A security system effectiveness evaluation method based on multimodal information

Abstract

The present invention discloses a method for quantitatively evaluating the protection effectiveness of a security system in an actual scenario, including modules such as hierarchical depth modeling of the scenario to be evaluated, multimodal information quantification, and evaluation algorithm. The method is based on the idea of ​​in-depth protection, and realizes hierarchical depth modeling of the security system of the actual scenario to be evaluated through security elements (including physical protection components and / or electronic protection components), and performs multimodal information quantification on the security elements and hierarchical depth model. With the protection target as the core, the security system effectiveness evaluation algorithm is used to calculate the intrusion time and detection probability of all possible intrusion paths in the hierarchical depth model, and the ranking is obtained according to the calculation results to obtain the ranking of the security prevention capabilities of the actual scenario, providing objective data support for subsequent evaluation and upgrading and transformation.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a security system effectiveness evaluation method based on multimodal information. Background Art

[0002] GB50348-2018 "Technical Standard for Security Engineering" puts forward the concept of "performance evaluation". The existing security system performance evaluation methods mainly include qualitative analysis methods such as hierarchical analysis method, fuzzy comprehensive evaluation method, Delphi method, and quantitative analysis methods such as BP neural network method, security network risk assessment method and path analysis method. However, a unified security system performance evaluation method has not yet been formed in the industry.

[0003] In the field of nuclear protection, my country has formed a relatively mature set of physical protection system protection capability assessment methods for analyzing the safety of nuclear facilities. Among them, a quantitative assessment method for the effectiveness of the physical protection system is proposed. The implementation process of this method is as follows:

[0004] The first step is to establish a two-dimensional facility description model of the physical protection system environment based on the facility component information, nuclear material information and specific environmental map information of the physical protection system of the nuclear power physical system. Among them, the facility component information includes detection probability, delay time, and traversable distance; the nuclear material information includes nuclear material size, nuclear material grade, and status information; the environmental map information includes the two-dimensional position coordinates and connection relationship of each facility component in the system.

[0005] The second step is to use the depth-first search algorithm to list all feasible paths for external adversary intrusion; determine the critical detection points of each feasible path based on the external intrusion enemy information and the civil defense response force information; calculate the interception probability of all possible paths based on the facility component information and sort them, and compare the minimum interception probability value with the industry standard to determine whether it reaches an effective level.

[0006] The third step is to use principal component analysis to determine the weapon effectiveness value, use the Lanchester combat damage theory model to calculate the final deterrence probability, and compare it with industry standards to determine whether the response force has reached an effective level.

[0007] In the fourth step, a greedy algorithm is used to calculate the internal detection probability of an insider committing a crime, and this is compared with the industry standard to determine whether it has reached an effective level.

[0008] The fifth step is to calculate the risk value of external adversary intrusion and the risk value of internal personnel committing crimes.

[0009] Step 6. When the risk value is high, analyze the areas for improvement and re-evaluate after improvement until it reaches the industry standard.

[0010] This technology achieves quantitative calculation of the effectiveness of nuclear power facilities through two-dimensional modeling, external intrusion algorithms, internal crime algorithms and other technologies. Compared with other fields in the security industry, there are some limitations:

[0011] 1. The two-dimensional modeling process is centered on the quantification of nuclear material information and is highly targeted. The protection targets of general security systems are diverse in form and location, which increases the difficulty of modeling.

[0012] 2. Calculate the minimum interception probability, final deterrence probability and internal detection probability based on the civil air defense information specified in the nuclear industry standards. Civil air defense information in other fields may be diverse, and there is no unified standard or industry consensus as the basis for evaluation, so the objectivity of the calculation results is poor. Summary of the invention

[0013] In view of the deficiencies of the prior art, the present invention aims to provide a security system effectiveness evaluation method based on multimodal information.

[0014] In order to achieve the above object, the present invention adopts the following technical solution:

[0015] A security system effectiveness evaluation method based on multimodal information, the specific process is:

[0016] The first step is to construct a security system layer depth model of the scenario to be evaluated, wherein the security system layer depth model is divided into multiple layers from the outside to the inside;

[0017] The second step is to load the security components of each layer into the corresponding layers of the hierarchical depth model one by one;

[0018] The third step is to quantify the multimodal information of each security element on the hierarchical depth model, including the intrusion time Pt ​​and detection probability Pg of each element, as well as the intrusion time ΔPt and detection probability ΔPg of the security elements in adjacent layers;

[0019] The fourth step is to use the protection target as the attack target, and calculate the intrusion time and detection probability of all possible intrusion paths through the effectiveness evaluation algorithm. Then, the calculation results are sorted to obtain the evaluation results: the lower the detection probability, the greater the risk of the intrusion path; the shorter the intrusion time, the greater the risk of the intrusion path.

[0020] Furthermore, in the first step, the security element is determined based on the actual survey results, and can be a separate physical component or a technical security component, or a combination of a physical component and a technical security component.

[0021] Furthermore, in the fourth step, the calculation process of the performance evaluation algorithm is as follows:

[0022] 1) Calculate the total number of all possible intrusion paths;

[0023] 2) Calculate the intrusion time of all possible intrusion paths based on the intrusion time and depth intrusion time of each layer of security elements in the hierarchical depth model that each intrusion path passes through in sequence;

[0024] 3) Calculate the detection probability of all possible intrusion paths based on the detection probability and depth detection probability of each layer of security elements in the hierarchical depth model that each intrusion path passes through in sequence, and calculate the detection probability of all possible intrusion paths;

[0025] 4) According to the calculation results, the intrusion time and detection probability of each intrusion path are sorted by numerical value to obtain the ranking of the security prevention capability of the evaluation scenario.

[0026] The beneficial effects of the present invention are as follows: the method of the present invention integrates the concepts of security hierarchy and in-depth protection to achieve hierarchical and in-depth modeling of the scenario to be evaluated, and forms a quantitative model based on physical components and technical defense components by assigning multimodal information of security elements and hierarchical and in-depth models. In this way, the intrusion time and detection probability of all possible intrusion paths are calculated, and the calculation results are sorted to obtain the security prevention capability of the evaluation scenario. The multimodal information quantification process of the present invention can be assigned according to the product's test and certification report, relevant national and industry standards, to ensure the objectivity of the evaluation results. Walls, windows, etc. that are not clearly specified by standards are assigned by the evaluation team. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a schematic diagram of the method flow of Example 1 of the present invention;

[0028] Figure 2 This is a schematic diagram of a layered depth model of a security system according to Embodiment 1 of the present invention;

[0029] Figure 3 This is a schematic diagram of a multi-modal quantization process of hierarchical depth model information according to Embodiment 1 of the present invention;

[0030] Figure 4 Schematic diagram of the performance evaluation algorithm of Example 1 of the present invention;

[0031] Figure 5 This is a hierarchical depth model diagram of Example 2 of the present invention;

[0032] Figure 6 A multimodal information quantization diagram of the hierarchical depth model of embodiment 2 of the present invention;

[0033] Figure 7 This is a hierarchical depth model diagram of Example 3 of the present invention;

[0034] Figure 8 This is a multimodal information quantization diagram of the hierarchical depth model of Example 3 of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0036] Example 1

[0037] The following is an introduction to some terms:

[0038] Security system: A prevention system that aims at safety and integrates physical protection, electronic protection and other technologies.

[0039] Security system effectiveness evaluation: The purpose of security system effectiveness evaluation is to evaluate the effectiveness of the system and provide a basis for the continued operation, maintenance, upgrade, transformation or reconstruction of the system.

[0040] Security elements: physical protection components (referred to as physical components), electronic protection components (also known as technical protection components) or a combination of the two used to form the hierarchical depth model of the security system.

[0041] Intrusion path: The path that the intruder takes from the outermost part of the assessment scene to the attack target (i.e., the protection target) is called the invasion path, without considering the situation where the intruder turns back during the invasion process.

[0042] This embodiment provides a security system effectiveness evaluation method based on multimodal information, which realizes quantitative evaluation of the effectiveness of the security system of the scenario to be evaluated by constructing a hierarchical depth model of the security system of the scenario to be evaluated, multimodal quantification of the hierarchical depth model information, and calculation of the effectiveness evaluation algorithm based on the hierarchical depth model. Figure 1 The specific process is as follows:

[0043] The first step is to build a security hierarchical depth model of the scenario to be evaluated. This is based on the concept of layered protection and in-depth protection of the security system. The layered and in-depth modeling method is used to represent the security system (system) of the actual scenario with discrete security components (including physical components and technical defense components) to form a security system hierarchical depth model of the evaluation scenario. The security system hierarchical depth model can be divided into 5 layers from the outside to the inside: perimeter layer (A), delay layer (B), protection layer (C), target layer (D), core layer, such as Figure 2 As shown. Security components are loaded on layers A, B, C, and D respectively, and the core layer is the protection target. Security components are determined according to the actual survey results and can be separate physical components or technical defense components, or a combination of physical components and technical defense components.

[0044] It should be noted that, in addition to being divided into 5 layers, the security system layer depth model can also be divided into 3 layers (such as perimeter layer, protection layer, core layer), 4 layers, and can be further divided into 6 layers, 7 layers, etc. This embodiment only takes 5 layers as an example for description.

[0045] The second step is to load the security components in the perimeter layer into the A layer of the hierarchical depth model one by one, represented by A1, A2, ..., Ai, and load the security components in the delay layer into the B layer of the hierarchical depth model one by one, represented by B1, B2, ..., Bj, and load the security components in the protection layer into the C layer of the hierarchical depth model one by one, represented by C1, C2, ..., Cm, and load the security components in the target layer into the D layer of the hierarchical depth model one by one, represented by D1, D2, ..., Dn.

[0046] Step 3: Figure 3 As shown, multimodal information is quantified and assigned to each security element on the hierarchical depth model, including the intrusion time Pt ​​and detection probability Pg of each security element, as well as the depth intrusion time ΔPt and depth detection probability ΔPg between security elements in adjacent levels. That is, the intrusion time Pt_a1~Pt_ai, Pt_b1~Pt_bj, Pt_c1~Pt_cm, Pt_d1~Pt_dn, detection probability Pg_a1~Pg_ai, Pg_b1~Pg_bj, Pg_c1~Pg_cm, Pg_d1~Pg_dn of each security component, as well as the intrusion time of each depth ΔPt_a1~ΔPt_ai, ΔPt_b1~ΔPt_bj, ΔPt_c1~ΔPt_cm, ΔPt_d1~ΔPt_dn and the depth detection probability ΔPg_a1~ΔPg_ai, ΔPg_b1~ΔPg_bj, ΔPg_c1~ΔPg_cm, ΔPg_d1~ΔPg_dn of the hierarchical depth model are assigned as the basic data of the performance evaluation algorithm.

[0047] Step 4: Figure 4 As shown in the figure, the protection target at the core layer is set as the attack target. Through the performance evaluation algorithm, the intrusion time and detection probability of all possible intrusion paths are calculated respectively, and the calculation results are sorted to obtain the evaluation results. The lower the detection probability, the greater the risk of the intrusion path; the shorter the intrusion time, the greater the risk of the intrusion path. When evaluating, upgrading and transforming the protection effectiveness of the security system, targeted reinforcement suggestions and plans can be put forward according to the size of the risk.

[0048] In this embodiment, the calculation process of the performance evaluation algorithm is as follows:

[0049] 1. Calculate the total number of all possible intrusion paths. The total number of paths R = i*j*m*n.

[0050] 2. Calculate the intrusion time Pt_k of all possible intrusion paths. Pt_k=Pt+ΔPt, the value range of k is: 1≤k≤R, k is an integer. Among them, Pt=Pt_al+Pt_bq+Pt_cr+Pt_ds, ΔPt=ΔPt_al+ΔPt_bq+ΔPt_cr+ΔPt_s; Pt_al, Pt_bq, Pt_cr, Pt_ds respectively represent the intrusion time of security element Al of the perimeter layer, security element Bq of the delay layer, security element Cr of the protection layer, and security element Ds of the target layer passed in sequence in the k-th intrusion path, ΔPt_al, ΔPt_bq, ΔPt_cr, ΔPt_ds respectively represent the depth intrusion time of security element Al of the perimeter layer, security element Bq of the delay layer, security element Cr of the protection layer, and security element Ds of the target layer passed in sequence in the k-th intrusion path, 1≤l≤i, 1≤q≤j, 1≤r≤m, 1≤s≤n.

[0051] 3. Calculate the detection probability Pg_p of all possible intrusion paths. Pg_p = Pg_al + (1-Pg_al) * ΔPg_al + (1-Pg_al) * (1-ΔPg_al) * Pg_bq + (1-Pg_al) * (1-ΔPg_al) * (1-Pg_bq) * ΔPg_bq + (1-Pg_al) * (1-ΔPg_al) * (1-Pg_bq) * ΔPg_bq + (1-Pg_al) * (1-ΔPg_al) * (1-Pg_bq) * (1-ΔPg_bq) * Pg_cr + (1-Pg_al) * (1-ΔPg_al) * (1-Pg_bq) * (1-ΔPg_bq) * ( +(1-Pg_al)*(1-ΔPg_al)*(1-ΔPg_bq)*(1-ΔPg_bq)*(1-Pg_cr)*(1-ΔPg_cr)*Pg_ds+(1-Pg_al)*(1-ΔPg_al)*(1-Pg_bq)*(1-ΔPg_bq)*(1-Pg_cr)*(1-ΔPg_cr)*Pg_ds*ΔPg_ds, the value range of p is: 1≤p≤R, and k is an integer. Pg_al, Pg_bq, Pg_cr, and Pg_ds respectively represent the detection probabilities of security element Al of the perimeter layer, security element Bq of the delay layer, security element Cr of the protection layer, and security element Ds of the target layer passed in sequence in the p-th intrusion path, ΔPg_al, ΔPg_bq, ΔPg_cr, and ΔPg_ds respectively represent the depth detection probabilities of security element Al of the perimeter layer, security element Bq of the delay layer, security element Cr of the protection layer, and security element Ds of the target layer passed in sequence in the p-th intrusion path, 1≤l≤i, 1≤q≤j, 1≤r≤m, 1≤s≤n.

[0052] According to the calculation results, the calculated Pt_k and Pg_p are sorted by numerical value to obtain the ranking of the security prevention capabilities of the evaluation scenario. The evaluation team and the management team provide suggestions and plans for subsequent performance evaluation and upgrades and renovations of the security system in the scenario based on the sorting results.

[0053] Example 2

[0054] This embodiment uses the method described in Example 1 to evaluate the effectiveness of prevention in a certain scenario to be evaluated. When constructing a hierarchical depth model, the physical components and technical defense components are described separately, and the implementation steps are as follows:

[0055] 1. According to the on-site investigation, taking the core layer protection target as the attack target, a five-layer hierarchical depth model consisting of perimeter layer, delay layer, protection layer, target layer and core layer is constructed.

[0056] 2. Sort out the physical components and technical defense components of each layer, and the results are as follows: Figure 5 shown.

[0057] 3. Quantification of multimodal information of the hierarchical depth model. In this embodiment, the physical components and technical defense components are separately reflected in the model, so the detection probability of the physical components is 0, and the intrusion time of the technical defense components is 0. For the intrusion time assignment of the access doors, the anti-theft doors adopt the anti-destruction time requirements in the national standard GB17565-2007 "General Technical Conditions for Anti-theft Security Doors" (30 minutes for Class A doors, 15 minutes for Class B doors, 10 minutes for Class C doors, and 6 minutes for Class D doors), and other access doors refer to the anti-theft doors for assignment. The intrusion time of cameras, alarm equipment, and access control equipment is 0, and the detection probability adopts the third-party inspection report value of the product. For walls, windows, etc. that are not clearly specified in the standards, the assessment team assigns them according to empirical values. The depth detection time and depth detection probability between two layers are assigned according to the actual situation. In this embodiment, the depth detection time and depth detection probability between two adjacent layers use the same value. The multimodal information quantification results of the hierarchical depth model are shown as follows. Figure 6 shown.

[0058] 4. The total number of all possible intrusion paths R = 3*3*2*2 = 36.

[0059] 5. Calculate the time Pt ​​of each intrusion path. The results are shown in Table 1.

[0060] 6. Sort the intrusion time from small to large. The results are shown in Table 2.

[0061] 7. Calculate the detection probability Pg of each intrusion path. The results are shown in Table 3.

[0062] 8. Sort the detection probabilities from small to large. The results are shown in Table 4.

[0063] Table 1: Intrusion time calculation results

[0064]

[0065]

[0066] Table 2: Intrusion time ranking results

[0067]

[0068]

[0069] Table 3: Calculation results of intrusion detection probability

[0070]

[0071]

[0072] Table 4: Ranking results of intrusion detection probability

[0073]

[0074] 9. Based on the intrusion time and detection probability results, the assessment team evaluates and summarizes the protection effectiveness of the assessment scenario and puts forward improvement suggestions.

[0075] Example 3

[0076] Generally, security engineering construction includes physical protection and electronic protection. In the actual evaluation process, the part where the physical components and technical protection components work together can be regarded as a security element. In this case, the quantitative assignment process of the hierarchical depth model can be simplified to reduce the computational complexity. This embodiment is a description of such an evaluation scenario, and its implementation steps are as follows:

[0077] 1. According to the on-site investigation, the core layer protection target is taken as the attack target, and a five-layer hierarchical depth model consisting of perimeter layer, delay layer, protection layer, target layer, and core layer is constructed;

[0078] 2. Sort out the physical components and technical defense components of each layer, classify and integrate them into security components. The results are as follows: Figure 7 shown.

[0079] 3. Multimodal information quantification of hierarchical depth model. Security components cover the functions of physical and electronic components. Information quantification is performed based on their protection capabilities to obtain quantitative results, such as Figure 8 shown.

[0080] 4. The total number of all possible intrusion paths R = 2*2*1*1 = 4.

[0081] 5. Calculate the time Pt ​​of each intrusion path. The results are shown in Table 5.

[0082] 6. Sort the intrusion time from small to large. The results are shown in Table 6.

[0083] 7. Calculate the detection probability Pg of each intrusion path. The results are shown in Table 7.

[0084] 8. Sort the detection probabilities from small to large. The results are shown in Table 8.

[0085] Table 5: Intrusion time calculation results

[0086]

[0087]

[0088] Table 6: Intrusion time ranking results

[0089]

[0090] Table 7: Intrusion detection probability calculation results

[0091]

[0092] Table 8: Ranking results of intrusion detection probability

[0093]

[0094] 9. Based on the intrusion time and detection probability results, the assessment team evaluates and summarizes the protection effectiveness of the assessment scenario and puts forward improvement suggestions.

[0095] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A security system effectiveness evaluation method based on multimodal information, characterized in that: The specific process is: The first step is to construct a security system layer depth model of the scenario to be evaluated, wherein the security system layer depth model is divided into multiple layers from the outside to the inside; The second step is to load the security components of each layer into the corresponding layers of the hierarchical depth model one by one; The third step is to quantify the multimodal information of each security element on the hierarchical depth model, including the intrusion time Pt ​​and detection probability Pg of each element, as well as the intrusion time ΔPt and detection probability ΔPg of the security elements in adjacent layers; Step 4: Take the protected target as the attack target, calculate the intrusion time and detection probability of all possible intrusion paths through the effectiveness evaluation algorithm, and sort them according to the calculation results to obtain the evaluation results: the lower the detection probability, the greater the risk of the intrusion path; the shorter the intrusion time, the greater the risk of the intrusion path; The calculation process of the performance evaluation algorithm is as follows: 1) Calculate the total number of all possible intrusion paths; 2) Calculate the intrusion time of all possible intrusion paths based on the intrusion time and depth intrusion time of each layer of security elements in the hierarchical depth model that each intrusion path passes through in sequence; 3) Calculate the detection probability of all possible intrusion paths based on the detection probability and depth detection probability of each layer of security elements in the hierarchical depth model that each intrusion path passes through in sequence, and calculate the detection probability of all possible intrusion paths; 4) Based on the calculation results, the intrusion time and detection probability of each intrusion path are sorted by numerical value to obtain the ranking of the security prevention capabilities of the assessment scenario.

2. The method according to claim 1, characterized in that In the first step, the security elements are determined based on the actual survey results. They can be separate physical components or technical security components, or a combination of physical components and technical security components.

Images