A method and system for evaluating the vulnerability threat level of power monitoring system equipment

Abstract

The present invention discloses a method and system for evaluating the vulnerability threat level of power monitoring system equipment, and belongs to the technical field of vulnerability assessment and analysis of power monitoring systems. The method of the present invention comprises: determining a network attack path for key equipment of the power monitoring system, extracting attack behaviors according to the network attack path, and determining the difficulty coefficient of the network attack behavior in combination with the attacker's skills and the configuration evaluation of the attack object; determining the success probability of the network attack under a specific attack cost according to the difficulty coefficient of the network attack behavior; and determining the vulnerability threat level of the key equipment of the power monitoring system subjected to the network attack according to the success probability and the difficulty coefficient of the network attack behavior. The present invention quantitatively evaluates the vulnerability threat level of the key equipment involved in the network attack path, and the evaluation results can provide a technical basis for determining the importance of network assets and the priority of equipment protection deployment.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability assessment and analysis of power monitoring systems, and more specifically, to a method and system for assessing the threat level of vulnerability of power monitoring system equipment. Background Art

[0002] In recent years, there have been frequent cases of cyber attacks on industrial control systems around the world. Cyber ​​attacks are characterized by strong concealment, large-scale destruction, and difficulty in determining responsibility. As various cyber attack methods and means become increasingly mature, the level of network security risk in industrial control systems is increasing.

[0003] As an important basic industry supporting economic and social development and ensuring basic people's livelihood, the power system accounts for an increasing proportion of electricity in modern society's terminal energy consumption. The dependence of various industries on electricity supply is deepening, and the impact of power outages on normal production and life is becoming more and more serious. Under the new situation of highly integrated development of energy and digital revolution, the interactive boundary between power grids and networks continues to expand and extend. Currently, there are more than 500 million smart terminals connected to the power grid. The risk of power grids being attacked by cyber attacks is gradually accumulating. Various forms of organized and premeditated cyber attacks have become a prominent security threat currently facing the power system. Plant monitoring systems, dispatching center monitoring systems, interactive control terminals, smart power equipment, etc. may become targets of cyber attacks, thereby disrupting the safe and stable operation of the primary power system.

[0004] In the computer field, vulnerability is usually used to describe the security level of distributed systems. The power monitoring system can be regarded as a typical distributed computer control system. Network attack behavior is the process of exploiting the vulnerability of the power monitoring system, and ultimately achieves the purpose of operating and controlling the power primary system equipment. At present, the relevant research on the vulnerability analysis of the power monitoring system is mainly reflected in the following three aspects:

[0005] (1) Qualitative evaluation methods based on engineering experience are usually used, lacking evaluation indicators that can be described quantitatively;

[0006] (2) When conducting vulnerability assessments, only the configuration of the system itself is considered, and the measurement factors are single;

[0007] (3) There is a lack of methods for comprehensive equipment vulnerability assessment based on the key equipment involved in each attack path. In addition, conventional vulnerability assessments pay little attention to attackers, which is usually reflected in the fact that the attacker's skill level is not taken into account. The relative concept of system vulnerability when facing specific attackers is ignored, and the rationality and accuracy requirements of vulnerability threat assessment cannot be met. Therefore, how to take into account the configuration of the attack target and the attacker's skill level to ensure the rationality of the vulnerability threat assessment of the power monitoring system is of great guiding significance for accurately grasping the importance of network assets of the power monitoring system and the priority of equipment protection deployment. Summary of the invention

[0008] In view of the above problems, the present invention provides a method for evaluating the vulnerability threat level of power monitoring system equipment, comprising:

[0009] For the key equipment of the power monitoring system, determine the network attack path, extract the attack behavior based on the network attack path, and determine the difficulty coefficient of the network attack behavior by combining the attacker's skills and the configuration evaluation of the attack target;

[0010] According to the difficulty coefficient of network attack behavior, determine the success probability of network attack under specific attack cost;

[0011] Based on the success probability and difficulty coefficient of the network attack behavior, determine the vulnerability threat level of key equipment in the power monitoring system to network attacks.

[0012] Optionally, determine the difficulty coefficient of the network attack behavior, including:

[0013] According to the network attack path, a hierarchical model for evaluating the difficulty of network attack behavior is constructed, wherein the hierarchical model includes: a target layer, a criterion layer, an indicator layer and a behavior layer;

[0014] Determine the mutual importance of different factors in the criterion layer and construct a judgment matrix of the criterion layer to the target layer;

[0015] Determine the mutual importance of different factors in the indicator layer and construct a judgment matrix of the indicator layer against the criterion layer;

[0016] Obtain the maximum eigenvalue and eigenvector of the judgment matrix, and perform consistency check on the judgment matrix;

[0017] If the consistency check passes, the weight vector of the index layer element for the target layer element is determined according to the maximum eigenvector;

[0018] Establish a decision matrix of behavior layer elements for indicator layer elements;

[0019] According to the decision matrix and the weight vector of the indicator layer elements to the target layer elements, a weighted standardized decision matrix is ​​established;

[0020] The difficulty coefficient of network attack behavior is determined through a weighted standardized decision matrix.

[0021] Optionally, a hierarchical model is used to establish a target layer by calculating the difficulty coefficient of network attack behavior as the target element; to establish a criterion layer by using the attacker's skills of the network attack behavior and important configuration items of the attack target as reference criterion elements; to establish an indicator layer by using the evaluation indicator elements for the attacker's skills and the configuration of the attack target; and to establish a behavior layer by using various behaviors of the network attack behavior as behavior elements.

[0022] Optionally, determining the success probability of a network attack includes: determining a success probability function of any network attack behavior based on a reliability calculation method and a difficulty coefficient of the network attack behavior, and determining the success probability of the network attack based on the success probability function.

[0023] Optionally, determine the degree of vulnerability threat of key equipment of the power monitoring system to cyber attacks, specifically: determine the key equipment of the power monitoring system involved in the cyber attack path, establish a correlation between the attack path and the key equipment of the power monitoring system involved in the cyber attack path based on the success probability and the difficulty coefficient of the cyber attack behavior, and determine the degree of vulnerability threat of key equipment of the power monitoring system to cyber attacks based on the correlation.

[0024] The present invention also proposes a system for evaluating the vulnerability threat level of power monitoring system equipment, comprising:

[0025] The difficulty coefficient determination module determines the network attack path for the key equipment of the power monitoring system, extracts the attack behavior based on the network attack path, and determines the difficulty coefficient of the network attack behavior by combining the attacker's skills and the configuration evaluation of the attack target;

[0026] The probability calculation module determines the success probability of a network attack at a specific attack cost based on the difficulty coefficient of the network attack behavior;

[0027] The threat level assessment module determines the vulnerability threat level of key equipment in the power monitoring system to network attacks based on the success probability and difficulty coefficient of network attack behavior.

[0028] Optionally, determine the difficulty coefficient of the network attack behavior, including:

[0029] According to the network attack path, a hierarchical model for evaluating the difficulty of network attack behavior is constructed, wherein the hierarchical model includes: a target layer, a criterion layer, an indicator layer and a behavior layer;

[0030] Determine the mutual importance of different factors in the criterion layer and construct a judgment matrix of the criterion layer to the target layer;

[0031] Determine the mutual importance of different factors in the indicator layer and construct a judgment matrix of the indicator layer against the criterion layer;

[0032] Obtain the maximum eigenvalue and eigenvector of the judgment matrix, and perform consistency check on the judgment matrix;

[0033] If the consistency check passes, the weight vector of the index layer element for the target layer element is determined according to the maximum eigenvector;

[0034] Establish a decision matrix of behavior layer elements for indicator layer elements;

[0035] According to the decision matrix and the weight vector of the indicator layer elements to the target layer elements, a weighted standardized decision matrix is ​​established;

[0036] The difficulty coefficient of network attack behavior is determined through a weighted standardized decision matrix.

[0037] Optionally, a hierarchical model is used to establish a target layer by calculating the difficulty coefficient of network attack behavior as the target element; to establish a criterion layer by using the attacker's skills of the network attack behavior and important configuration items of the attack target as reference criterion elements; to establish an indicator layer by using the evaluation indicator elements for the attacker's skills and the configuration of the attack target; and to establish a behavior layer by using various behaviors of the network attack behavior as behavior elements.

[0038] Optionally, determining the success probability of a network attack includes: determining a success probability function of any network attack behavior based on a reliability calculation method and a difficulty coefficient of the network attack behavior, and determining the success probability of the network attack based on the success probability function.

[0039] Optionally, determine the degree of vulnerability threat of key equipment of the power monitoring system to cyber attacks, specifically: determine the key equipment of the power monitoring system involved in the cyber attack path, establish a correlation between the attack path and the key equipment of the power monitoring system involved in the cyber attack path based on the success probability and the difficulty coefficient of the cyber attack behavior, and determine the degree of vulnerability threat of key equipment of the power monitoring system to cyber attacks based on the correlation.

[0040] Under the conditions of specific attacker skills and power monitoring system configuration, the present invention calculates the comprehensive difficulty coefficient of network attack behavior, providing a technical reference for quantitatively evaluating the difficulty of attack behavior.

[0041] The present invention calculates the success probability of each network attack path under a specific attack cost, providing a quantitative basis for comparing and measuring the difficulty of attacks on different paths.

[0042] The present invention quantitatively evaluates the threat level of the vulnerability of key equipment involved in the network attack path, and the evaluation results can provide a technical basis for determining the importance of network assets and the priority of equipment protection deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a flow chart of the method of the present invention;

[0044] Figure 2 It is a hierarchical structure model diagram of the method of the present invention;

[0045] Figure 3 A hierarchical structure model diagram of a substation monitoring system used in the method of the present invention;

[0046] Figure 4 It is a structural diagram of the system of the present invention. DETAILED DESCRIPTION

[0047] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0048] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0049] The present invention proposes a method for evaluating the vulnerability threat level of power monitoring system equipment, such as Figure 1 As shown, including:

[0050] First, based on the network attack path, the attack behavior is analyzed and extracted, and the difficulty of the network attack behavior is evaluated.

[0051] Afterwards, the attack path process and behavior difficulty are comprehensively considered to calculate the probability of success of the network attack under a specific attack cost.

[0052] Finally, combined with the attack success probability and behavior difficulty evaluation, the vulnerability threat level of the key equipment of the power monitoring system involved in the attack path is assessed.

[0053] (1) Solve the comprehensive difficulty coefficient of network attack behavior as follows:

[0054] Combining the characteristics of network attack scenarios and the distributed system vulnerability assessment method, the hierarchical analysis method and the approximate ideal solution sorting method are considered to realize the quantitative analysis of the difficulty of attack behavior. The specific steps are as follows:

[0055] 1) Construct a hierarchical model for comprehensive difficulty assessment of cyber attack behaviors;

[0056] The hierarchical model of comprehensive difficulty assessment of cyber attack behavior consists of four levels: target level, criterion level, indicator level, and behavior level. Figure 2 As shown, the calculated comprehensive difficulty coefficient of the attack behavior is the target and becomes a target layer element alone; the attacker's skills and important configuration items of the attack target, which are closely related to the comprehensive difficulty system, are the reference criteria for determining the difficulty coefficient and together form the criterion layer elements; the specific indicators that need to be obtained when conducting the assessment of the attacker's skills and the configuration of the attack target, such as the specific skills mastered by the attacker and the specific configuration conditions of the attack target, together form the indicator layer elements, which provide a basis for the quantitative analysis of the criterion layer elements; each attack behavior forms the lowest level of the behavior layer element, which aims to explain the relationship between the attack difficulty of each attack behavior and the indicator layer elements.

[0057] The model constructs the overall relationship between network attack behaviors and various factors associated with them. Through layered analysis, it finally obtains the comprehensive difficulty coefficient index of each behavior.

[0058] 2) Construct a judgment matrix;

[0059] According to the comparison of the mutual importance of different factors in the criterion layer, the expert scoring opinions are solicited, and the judgment matrix A (m+1 order) of the criterion layer on the target layer is constructed based on this, where A ij Indicates the importance of index i relative to index j. Similarly, construct judgment matrices B0 (nth order), B1 (pth order), B2 (qth order), ..., Bm (rth order) of the index layer against the attacker's skills and attack target configuration items 1 to m in the criterion layer.

[0060] 3) Obtain the maximum eigenvector of the judgment matrix and perform consistency test;

[0061] Obtain the maximum eigenvalue and eigenvector W of the judgment matrix A, B0, B1, B2, ..., Bm respectively A , W B0 , W B1 , W B2 ,……,W Bm Since the judgment matrix is ​​based on the judgment of expert experience, inconsistency is inevitable, but the inconsistency must be within a certain range to be acceptable. The consistency test is a method to examine the degree of inconsistency in judgment. The consistency test index CI is defined as follows:

[0062]

[0063] In the formula, n is the order of the judgment matrix, λ max is the maximum eigenvalue. When they are completely consistent, CI = 0. When they are inconsistent, the larger n is, the worse the consistency is. Therefore, the average random consistency index RI and random consistency ratio CR are introduced:

[0064]

[0065]

[0066] The average random consistency index RI is obtained by randomly constructing an n-order positive reciprocal matrix. When a sufficiently large sub-sample is taken, the average value of the maximum eigenvalue λ is obtained. ave , and then RI is calculated, and each order corresponds to an RI value. The introduction of RI overcomes the disadvantage that the consistency test index CI increases with the increase of the matrix order to a certain extent. When making consistency judgments, if the random consistency ratio CR is less than 0.1, the inconsistency is considered acceptable; if CR is greater than or equal to 0.1, the inconsistency is considered unacceptable and the judgment matrix needs to be modified.

[0067] 4) Calculate the weight vector of the index layer elements for the target layer elements;

[0068] The weight vector of the indicator layer element for the target layer element is:

[0069] W=[W B0 , W B1 , W B2 , ..., W Bm ]×W A (4)

[0070] 5) Construct a decision matrix of behavior layer elements for indicator layer elements;

[0071] Construct a decision matrix C for t indicator layer elements of s behaviors = (c ij ), where t=n+p+q+r, i=1, 2,..., s, j=1, 2,..., t, c ij Assign a value to the difficulty of the i-th behavior to break the j-th indicator. The greater the difficulty, the higher the c ij The larger the value.

[0072] The decision matrix is ​​standardized to form a standardized matrix D, where:

[0073]

[0074] 6) Construct a weighted standardized decision matrix;

[0075] Weighted standardized decision matrix Z ij =W j ×D ij , where W j is the j-th element of W.

[0076] 7) Calculate the comprehensive attack difficulty coefficient of each behavior;

[0077] According to the method of sorting approximate ideal solutions, the positive ideal solution Z+ and the negative ideal solution Z- are calculated, where:

[0078]

[0079] The distance between the attack difficulty coefficient of each behavior and the positive and negative ideal solutions is:

[0080]

[0081] Calculate the closeness of the ideal solution, and combine it with the average difficulty value in the decision matrix to calculate the comprehensive difficulty coefficient of each behavior:

[0082]

[0083] in,

[0084] (2) Solve the attack success probability of the attack path as follows:

[0085] Referring to the reliability calculation method, the success probability function of a certain attack behavior is defined as:

[0086]

[0087] Where c is the equivalent attack cost that the attacker can pay, and C is the equivalent attack cost required to implement the attack behavior. The larger P(c) is, the higher the probability of success of the behavior.

[0088] Combined with the attack path diagram analysis, when the number of attack behaviors contained in a path n≥2, the probability of completing the entire attack path is:

[0089]

[0090] (3) Solve the vulnerability threat assessment coefficient of the power monitoring system equipment as follows:

[0091] Based on the attack path diagram, a correlation diagram between attack behaviors and power monitoring system equipment is constructed, and the vulnerability threat assessment coefficient of power monitoring system equipment i is calculated based on it:

[0092]

[0093] Among them, j is the attack path that needs to pass through device i, PSj is the attack success probability of the path, DI obj =i is the comprehensive attack difficulty coefficient with device i as the attack target in attack path j. The larger the number of attack paths n passing through a device, the higher the success probability P Sj The larger the DI obj =The smaller the i is, the greater the vulnerability threat assessment coefficient of the device.

[0094] Taking a typical substation monitoring system that adopts the IEC 61850 standard as an example, based on network attack path analysis, the vulnerability threats of key equipment involved in six attack paths under specific configuration conditions are evaluated, and the attack behaviors contained in the six attack paths are sorted out as shown in Table 1:

[0095] Table 1

[0096]

[0097] The functions of the equipment are marked in the table, which correspond to the logical nodes in the IEC 61850 standard. The equipment is the target of attack, but what is actually attacked is the function of the equipment. The right side is the attack behavior number included in the attack path. The hierarchical model for the comprehensive difficulty assessment of network attack behaviors in the substation monitoring system is constructed as follows: Figure 3 shown.

[0098] The reciprocity 1-9 scaling method is used to compare the mutual importance of factors, construct the judgment matrix A of the criterion layer to the target layer, and the judgment matrix B0-B4 of the indicator layer to the criterion layer, calculate the maximum eigenvalue and the corresponding eigenvector, and perform consistency test.

[0099] When constructing a judgment matrix, the importance of each element should be fully compared, and reasonable values ​​should be assigned based on the measurement results. Taking judgment matrix A as an example, by fully soliciting expert opinions, the importance comparison between the five indicators such as attacker skills, network environment, and target objects is assigned. For example, A 11 is the attacker's skill index and its own measurement value is 1 (the matrix diagonal elements are indicators and their own measurement values ​​are 1), A 12 is the importance of attacker skills relative to the network environment. Assuming that the importance of attacker skills is about three times that of the network environment when evaluating target layer elements, then A 12 The value is 3; similarly, the remaining matrix elements are assigned according to the above rules. In addition, in order to avoid serious inconsistencies in the measurement process, the judgment matrix needs to be checked for consistency.

[0100] The calculation results are as follows:

[0101] λ Amax =5.0723

[0102] λ B0max =2.0

[0103] λ B1max =2.0

[0104] λ B2max =3.0092

[0105] λ B3max =3.0183

[0106] λ B4max =3.0183

[0107] The consistency test is performed on the above matrix. According to the statistical calculation results, the RI value is shown in Table 2:

[0108] Table 2

[0109] n 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 RI 0 0 0.58 0.90 1.12 1.24 1.32 1.41 1.45 1.49 1.52 1.54 1.56 1.58 1.59 1.59 1.61 1.61 1.62 1.63

[0110] The consistency test results are shown in Table 3. The above judgment matrices all pass the consistency test.

[0111] Table 3

[0112]

[0113]

[0114] The weight vector of the index layer element for the target layer element can be calculated as:

[0115] W=[0.0693 0.2079 0.0785 0.0393 0.1435 0.0790 0.2608 0.0099 0.01130.0260 0.0091 0.0238 0.0416] T

[0116] The decision matrix of the behavior layer elements for the indicator layer elements is constructed as follows:

[0117]

[0118] The decision matrix is ​​standardized to form a standardized matrix as follows:

[0119]

[0120] The weighted standardized decision matrix is ​​calculated as follows:

[0121]

[0122] The positive ideal solution Z+ and the negative ideal solution Z- are:

[0123] Z + =[0.0423 0.1085 0.0419 0.0187 0.0487 0.0276 0.1284 0.0047 0.00490.0122 0.0040 0.0103 0.0149]

[0124] Z - =[0.0106 0.0310 0.0105 0.0070 0.0348 0.0215 0.0482 0.0009 0.00140.0061 0.0020 0.0051 0.0085]

[0125] The distance between the attack difficulty coefficient of each behavior and the positive and negative ideal solutions is:

[0126] d + =[0.0871 0.0905 0.1120 0.0520 0.0976 0.0384 0.1010 0.0864 0.10880.0762 0.0606]

[0127] d - =[0.0405 0.0387 0.0164 0.0913 0.0278 0.0996 0.0344 0.0391 0.02070.0473 0.0686]

[0128] Calculate the closeness of the ideal solution and combine it with the average difficulty value in the decision matrix to calculate the comprehensive difficulty coefficient of each behavior as follows:

[0129] DI=[1.5141 1.2450 0.4215 3.0864 1.1072 4.7171 1.1132 1.4616 0.58911.6505 2.5722]The attack success probability of each attack path is calculated (assuming the attack cost c=1), as shown in Table 4:

[0130] Table 4

[0131]

[0132] The calculated secondary system equipment vulnerability threat assessment coefficient is shown in Table 5:

[0133] Table 5

[0134]

[0135] The calculation results show that the remote control workstation has the lowest vulnerability threat assessment coefficient and the greatest attack difficulty. This is because when invading the device from the dispatching master station, it is necessary to go through the vertical encryption authentication device, which increases the difficulty of intrusion. The intelligent terminal is a device that directly sends action signals to the primary device. Each attack path must pass through the device. Therefore, through comprehensive evaluation, it can be seen that its vulnerability threat coefficient is the highest. A comparative analysis of the above evaluation results shows that the calculation results of this method are basically consistent with the qualitative cognition results of equipment vulnerability based on engineering experience.

[0136] The present invention also proposes a system 200 for evaluating the vulnerability threat level of power monitoring system equipment, such as Figure 4 As shown, including:

[0137] The difficulty coefficient determination module 201 determines the network attack path for the key equipment of the power monitoring system, extracts the attack behavior according to the network attack path, and determines the difficulty coefficient of the network attack behavior in combination with the attacker's skills and the configuration evaluation of the attack target;

[0138] The probability calculation module 202 determines the success probability of the network attack under a specific attack cost according to the difficulty coefficient of the network attack behavior;

[0139] The threat level assessment module 203 determines the vulnerability threat level of the key equipment of the power monitoring system to the network attack based on the success probability and the difficulty coefficient of the network attack behavior.

[0140] Among them, determining the difficulty of network attack behavior includes:

[0141] According to the network attack path, a hierarchical model for evaluating the difficulty of network attack behavior is constructed, wherein the hierarchical model includes: a target layer, a criterion layer, an indicator layer and a behavior layer;

[0142] Determine the mutual importance of different factors in the criterion layer and construct a judgment matrix of the criterion layer to the target layer;

[0143] Determine the mutual importance of different factors in the indicator layer and construct a judgment matrix of the indicator layer against the criterion layer;

[0144] Obtain the maximum eigenvalue and eigenvector of the judgment matrix, and perform consistency check on the judgment matrix;

[0145] If the consistency check passes, the weight vector of the index layer element for the target layer element is determined according to the maximum eigenvector;

[0146] Establish a decision matrix of behavior layer elements for indicator layer elements;

[0147] According to the decision matrix and the weight vector of the indicator layer elements to the target layer elements, a weighted standardized decision matrix is ​​established;

[0148] The difficulty coefficient of network attack behavior is determined through a weighted standardized decision matrix.

[0149] Among them, the hierarchical model uses the difficulty coefficient of network attack behavior as the target element to establish the target layer; uses the attacker's skills of network attack behavior and the important configuration items of the attack target as the reference criterion elements to establish the criterion layer; uses the evaluation indicator elements for the attacker's skills and the configuration of the attack target to establish the indicator layer; and uses the various behaviors of network attack behavior as the behavior elements to establish the behavior layer.

[0150] Among them, the determination of the success probability of a network attack includes: determining the success probability function of any network attack behavior based on the reliability calculation method and the difficulty coefficient of the network attack behavior, and determining the success probability of the network attack based on the success probability function.

[0151] Among them, determine the degree of vulnerability threat of key equipment of the power monitoring system to network attacks, specifically: determine the key equipment of the power monitoring system involved in the network attack path, establish the correlation relationship between the attack path and the key equipment of the power monitoring system involved in the network attack path according to the success probability and the difficulty coefficient of the network attack behavior, and determine the degree of vulnerability threat of key equipment of the power monitoring system to network attacks according to the correlation relationship.

[0152] Under the conditions of specific attacker skills and power monitoring system configuration, the present invention calculates the comprehensive difficulty coefficient of network attack behavior, providing a technical reference for quantitatively evaluating the difficulty of attack behavior.

[0153] The present invention calculates the success probability of each network attack path under a specific attack cost, providing a quantitative basis for comparing and measuring the difficulty of attacks on different paths.

[0154] The present invention quantitatively evaluates the threat level of the vulnerability of key equipment involved in the network attack path, and the evaluation results can provide a technical basis for determining the importance of network assets and the priority of equipment protection deployment.

[0155] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0156] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0157] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0158] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0159] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0160] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for evaluating the vulnerability threat level of power monitoring system equipment, the method comprising: For the key equipment of the power monitoring system, determine the network attack path, extract the attack behavior based on the network attack path, and determine the difficulty coefficient of the network attack behavior by combining the attacker's skills and the configuration evaluation of the attack target; According to the difficulty coefficient of network attack behavior, determine the success probability of network attack under specific attack cost; Determine the vulnerability threat level of key equipment in the power monitoring system to cyber attacks based on the success probability and difficulty coefficient of cyber attacks; Determining the difficulty coefficient of the network attack behavior includes: According to the network attack path, a hierarchical model for evaluating the difficulty of network attack behavior is constructed, wherein the hierarchical model includes: a target layer, a criterion layer, an indicator layer and a behavior layer; Determine the mutual importance of different factors in the criterion layer and construct a judgment matrix of the criterion layer to the target layer; Determine the mutual importance of different factors in the indicator layer and construct a judgment matrix of the indicator layer against the criterion layer; Obtain the maximum eigenvalue and eigenvector of the judgment matrix, and perform consistency check on the judgment matrix; If the consistency check passes, the weight vector of the index layer element for the target layer element is determined according to the maximum eigenvector; Establish a decision matrix of behavior layer elements for indicator layer elements; According to the decision matrix and the weight vector of the indicator layer elements to the target layer elements, a weighted standardized decision matrix is ​​established; Determine the difficulty coefficient of network attack behavior through a weighted standardized decision matrix; The hierarchical structure model uses the difficulty coefficient of network attack behavior as the target element to establish the target layer; uses the attacker's skills of the network attack behavior and the important configuration items of the attack target as the reference criterion elements to establish the criterion layer; uses the evaluation indicator elements for the attacker's skills and the configuration of the attack target to establish the indicator layer; and uses the various behaviors of the network attack behavior as the behavior elements to establish the behavior layer.

2. The method according to claim 1, wherein the determination of the success probability of the network attack comprises: According to the reliability calculation method and the difficulty coefficient of network attack behavior, the success probability function of any network attack behavior is determined, and according to the success probability function, the success probability of the network attack is determined.

3. According to the method described in claim 1, the degree of vulnerability threat of key equipment of the power monitoring system to network attacks is determined by: determining the key equipment of the power monitoring system involved in the network attack path, establishing an association relationship between the attack path and the key equipment of the power monitoring system involved in the network attack path based on the success probability and the difficulty coefficient of the network attack behavior, and determining the degree of vulnerability threat of key equipment of the power monitoring system to network attacks based on the association relationship.

4. A system for evaluating the vulnerability threat level of power monitoring system equipment, the system comprising: The difficulty coefficient determination module determines the network attack path for the key equipment of the power monitoring system, extracts the attack behavior based on the network attack path, and determines the difficulty coefficient of the network attack behavior by combining the attacker's skills and the configuration evaluation of the attack target; The probability calculation module determines the success probability of a network attack at a specific attack cost based on the difficulty coefficient of the network attack behavior; The threat level assessment module determines the vulnerability threat level of key equipment in the power monitoring system to network attacks based on the success probability and the difficulty coefficient of network attack behavior; Determining the difficulty coefficient of the network attack behavior includes: According to the network attack path, a hierarchical model for evaluating the difficulty of network attack behavior is constructed, wherein the hierarchical model includes: a target layer, a criterion layer, an indicator layer and a behavior layer; Determine the mutual importance of different factors in the criterion layer and construct a judgment matrix of the criterion layer to the target layer; Determine the mutual importance of different factors in the indicator layer and construct a judgment matrix of the indicator layer against the criterion layer; Obtain the maximum eigenvalue and eigenvector of the judgment matrix, and perform consistency check on the judgment matrix; If the consistency check passes, the weight vector of the index layer element for the target layer element is determined according to the maximum eigenvector; Establish a decision matrix of behavior layer elements for indicator layer elements; According to the decision matrix and the weight vector of the indicator layer elements to the target layer elements, a weighted standardized decision matrix is ​​established; Determine the difficulty coefficient of network attack behavior through a weighted standardized decision matrix; The hierarchical structure model uses the difficulty coefficient of network attack behavior as the target element to establish the target layer; uses the attacker's skills of the network attack behavior and the important configuration items of the attack target as the reference criterion elements to establish the criterion layer; uses the evaluation indicator elements for the attacker's skills and the configuration of the attack target to establish the indicator layer; and uses the various behaviors of the network attack behavior as the behavior elements to establish the behavior layer.

5. The system according to claim 4, wherein the determination of the success probability of the network attack comprises: According to the reliability calculation method and the difficulty coefficient of network attack behavior, the success probability function of any network attack behavior is determined, and according to the success probability function, the success probability of the network attack is determined.

6. According to the system of claim 4, the method of determining the degree of vulnerability threat of key equipment of the power monitoring system to network attacks is specifically: determining the key equipment of the power monitoring system involved in the network attack path, establishing an association relationship between the attack path and the key equipment of the power monitoring system involved in the network attack path based on the success probability and the difficulty coefficient of the network attack behavior, and determining the degree of vulnerability threat of key equipment of the power monitoring system to network attacks based on the association relationship.

Images