning task workload and scanning load intensity based on the list of live IP addresses, the list of open ports and the scanning tolerance degree, and generating a scanning task based on the scanning task workload and the scanning load intensity; The risk interaction module is used for performing network vulnerability scanning according to the scanning task and obtaining an unverified vulnerability list, obtaining a vulnerability set according to the unverified vulnerability list and a threat score, and verifying the vulnerability set by using the POC.

Images