A trust measurement method, device, equipment and storage medium

Abstract

The present application discloses a trust measurement method, apparatus, device and storage medium, including: when a system call for a target industrial control program is monitored, call information related to the system call is obtained to obtain system call data; the system call data is preprocessed, and the preprocessed system call data is input into a target decision tree model obtained by training an initial decision tree model constructed based on a CART algorithm using a training set, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; and judge whether the target industrial control program is trustworthy through the target decision tree. The present application can effectively judge whether the program during the operation of the industrial control system is trustworthy through the target decision tree model constructed based on the CART algorithm, improve the accuracy of malicious behavior identification, and reduce the omission rate and false alarm rate of trusted computing.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a trust measurement method, apparatus, device, and storage medium. Background Art

[0002] Currently, Trusted Computing (TC) technology has achieved trusted startup of common computing platforms and passed the trust chain to applications, thereby achieving static integrity measurement of applications and ensuring trusted startup of applications.

[0003] However, Industrial Control Systems (ICS) require programs to run in order to function, and both trusted and untrusted programs perform sensitive operations. Traditional signature-based malware detection methods cannot guarantee that the program is running as intended and cannot identify the specific location of the malicious program. Existing dynamic trustworthiness measurement methods that analyze program behavior after sensitive operations have high false positive and false negative rates when applied to ICS.

[0004] In summary, how to effectively determine whether the program in an industrial control system is trustworthy during operation is a problem that needs to be further solved. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a trust measurement method, apparatus, device, and storage medium that can effectively determine whether the program is trustworthy when the industrial control system is running, improve the accuracy of malicious behavior identification, and reduce the false alarm rate and false alarm rate of trusted computing. The specific solution is as follows:

[0006] In a first aspect, the present application discloses a trust measurement method applied to an industrial control system, comprising:

[0007] When a system call for a target industrial control program is detected, call information related to the system call is obtained to obtain system call data;

[0008] Preprocessing the system call data to obtain preprocessed system call data;

[0009] Inputting the preprocessed system call data into the trained target decision tree model to construct an initial decision tree through the target decision tree model, and pruning the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set;

[0010] Whether the target industrial control program is credible is determined through the target decision tree.

[0011] Optionally, the credibility measurement method further includes:

[0012] Obtain the system call information corresponding to the industrial control program during the historical system call to obtain the historical system call information;

[0013] Preprocessing the historical system call information to obtain the training set;

[0014] The training set is input into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model.

[0015] Optionally, preprocessing the historical system call information to obtain the training set includes:

[0016] Preprocessing is performed on data with preset problem types in the historical system call information to obtain the training set; the preset problem types include any one or more of data missing, data noise, data redundancy, data set imbalance and data duplication.

[0017] Optionally, preprocessing the historical system call information to obtain the training set includes:

[0018] Dividing the historical system call information according to preset system call attributes, and assigning weights to each of the historical system calls to obtain weighted historical system call data;

[0019] The weighted historical system call data is used to calculate the sum of the system call weights of each system call attribute, and a target threat level value corresponding to the sum of the system call weights is determined according to a preset weight and threat level mapping table, and the target threat level value is used as the training set.

[0020] Optionally, inputting the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model includes:

[0021] Inputting the training set into the initial decision tree model constructed based on the CART algorithm, so that the initial decision tree model divides the training set according to a preset sample classification rule to obtain corresponding sample classification results;

[0022] Calculating the Gini coefficients of the sample classification results respectively to obtain multiple sample Gini coefficients;

[0023] Determine a minimum value from the multiple sample Gini coefficients, and use the system call attribute corresponding to the minimum value as a target attribute;

[0024] An initial sample decision tree is constructed using the target attribute, and the initial sample decision tree is pruned to obtain the target decision tree model.

[0025] Optionally, preprocessing the system call data to obtain preprocessed system call data includes:

[0026] Dividing the system call data according to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes to obtain process control threat attribute data, system control threat attribute data, memory management threat attribute data, and network management threat attribute data;

[0027] assigning weights to the process control threat attribute, the system control threat attribute, the memory management threat attribute, and the network management threat attribute respectively to obtain corresponding multiple weighted threat attributes;

[0028] Using the multiple weighted threat attributes, weighting the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data is performed to obtain corresponding weighted threat attribute data;

[0029] Calculating the sum of the weighted threat attribute data corresponding to each threat attribute, and determining a target threat attribute value corresponding to the sum of the weights according to the weight-threat degree mapping table;

[0030] Accordingly, inputting the pre-processed system call data into the trained target decision tree model includes:

[0031] The target threat attribute value is input into the trained target decision tree model.

[0032] Optionally, before obtaining the call information related to the system call and obtaining the system call data, the step further includes:

[0033] The system call is intercepted by a preset hook function.

[0034] In a second aspect, the present application discloses a trust measurement device, which is applied to an industrial control system, comprising:

[0035] A data acquisition module is used to acquire call information related to the system call when a system call for a target industrial control program is monitored, thereby obtaining system call data;

[0036] A data preprocessing module, configured to preprocess the system call data to obtain preprocessed system call data;

[0037] A decision tree generation module is used to input the preprocessed system call data into the trained target decision tree model to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set;

[0038] The credibility judgment module is used to judge whether the target industrial control program is credible through the target decision tree.

[0039] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the processor implements the aforementioned trust measurement method when executing a computer program stored in the memory.

[0040] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned trust measurement method is implemented.

[0041] It can be seen that when the present application monitors a system call for a target industrial control program, it obtains call information related to the system call, obtains system call data, and then preprocesses the system call data to obtain preprocessed system call data, and then inputs the preprocessed system call data into the target decision tree model obtained after training the initial decision tree model constructed based on the CART algorithm using the training set, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree, and the target decision tree can be used to determine whether the target industrial control program is trustworthy. It can be seen that the present application can analyze the program behavior after sensitive operations occur through the target decision tree model constructed based on the CART algorithm, and determine whether the operation is trustworthy through the dynamic characteristics of the industrial control program during operation, thereby improving the accuracy of malicious behavior identification and reducing the omission rate and false alarm rate of trusted computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0043] Figure 1 A flow chart of a trust measurement method disclosed in this application;

[0044] Figure 2 A flowchart of a specific method for creating a decision tree model disclosed in this application;

[0045] Figure 3 This is a specific weight and threat level mapping representation disclosed in this application;

[0046] Figure 4 A schematic diagram of a specific training set data disclosed in this application;

[0047] Figure 5 This is a flow chart of a specific training set acquisition method disclosed in this application;

[0048] Figure 6 A flowchart of a specific trust measurement method disclosed in this application;

[0049] Figure 7 This is a schematic diagram of the structure of a trust measurement device disclosed in this application;

[0050] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0052] The present application discloses a trust measurement method for industrial control systems. Figure 1 As shown, the method includes:

[0053] Step S11: when a system call for a target industrial control program is detected, call information related to the system call is acquired to obtain system call data.

[0054] In this embodiment, before a system call is made, a corresponding interception mechanism needs to be created in advance for the target industrial control program being called. This allows the system call to be intercepted during program execution by the interception mechanism when a system call for the target industrial control program is detected, preventing the direct execution of malicious or tampered industrial control programs. The system call information related to the system call is then obtained to obtain the corresponding system call data. The interception mechanism can be implemented using hook technology. Specifically, a hook function is created in advance in the industrial control system. When a system call for the target industrial control program is detected, the hook function is first called, and the system call is then intercepted by the hook function. Furthermore, the system call information, such as the parameters and name of the system call, can be returned to the industrial control system.

[0055] Step S12: pre-processing the system call data to obtain pre-processed system call data.

[0056] In this embodiment, after obtaining the call information related to the system call and obtaining the system call data, it is necessary to further pre-process the system call data accordingly and convert it into the data format required for building the decision tree model, thereby obtaining the pre-processed system call data. It is understandable that since this embodiment implements the trusted computing measurement of the industrial control system based on a model created by a decision tree, and the decision tree model has special format requirements for the input data, it is necessary to pre-process the system call data accordingly before inputting the system call data into the model created based on the decision tree. For example, after obtaining the system call data, the system call data is first divided according to attributes such as memory and network, and then weights are assigned to each of the divided system call data, and the total weight of the system call for each attribute is calculated. Then, based on the mapping relationship between the total weight and the preset threat level mapping table, the target threat level attribute value is determined, and the target threat level attribute value is used as the input of the decision tree model.

[0057] Step S13: Input the preprocessed system call data into the trained target decision tree model, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set.

[0058] In this embodiment, the system call data is preprocessed to obtain the preprocessed system call data, and then the preprocessed system call data is input into a target decision tree model obtained by training an initial decision tree model constructed based on a CART (Classification And Regression Tree) algorithm using a training set. Then, an initial decision tree is constructed using the target decision tree model, and branches that affect the accuracy of the initial decision tree are pruned to obtain a target decision tree.

[0059] Step S14: judging whether the target industrial control program is credible through the target decision tree.

[0060] In this embodiment, after the pre-processed system call data is input into the trained target decision tree model to obtain a target decision tree, it is possible to determine whether the target industrial control program is credible based on the information in the target decision tree.

[0061] It can be seen that when the embodiment of the present application monitors a system call for a target industrial control program, the call information related to the system call is obtained to obtain system call data, and then the system call data is preprocessed to obtain preprocessed system call data, and then the preprocessed system call data is input into the target decision tree model obtained after training the initial decision tree model constructed based on the CART algorithm using the training set, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree, and the target decision tree can be used to determine whether the target industrial control program is trustworthy. It can be seen that the embodiment of the present application can analyze the program behavior after a sensitive operation occurs through the target decision tree model constructed based on the CART algorithm, and determine whether the operation is trustworthy through the dynamic characteristics of the industrial control program during operation, thereby improving the accuracy of malicious behavior identification and reducing the omission rate and false alarm rate of trusted computing.

[0062] The present application embodiment discloses a specific process for creating a target decision tree model, which is applied to industrial control systems. Figure 2 As shown, the method includes:

[0063] Step S21: Obtain the system call information corresponding to the industrial control program during the historical system call to obtain the historical system call information.

[0064] In this embodiment, the relevant information of the system calls generated during the operation of the historical industrial control program of the industrial control system is first collected to obtain the historical system call information.

[0065] Step S22: pre-processing the historical system call information to obtain a training set.

[0066] In this embodiment, the system call information corresponding to the industrial control program during the historical system call is obtained. After the historical system call information is obtained, the historical system call information is further preprocessed to obtain a training set.

[0067] In this embodiment, the preprocessing of the historical system call information to obtain a training set may specifically include: preprocessing data with preset problem types in the historical system call information to obtain a training set; the preset problem types include any one or more of data missing, data noise, data redundancy, data set imbalance, and data duplication. It is understandable that due to the influence of factors such as the internal structure of the industrial control system and the acquisition equipment, in the actual process of collecting the historical system call information, there may be problems such as data missing, data noise, data redundancy, data set imbalance, and data duplication. Therefore, after obtaining the historical system call information, it needs to be processed accordingly, and the processed data is used as the training set. For example, data with missing attribute value data in the historical system call information can be directly deleted; data with attributes in the historical system call information that exceed the preset data analysis requirements or are irrelevant attributes can be processed by deleting the relevant attribute column data; if there are identical records of the same type of system calls at the same time in the historical system call information, only one record can be retained.

[0068] In this embodiment, the preprocessing of the historical system call information to obtain the training set may specifically include: dividing the historical system call information according to preset system call attributes, and assigning weights to each of the historical system calls to obtain weighted historical system call data; using the weighted historical system call data to calculate the sum of the system call weights of each of the system call attributes, and determining the target threat value corresponding to the sum of the system call weights according to a preset weight and threat level mapping table, and using the target threat value as the training set. Specifically, after obtaining the historical system call information, it is necessary to convert the historical system call information into the data format required for constructing a decision tree model. The historical system call information may be divided according to the preset system call attributes first, and then weights may be assigned to each of the system call attributes to obtain the weighted system call attributes, and then the sum of the system call weights corresponding to each of the system call attributes may be calculated, and the threat value corresponding to the sum of the system call weights may be determined according to a preset weight and threat level mapping table, and then the threat value may be used as the training set. For example, see Figure 3 As shown, when the calculated weights are between (20, 50), according to Figure 3The weight and threat level mapping table shown can determine that the threat level at this time is A. The system call attributes include but are not limited to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes.

[0069] In a specific embodiment, see Figure 4 As shown, Figure 4 The figure shows eight training sample data (i.e., ID1 to ID8) obtained after preprocessing the acquired historical system call information. The specific acquisition process is as follows: the collected historical system call information is divided into four categories according to attributes: process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes. Then, each type of threat attribute is weighted, and the sum of the system call weights of each threat attribute is calculated. Figure 3 The weight and threat level mapping table shown determines the corresponding threat level attribute value.

[0070] Step S23: inputting the training set into an initial decision tree model constructed based on the CART algorithm for training to obtain a target decision tree model.

[0071] In this embodiment, after preprocessing the historical system call information to obtain a training set, the training set is input into an initial decision tree model constructed based on the CART algorithm for training, thereby obtaining a target decision tree model.

[0072] In a specific embodiment, see Figure 5 As shown, the inputting of the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model may specifically include:

[0073] Step S31: inputting the training set into an initial decision tree model constructed based on the CART algorithm, so that the initial decision tree model divides the training set according to a preset sample classification rule to obtain corresponding sample classification results;

[0074] Step S32: Calculate the Gini coefficients of the sample classification results respectively to obtain multiple sample Gini coefficients;

[0075] Step S33: determining a minimum value from the multiple sample Gini coefficients, and taking the system call attribute corresponding to the minimum value as the target attribute;

[0076] Step S34: constructing an initial sample decision tree using the target attribute, and performing pruning processing on the initial sample decision tree to obtain a target decision tree model.

[0077] In this embodiment, after obtaining the training set, the training set can be input into the initial decision tree model constructed based on the CART algorithm for training. Figure 4 The eight training sample data in [1] are used as the training set and input into the initial decision tree model. The attributes X are defined as {process control threat attribute, network control threat attribute, system control threat attribute, memory management threat attribute}, and the classification result Y is defined as {trusted or untrusted}. Let D be the training set. The Gini index calculation formula for each attribute X is:

[0078]

[0079] Among them, C k is the sample subset belonging to the kth attribute in the training set D, where k is the number of classes.

[0080] Furthermore, the training set D is divided into D1 and D2 according to the sample classification results of "credible" or "uncredible", and the Gini coefficient calculation formula of the training set D is:

[0081]

[0082] Furthermore, the Gini coefficient of the process control threat attribute (denoted by X1) is calculated as follows:

[0083] Gini(D,X1=A)=4 / 8*(1-(3 / 4) 2 -(1 / 4) 2 )+4 / 8*(1-(3 / 4) 2 -(1 / 4) 2 )=0.375;

[0084] Gini(D,X1=B)=3 / 8*(1-(2 / 3) 2 -(1 / 3) 2 )+5 / 8*(1-(4 / 5) 2 -(1 / 5) 2 )=0.367;

[0085] Gini(D,X1=C)=1 / 8*(1-1 2 )+7 / 8*(1-(5 / 7) 2 -(2 / 7) 2 )=0.357.

[0086] Similarly, the Gini coefficients of the network control threat attribute, the system control threat attribute, and the memory management threat attribute can be calculated, which will not be described in detail here.

[0087] After respectively calculating the Gini coefficients of the process control threat attribute, the network control threat attribute, the system control threat attribute, and the memory management threat attribute, the minimum Gini coefficient is determined from the four Gini coefficients, and the threat attribute and the split point corresponding to the minimum Gini coefficient are used as the optimal attribute and the optimal split point. Two child nodes are generated from the current node according to the optimal attribute and the optimal split point, and the training set D is assigned to the two child nodes according to the attributes, thereby creating an initial decision tree T0, and performing a pruning operation on the initial decision tree T0. The specific process of the pruning operation is as follows:

[0088] Assume k = 0, T = T0, α = +∞, and the calculation formula for each internal node t from bottom to top is:

[0089]

[0090] Among them, T t represents the subtree with t as the root node, C(T t ) is the prediction error of the training set data, |T t |It is T t The number of leaf nodes.

[0091] The internal node t is visited from top to bottom, and if g(t)=α, a pruning operation is performed.

[0092] For more specific processing procedures of the above steps, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0093] It can be seen that in the embodiment of the present application, the system call information corresponding to the industrial control program during historical system calls is first obtained to obtain the historical system call information, and then the historical system call information is preprocessed to obtain a training set, and then the training set is input into the initial decision tree model constructed based on the CART algorithm for training to obtain a target decision tree model. The obtained target decision tree model can effectively determine whether the program during the operation of the industrial control system is trustworthy.

[0094] The present application discloses a specific trust measurement method for industrial control systems. Figure 6 As shown, the method includes:

[0095] Step S41: when a system call for a target industrial control program is detected, call information related to the system call is acquired to obtain system call data.

[0096] Step S42: pre-processing the system call data to obtain pre-processed system call data.

[0097] Step S43: Divide the system call data according to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes to obtain process control threat attribute data, system control threat attribute data, memory management threat attribute data, and network management threat attribute data.

[0098] In this embodiment, after preprocessing the system call data to obtain preprocessed system call data, the above-mentioned system call data is further divided according to process control threat attributes, system control threat attributes, memory management threat attributes and network management threat attributes to obtain corresponding process control threat attribute data, system control threat attribute data, memory management threat attribute data and network management threat attribute data.

[0099] Step S44: assigning weights to the process control threat attribute, the system control threat attribute, the memory management threat attribute, and the network management threat attribute respectively to obtain corresponding multiple weighted threat attributes.

[0100] In this embodiment, the system call data is divided according to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes. After obtaining process control threat attribute data, system control threat attribute data, memory management threat attribute data, and network management threat attribute data, weights are assigned to the process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes according to the importance of each attribute to obtain corresponding multiple weighted threat attributes.

[0101] Step S45: Using the multiple weighted threat attributes, weighting processing is performed on the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data to obtain corresponding weighted threat attribute data.

[0102] In this embodiment, after obtaining multiple weighted threat attributes, the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data can be weighted using the multiple weighted threat attributes, that is, the weight of each threat attribute is matched to the corresponding system call data to obtain multiple weighted threat attribute data.

[0103] Step S46: Calculate the sum of the weighted threat attribute data corresponding to each threat attribute, and determine the target threat attribute value corresponding to the sum of the weights according to the weight-threat degree mapping table.

[0104] In this embodiment, the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data are weighted using the multiple weighted threat attributes to obtain the corresponding weighted threat attribute data. Then, the sum of the weights of the weighted threat attribute data corresponding to each threat attribute is calculated, and then a target threat level attribute value corresponding to the sum of the weights can be determined based on a preset weight-threat level mapping table.

[0105] Step S47: Input the target threat attribute value into the trained target decision tree model so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set.

[0106] Step S48: Determine whether the target industrial control program is credible through the target decision tree.

[0107] Among them, for more specific processing procedures of the above steps S41, S42, S47, and S48, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0108] It can be seen that the embodiment of the present application divides the system call data according to the process control threat attributes, system control threat attributes, memory management threat attributes and network management threat attributes, and then obtains the target decision tree. Through the target decision tree, it is possible to effectively judge whether the process control program, system control program, memory management program and network management program during the operation of the industrial control system are trustworthy.

[0109] Accordingly, the present application also discloses a trust measurement device, which is applied to industrial control systems. Figure 7 As shown, the device includes:

[0110] The data acquisition module 11 is used to acquire call information related to the system call when a system call for the target industrial control program is monitored, and obtain system call data;

[0111] A data preprocessing module 12 is used to preprocess the system call data to obtain preprocessed system call data;

[0112] A decision tree generation module 13 is configured to input the preprocessed system call data into a trained target decision tree model, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set;

[0113] The credibility judgment module 14 is configured to judge whether the target industrial control program is credible through the target decision tree.

[0114] Among them, the specific work processes of the above modules can refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0115] It can be seen that in the embodiment of the present application, when a system call for a target industrial control program is monitored, call information related to the system call is obtained to obtain system call data, and then the system call data is preprocessed to obtain preprocessed system call data, and then the preprocessed system call data is input into the target decision tree model obtained after training the initial decision tree model constructed based on the CART algorithm using the training set, so as to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree, and the target decision tree can be used to determine whether the target industrial control program is trustworthy. It can be seen that the embodiment of the present application can analyze the program behavior after a sensitive operation occurs through the target decision tree model constructed based on the CART algorithm, and determine whether the operation is trustworthy through the dynamic characteristics of the industrial control program during operation, thereby improving the accuracy of malicious behavior identification and reducing the omission rate and false alarm rate of trusted computing.

[0116] In some specific embodiments, the credibility measurement device may further include:

[0117] An information acquisition unit is used to acquire system call information corresponding to the industrial control program during historical system calls, thereby obtaining historical system call information;

[0118] A first preprocessing unit, configured to preprocess the historical system call information to obtain the training set;

[0119] The first model training unit is used to input the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model.

[0120] In some specific embodiments, the first pre-processing unit may specifically include:

[0121] The second preprocessing unit is used to preprocess data with preset problem types in the historical system call information to obtain the training set; the preset problem types include any one or more of data missing, data noise, data redundancy, data set imbalance and data duplication.

[0122] In some specific embodiments, the first pre-processing unit may specifically include:

[0123] A first dividing unit, configured to divide the historical system call information according to preset system call attributes;

[0124] a first weighting unit, configured to assign a weight to each of the historical system calls to obtain weighted historical system call data;

[0125] A training set acquisition unit is used to use the weighted historical system call data to calculate the sum of the system call weights of each system call attribute, and determine the target threat level value corresponding to the sum of the system call weights according to a preset weight and threat level mapping table, and use the target threat level value as the training set.

[0126] In some specific embodiments, the model training unit may specifically include:

[0127] A second partitioning unit is configured to input the training set into the initial decision tree model constructed based on the CART algorithm, so that the initial decision tree model partitions the training set according to a preset sample classification rule to obtain corresponding sample classification results;

[0128] A first calculation unit is used to calculate the Gini coefficients of the sample classification results respectively to obtain multiple sample Gini coefficients;

[0129] a feature determination unit, configured to determine a minimum value from the multiple sample Gini coefficients, and use the system call attribute corresponding to the minimum value as a target attribute;

[0130] A pruning processing unit is used to construct an initial sample decision tree using the target attribute and perform pruning processing on the initial sample decision tree to obtain the target decision tree model.

[0131] In some specific embodiments, the data preprocessing module 12 may specifically include:

[0132] a third dividing unit, configured to divide the system call data according to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes, to obtain process control threat attribute data, system control threat attribute data, memory management threat attribute data, and network management threat attribute data;

[0133] a weighting unit, configured to assign weights to the process control threat attribute, the system control threat attribute, the memory management threat attribute, and the network management threat attribute, respectively, to obtain a plurality of corresponding weighted threat attributes;

[0134] a second weighting unit, configured to perform weighted processing on the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data using the multiple weighted threat attributes to obtain corresponding weighted threat attribute data;

[0135] a second calculation unit, configured to calculate a sum of weights of the weighted threat attribute data corresponding to each threat attribute, and determine a target threat attribute value corresponding to the sum of weights according to a weight-threat degree mapping table;

[0136] Accordingly, inputting the pre-processed system call data into the trained target decision tree model may specifically include:

[0137] The data input unit is used to input the target threat attribute value into the trained target decision tree model.

[0138] In some specific embodiments, before obtaining the call information related to the system call and obtaining the system call data, the following steps may also be included:

[0139] The interception unit is used to intercept the system call through a preset hook function.

[0140] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0141] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the trust measurement method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may be a computer.

[0142] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0143] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0144] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to implement the trust measurement method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks.

[0145] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned trust measurement method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0146] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0147] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0148] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0149] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0150] The above describes in detail a trust measurement method, apparatus, device, and storage medium provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core concept of the present application. At the same time, for those skilled in the art, based on the concept of the present application, there may be changes in the specific implementation methods and application scope. In summary, the contents of this specification should not be understood as limiting the present application.

Claims

1. A credibility measurement method, characterized in that: Applied to industrial control systems, including: When a system call for a target industrial control program is detected, call information related to the system call is obtained to obtain system call data; Preprocessing the system call data to obtain preprocessed system call data; Inputting the preprocessed system call data into the trained target decision tree model to construct an initial decision tree through the target decision tree model, and pruning the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set; Determining whether the target industrial control program is credible by using the target decision tree; The method further comprises: Obtain the system call information corresponding to the industrial control program during the historical system call to obtain the historical system call information; Preprocessing the historical system call information to obtain the training set; Inputting the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model; The preprocessing of the historical system call information to obtain the training set includes: Dividing the historical system call information according to preset system call attributes, and assigning weights to each of the historical system calls to obtain weighted historical system call data; The weighted historical system call data is used to calculate the sum of the system call weights of each system call attribute, and a target threat level value corresponding to the sum of the system call weights is determined according to a preset weight and threat level mapping table, and the target threat level value is used as the training set.

2. The trust measurement method according to claim 1, characterized in that: The preprocessing of the historical system call information to obtain the training set includes: Preprocessing is performed on data with preset problem types in the historical system call information to obtain the training set; the preset problem types include any one or more of data missing, data noise, data redundancy, data set imbalance and data duplication.

3. The trust measurement method according to claim 1, characterized in that: The step of inputting the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model comprises: Inputting the training set into the initial decision tree model constructed based on the CART algorithm, so that the initial decision tree model divides the training set according to a preset sample classification rule to obtain corresponding sample classification results; Calculating the Gini coefficients of the sample classification results respectively to obtain multiple sample Gini coefficients; Determine a minimum value from the multiple sample Gini coefficients, and use the system call attribute corresponding to the minimum value as a target attribute; An initial sample decision tree is constructed using the target attribute, and the initial sample decision tree is pruned to obtain the target decision tree model.

4. The trust measurement method according to claim 1, characterized in that: The preprocessing of the system call data to obtain preprocessed system call data includes: Dividing the system call data according to process control threat attributes, system control threat attributes, memory management threat attributes, and network management threat attributes to obtain process control threat attribute data, system control threat attribute data, memory management threat attribute data, and network management threat attribute data; assigning weights to the process control threat attribute, the system control threat attribute, the memory management threat attribute, and the network management threat attribute respectively to obtain corresponding multiple weighted threat attributes; Using the multiple weighted threat attributes, weighting the process control threat attribute data, the system control threat attribute data, the memory management threat attribute data, and the network management threat attribute data is performed to obtain corresponding weighted threat attribute data; Calculating the sum of the weighted threat attribute data corresponding to each threat attribute, and determining a target threat attribute value corresponding to the sum of the weights according to the weight-threat degree mapping table; Accordingly, inputting the pre-processed system call data into the trained target decision tree model includes: The target threat attribute value is input into the trained target decision tree model.

5. The credibility measurement method according to any one of claims 1 to 4, characterized in that: Before obtaining the call information related to the system call and obtaining the system call data, the method further includes: The system call is intercepted by a preset hook function.

6. A trust measurement device, characterized in that: Applied to industrial control systems, including: A data acquisition module is used to acquire call information related to the system call when a system call for a target industrial control program is monitored, thereby obtaining system call data; A data preprocessing module, configured to preprocess the system call data to obtain preprocessed system call data; A decision tree generation module is used to input the preprocessed system call data into the trained target decision tree model to construct an initial decision tree through the target decision tree model, and prune the initial decision tree to obtain a target decision tree; the target decision tree model is a model obtained by training the initial decision tree model constructed based on the CART algorithm using the training set; a credibility judgment module, configured to judge whether the target industrial control program is credible through the target decision tree; The device further comprises: An information acquisition unit is used to acquire system call information corresponding to the industrial control program during historical system calls, thereby obtaining historical system call information; A first preprocessing unit, configured to preprocess the historical system call information to obtain the training set; A first model training unit is used to input the training set into the initial decision tree model constructed based on the CART algorithm for training to obtain the target decision tree model; The first pre-processing unit includes: A first dividing unit, configured to divide the historical system call information according to preset system call attributes; a first weighting unit, configured to assign a weight to each of the historical system calls to obtain weighted historical system call data; A training set acquisition unit is used to use the weighted historical system call data to calculate the sum of the system call weights of each system call attribute, and determine the target threat level value corresponding to the sum of the system call weights according to a preset weight and threat level mapping table, and use the target threat level value as the training set.

7. An electronic device, characterized in that: The method comprises a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the trust measurement method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the trust measurement method according to any one of claims 1 to 5 is implemented.

Images