Industrial control risk assessment method, device, equipment and storage medium

Abstract

The application is suitable for the field of industrial control technology, and provides an industrial control risk assessment method, device, equipment and storage medium, wherein the method comprises the following steps: based on industrial control equipment networking information, an industrial control simulation system is configured and generated; based on industrial control network control information, an industrial control network virtual target range is configured and generated; a data transmission relationship between the industrial control network virtual target range and the industrial control simulation system is established; according to a risk assessment task, a risk assessment operation under a set risk assessment scene is executed in the industrial control network virtual target range and the industrial control simulation system with the data transmission relationship, and a risk assessment result is generated. The scheme can ensure stable operation of a production environment, and improve the convenience and safety of risk assessment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control, and particularly relates to an industrial control risk assessment method and device, equipment and a storage medium. BACKGROUND

[0002] In recent years, the security problem of industrial control systems has become increasingly serious, and various network attack events targeting industrial control systems have occurred frequently. With the development strategy of industrial 'Internet+' proposed in China, it is more important to strengthen the research on the security problem of industrial control systems and strengthen the security protection measures of industrial control systems. The national regulatory departments, industry management departments and enterprises themselves are also increasing their attention to the security of industrial control systems.

[0003] Therefore, it is necessary to perform risk assessment on the network devices, computer devices, software, other assets and management security associated with the industrial control system or software.

[0004] The industrial control system or software is in the core area of enterprise production, and is related to the production and data security of the enterprise. At the same time, it is also the weakest area of network security of industrial internet enterprises. When performing risk assessment on the industrial control system in the production environment, it is not possible to completely avoid the impact on the field industrial control environment and production operation environment even under the operation of professional personnel, and serious problems may cause production safety accidents.

[0005] Therefore, how to perform effective industrial control risk assessment while minimizing the interference with the actual production environment is a problem to be solved. SUMMARY

[0006] The embodiments of the application provide an industrial control risk assessment method, device, equipment and storage medium to solve the problem of how to perform effective industrial control risk assessment while minimizing the interference with the actual production environment in the prior art.

[0007] The first aspect of the embodiments of the application provides an industrial control risk assessment method, comprising:

[0008] Based on the networking information of the industrial control device, an actual industrial control simulation system is configured and generated, and the actual industrial control simulation system comprises industrial control simulation devices and the networking relationship between the industrial control simulation devices;

[0009] Based on the industrial control network control information, an industrial control network virtual target range is configured and generated, and the industrial control network virtual target range is configured with an industrial control network control system to be evaluated;

[0010] A data transmission relationship between the industrial control network virtual target range and the actual industrial control simulation system is established;

[0011] According to the risk assessment task, a risk assessment operation in a set risk assessment scene is performed in the industrial control network virtual target range and the real industrial control simulation system established with the data transmission relationship, and a risk assessment result is generated.

[0012] Optionally, the real industrial control simulation system is configured and generated based on the industrial control device networking information, and the method comprises the following steps.

[0013] The industrial control device networking information is parsed to determine the industrial control real device and the networking relationship between the industrial control real devices.

[0014] The industrial control simulation device corresponding to the industrial control real device is matched.

[0015] The industrial control simulation device and the networking relationship between the industrial control simulation devices are configured to obtain the real industrial control simulation system.

[0016] Optionally, the industrial control simulation device and the networking relationship between the industrial control simulation devices are configured to obtain the real industrial control simulation system, and the method comprises the following steps.

[0017] The industrial control simulation device and the networking relationship between the industrial control simulation devices are configured to obtain a preliminary industrial control simulation system.

[0018] The preliminary industrial control simulation system is compared with the real industrial control system in structure, and in the case where the configuration structure of the preliminary industrial control simulation system is consistent with that of the real industrial control system, the preliminary industrial control simulation system is determined as the real industrial control simulation system.

[0019] Optionally, the industrial control network virtual target range is configured and generated based on the industrial control network control information, and the method comprises the following steps.

[0020] The network target range system is configured based on the network target range hardware environment.

[0021] The industrial control network control system to be evaluated is created in the network target range system to obtain the industrial control network virtual target range, and the industrial control network control system is used to implement industrial control of the industrial control simulation device.

[0022] Optionally, the risk assessment operation in a set risk assessment scene is performed in the industrial control network virtual target range and the real industrial control simulation system established with the data transmission relationship according to the risk assessment task, and the risk assessment result is generated, and the method comprises the following steps.

[0023] According to the risk assessment task, risk test data is input into the industrial control network virtual target range or the real industrial control simulation system, and based on the data transmission relationship, test result collection is performed on the industrial control network virtual target range and the real industrial control simulation system to obtain a risk assessment data sample.

[0024] According to the set risk analysis dimension, the risk assessment data sample is analyzed to obtain the risk assessment result.

[0025] Optionally, the risk assessment result is obtained by analyzing the risk assessment data sample according to the set risk analysis dimension, and the method comprises the following steps of:

[0026] According to the set risk analysis dimension, the risk assessment data sample is analyzed to obtain the risk assessment result.

[0027] According to the set risk analysis dimension, the risk assessment data sample is analyzed to obtain the risk assessment result.

[0028] The second aspect of the embodiment of the application provides an industrial control risk assessment device, which comprises:

[0029] The first configuration module is configured to generate a physical industrial control simulation system based on industrial control device networking information, wherein the physical industrial control simulation system comprises industrial control simulation devices and networking relationships between the industrial control simulation devices.

[0030] The second configuration module is configured to generate an industrial control network virtual target field based on industrial control network control information, wherein the industrial control network virtual target field is configured with an industrial control network control system to be evaluated.

[0031] The relationship establishment module is configured to establish a data transmission relationship between the industrial control network virtual target field and the physical industrial control simulation system.

[0032] The risk assessment module is configured to perform a risk assessment operation in a set risk assessment scene in the industrial control network virtual target field and the physical industrial control simulation system with the established data transmission relationship according to a risk assessment task, and generate a risk assessment result.

[0033] Optionally, the first configuration module is specifically configured to:

[0034] The industrial control device networking information is parsed to determine industrial control physical devices and networking relationships between the industrial control physical devices.

[0035] The industrial control simulation devices corresponding to the industrial control physical devices are matched.

[0036] The industrial control simulation devices and the networking relationships between the industrial control simulation devices are configured to obtain the physical industrial control simulation system.

[0037] The third aspect of the embodiments of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to the first aspect when executing the computer program.

[0038] The fourth aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the method according to the first aspect when executed by a processor.

[0039] The fifth aspect of the present application provides a computer program product, which, when executed on a computer device, causes the computer device to perform the steps of the method according to the first aspect.

[0040] As can be seen from the above, in the embodiments of the present application, by means of the physical industrial control simulation system generated by configuration and the industrial control network virtual target range, networking simulation of actual industrial control hardware devices in a real production environment is realized, and simulation of the industrial control network control system, which is a software control system, in the industrial control network virtual target range is realized, and a data transmission relationship between the industrial control network virtual target range and the physical industrial control simulation system is established. The industrial control risk assessment work can be carried out without the field production environment, and no interference or loss is caused to the production environment. The stability of the production environment is ensured, and the convenience and safety of the risk assessment are improved. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0042] Figure 1 is a flow of an industrial control risk assessment method provided by the embodiments of the present application Figure 1 ;

[0043] Figure 2 is a flow of an industrial control risk assessment method provided by the embodiments of the present application Figure 2 ;

[0044] Figure 3 is a schematic diagram of a physical industrial control simulation system provided by the embodiments of the present application

[0045] Figure 4 is a schematic diagram of a network target range architecture provided by the embodiments of the present application

[0046] Figure 5is a structural diagram of an industrial control risk assessment device provided by an embodiment of the present application;

[0047] Figure 6 is a structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0048] In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular sequences of steps, techniques, etc., in order to provide a thorough understanding of the present embodiments. However, it will be apparent to those skilled in the art that the present embodiments can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, and circuits are omitted so as not to obscure the description of the present embodiments.

[0049] It is to be understood that the terminology "includes", "has", "holds", "contains" and / or "comprising", when used in this specification and in the following claims, indicates the presence of the described features, integers, steps, operations, elements, and / or components but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0050] It is also to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used in this specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0051] It will be further understood that the terms "and / or", "including", "comprising" when used in this specification and in the following claims, specify the presence of features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0052] As used in this specification and the appended claims, the term "if' can be construed to mean "when" or "upon" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be construed to mean "upon determining" or "in response to determining" or "upon [the described condition or event] being detected" or "in response to [the described condition or event] being detected", depending on the context.

[0053] In specific implementations, the computer devices described in the embodiments of this application include, but are not limited to, other portable devices such as mobile phones, laptop computers, or tablet computers with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads). It should also be understood that in some embodiments, the device is not a portable communication device, but a desktop computer with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads).

[0054] The following discussion describes computer devices including displays and touch-sensitive surfaces. However, it should be understood that computer devices may include one or more other physical user interface devices such as physical keyboards, mice, and / or joysticks.

[0055] Computer devices support a variety of applications, such as one or more of the following: drawing applications, presentation applications, word processing applications, website creation applications, disc burning applications, spreadsheet applications, game applications, telephone applications, video conferencing applications, email applications, instant messaging applications, exercise support applications, photo management applications, digital camera applications, digital camcorder applications, web browsing applications, digital music player applications, and / or digital video player applications.

[0056] Various applications that can run on a computer device can use at least one common physical user interface device, such as a touch-sensitive surface. One or more functions of the touch-sensitive surface and the corresponding information displayed on the computer device can be adjusted and / or changed between and / or within applications. In this way, the common physical architecture of the computer device (e.g., the touch-sensitive surface) can support various applications with user interfaces that are intuitive and transparent to the user.

[0057] It should be understood that the sequence number of each step in this embodiment does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application embodiment.

[0058] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0059] See Figure 1 , Figure 1 This is a flowchart of an industrial control system risk assessment method provided in an embodiment of this application. Figure 1 .like Figure 1 As shown, an industrial control system risk assessment method includes the following steps:

[0060] Step 101: Based on the network information of industrial control equipment, configure and generate a physical industrial control simulation system.

[0061] The real object industrial control simulation system comprises the industrial control simulation devices and the networking relationship between the industrial control simulation devices.

[0062] The process is that the industrial control simulation devices are real devices corresponding to the industrial control real devices. The industrial control simulation devices and the networking relationship between the industrial control simulation devices are configured to generate the real object industrial control simulation system.

[0063] Specifically, in specific implementation, the industrial control simulation devices corresponding to the industrial control real devices can comprise real devices consistent with the production environment simulated from the field basic device layer, the field control device layer and the process control device layer. The process flow of the production environment industrial control system is reproduced to improve the accuracy of the risk assessment result and the influence or damage caused by the risk can be intuitively verified.

[0064] The industrial control simulation devices can be computer devices or control devices internally implementing function simulation of the industrial control real devices.

[0065] In an optional embodiment, the industrial control device networking information is obtained by Figure 2 As shown in the figure, the step of configuring and generating the real object industrial control simulation system based on the industrial control device networking information comprises:

[0066] Step 201: Analyzing the industrial control device networking information to determine the industrial control real devices and the networking relationship between the industrial control real devices;

[0067] Step 202: Matching the industrial control simulation devices corresponding to the industrial control real devices;

[0068] Step 203: Configuring the industrial control simulation devices and the networking relationship between the industrial control simulation devices to obtain the real object industrial control simulation system.

[0069] In the above process, the industrial control device networking information can be configured based on the industrial control real devices and the networking relationship between the industrial control real devices contained in the real production environment.

[0070] In an implementation scenario, the industrial control device networking information is obtained by Figure 3 As shown in the figure, according to the deployment and field networking of each industrial control real device in the field industrial control system of an enterprise, six key process flows can be selected, and the network devices, computer devices, software and systems used in the actual production environment are restored, deployed and installed to realize the real simulation construction of the field device layer, the field control layer and the process control layer in the industrial control system architecture.

[0071] In the example of the present scheme, six common industrial control devices are selected (see Figure 3Siemens PLC (Programmable Logic Controller, Programmable Logic Controller) in the middle, Rolweier A-B PLC, Honeywell DCS (Distributed Control System, Distributed Control System), and Lixi DCS, DCS of Hitachi, DCS of Zhongkong), realize the simulation of the field control system of the process flow corresponding to the six kinds of industrial control equipment.

[0072] According to the network topology diagram corresponding to the industrial control physical equipment in the actual production environment, the hardware environment is built, so that the simulation environment reflected in the physical industrial control simulation system is consistent with the network architecture and system equipment of the production environment, and the hardware basis support of the risk assessment work is met.

[0073] Among them, the configuration of the industrial control simulation device and the networking relationship between the industrial control simulation devices obtains the physical industrial control simulation system, comprising:

[0074] The configuration of the industrial control simulation device and the networking relationship between the industrial control simulation devices obtains the preliminary industrial control simulation system.

[0075] The structure of the preliminary industrial control simulation system and the physical industrial control system is compared, and in the case where the configuration structure of the preliminary industrial control simulation system and the physical industrial control system is consistent, the preliminary industrial control simulation system is determined as the physical industrial control simulation system.

[0076] The networking relationship between the industrial control simulation devices, for example, is to transfer data through a switch, set up a firewall, and set up a series-parallel relationship between different industrial control simulation devices.

[0077] Step 102, based on the industrial control network control information, configure and generate an industrial control network virtual target field.

[0078] The industrial control network virtual target field can be used for attack and defense drills and can be configured with a software running environment under a given scene. Among them, the industrial control network virtual target field is configured with an industrial control network control system to be evaluated.

[0079] The industrial control network control system can specifically control the industrial control simulation devices in the physical industrial control simulation system. The control is, for example, operation such as running control, scheduling control, start-stop control, etc.

[0080] Among them, in an optional embodiment, the configuration and generation of the industrial control network virtual target field based on the industrial control network control information comprises:

[0081] Based on the network target field hardware environment, configure the network target field system;

[0082] The industrial control network control system to be evaluated is created in the network target range system, and the industrial control network virtual target range is obtained, and the industrial control network control system is used to realize industrial control on the industrial simulation equipment.

[0083] The network target range hardware environment includes hardware devices used to assemble the network target range system and network connection and hardware configuration of the hardware devices.

[0084] In the implementation process, the network target range is configured, and the network target range virtualization component function is used to reproduce the network devices, computer devices, software and systems of the production execution layer and the office management layer in the actual production environment of an enterprise, and the virtual simulation restoration deployment and installation are performed.

[0085] Based on the network target range hardware environment, the network devices, computer devices, software and systems in the field device layer, the field control layer and the process control layer of the production environment are reproduced.

[0086] Based on the network target range hardware environment, the network target range system is configured, and the network target range basic function can be realized. Figure 4 As shown in

[0087] The virtualization management module, the virtual device resource library, the component resource library and the scene construction module.

[0088] As shown in Figure 4 The target range business application system can also be realized in the network target range system, including a risk verification system, a risk assessment system, an attack and defense drilling system and a vulnerability mining system. Based on the target range business application system, the simulation and creation of the industrial control network control system to be evaluated are realized, and the risk assessment operation of the industrial control network control system to be evaluated can be carried out.

[0089] In Figure 4 , the target range basic function and the target range business application system contained in the network target range need to be implemented in cooperation with the basic support on the right side. The basic support corresponds to the physical industrial control simulation system, and the simulation of the real industrial control device scene in the actual production environment is realized.

[0090] Based on the virtualization host and the network capability of the network target range, the virtual host of the network devices and computer devices in the production execution layer and the office management layer is created, the virtual network connection is established, and the network devices, computer devices, software and systems in the production execution layer and the office management layer of the production environment of the enterprise are reproduced.

[0091] In step 103, the data transmission relationship between the industrial control network virtual target range and the physical industrial control simulation system is established.

[0092] The data transmission relationship specifically includes a data flow relationship, an output control relationship of an instruction, a feedback flow relationship of data, and the like.

[0093] The data transmission relationship between the physical industrial control simulation system and the industrial control network virtual target field can be configured through a TCP / IP (Transmission Control Protocol / Internet Protocol) protocol, an OPC (OLE for Process Control) protocol, and the like.

[0094] At step 104, in accordance with the risk assessment task, a risk assessment operation under a set risk assessment scene is performed in the industrial control network virtual target field and the physical industrial control simulation system having the data transmission relationship, and a risk assessment result is generated.

[0095] After the physical industrial control simulation system and the industrial control network virtual target field are generated, a risk assessment scene can be created, and according to a risk assessment requirement, a risk assessment operation is performed on the virtual network equipment, computer equipment, software, and system in the network target field and the network equipment, computer equipment, software, and system in the physical simulation in sequence, and a risk assessment report is generated.

[0096] In the present scheme, the risk assessment work on the network equipment, computer equipment, software, and system in the field device layer, field control layer, process control layer, production execution layer, and office management layer in the industrial control system architecture is implemented.

[0097] The process adopts a virtual-real combined industrial control risk assessment idea, improves the reproduction degree of the field industrial control system and environment, avoids interference to the field production environment caused by the risk assessment work, supports the non-disturbance risk assessment on the network equipment, computer equipment, software, and other assets involved in the risk assessment, achieves the purpose of non-disturbance risk assessment, and thus improves the accuracy of the risk assessment result under the condition of being separated from the real production environment.

[0098] The performed risk assessment operation is, for example, a simulation device operation control, a simulation vulnerability attack on the industrial control network control system to be evaluated, and the like.

[0099] In an optional implementation, the risk assessment operation in the set risk assessment scene is performed in the industrial control network virtual target range and the real industrial control simulation system having the data transmission relationship, and a risk assessment result is generated, including:

[0100] According to the risk assessment task, risk test data is input into the industrial control network virtual target range or the real industrial control simulation system, and based on the data transmission relationship, test result collection is performed on the industrial control network virtual target range and the real industrial control simulation system, and risk assessment data samples are obtained.

[0101] According to the set risk analysis dimension, data analysis is performed on the risk assessment data samples, and the risk assessment result is obtained.

[0102] The risk test data may be, for example, incorrect operation control parameters, attack data on vulnerabilities in the industrial control system, etc.

[0103] By setting different risk analysis dimensions, risk assessment of the industrial control network virtual target range and the real industrial control simulation system is realized according to the risk test data corresponding to the risk assessment task, and the comprehensiveness and accuracy of the assessment result are improved.

[0104] The risk assessment result is obtained by performing data analysis on the risk assessment data samples according to the set risk analysis dimension, including:

[0105] According to the set risk analysis dimension, data analysis is performed on the risk assessment data samples, and an assessment result item corresponding to each set risk analysis dimension is obtained.

[0106] The assessment result item is embedded into a corresponding display position of a set assessment display template, and the risk assessment result containing each assessment result item is generated.

[0107] The convenience of finally generating the risk assessment result and the readability of the assessment result are improved.

[0108] In specific applications, risk assessment analysis of the industrial control network control system to be evaluated is realized based on the real industrial control simulation system and the industrial control network virtual target range, and network device, computer device, software and system risk assessment in the virtual environment (production execution layer and office management layer) and the real simulation environment (field device layer, field control layer and process control layer) is sequentially completed, and a risk assessment report is generated.

[0109] In the embodiment of the present application, by means of the physical industrial control simulation system generated by configuration and the industrial control network virtual target range, networking simulation of actual industrial control hardware devices in the real production environment is realized, and simulation of the industrial control network control system, which is a software control system, in the industrial control network virtual target range is realized, and a data transmission relationship between the industrial control network virtual target range and the physical industrial control simulation system is established. The industrial control risk assessment work can be carried out without the field production environment, and no interference or loss is caused to the production environment. While ensuring the stable operation of the production environment, the convenience and safety of risk assessment are improved.

[0110] Referring to Figure 5 , Figure 5 is a structure diagram of an industrial control risk assessment device provided by the embodiment of the present application. Only parts related to the embodiment of the present application are shown for ease of description.

[0111] The industrial control risk assessment device 500 comprises:

[0112] A first configuration module 501 is configured to generate a physical industrial control simulation system based on industrial control device networking information, wherein the physical industrial control simulation system comprises industrial control simulation devices and networking relationships between the industrial control simulation devices.

[0113] A second configuration module 502 is configured to generate an industrial control network virtual target range based on industrial control network control information, wherein the industrial control network virtual target range is configured with an industrial control network control system to be evaluated.

[0114] A relationship establishment module 503 is configured to establish a data transmission relationship between the industrial control network virtual target range and the physical industrial control simulation system.

[0115] A risk assessment module 504 is configured to perform a risk assessment operation in a set risk assessment scene in the industrial control network virtual target range and the physical industrial control simulation system in which the data transmission relationship is established, according to a risk assessment task, to generate a risk assessment result.

[0116] The first configuration module 501 is specifically configured to:

[0117] Parse the industrial control device networking information to determine industrial control physical devices and networking relationships between the industrial control physical devices.

[0118] Match the industrial control simulation devices corresponding to the industrial control physical devices.

[0119] Configure the industrial control simulation devices and the networking relationships between the industrial control simulation devices to obtain the physical industrial control simulation system.

[0120] The first configuration module 501 is more specifically configured to:

[0121] Configure the industrial control simulation equipment and the networking relationship between the industrial control simulation equipment to obtain a preliminary industrial control simulation system;

[0122] The preliminary industrial control simulation system is structurally compared with the physical industrial control system. If the configuration structure of the preliminary industrial control simulation system and the physical industrial control system are consistent, the preliminary industrial control simulation system is identified as the physical industrial control simulation system.

[0123] The second configuration module 502 is specifically used for:

[0124] Configure the network range system based on the network range hardware environment;

[0125] The industrial control network control system to be evaluated is created in the network test range system to obtain the industrial control network virtual test range. The industrial control network control system is used to realize industrial control of the industrial control simulation equipment.

[0126] Among them, risk assessment module 504 is specifically used for:

[0127] According to the risk assessment task, the risk test data is input into the industrial control network virtual test range or the physical industrial control simulation system, and based on the data transmission relationship, the test results of the industrial control network virtual test range and the physical industrial control simulation system are collected to obtain risk assessment data samples;

[0128] Based on the established risk analysis dimensions, the risk assessment data sample is analyzed to obtain the risk assessment results.

[0129] Specifically, risk assessment module 504 is used for:

[0130] Based on the set risk analysis dimensions, the risk assessment data sample is analyzed to obtain assessment result items corresponding to each set risk analysis dimension;

[0131] The assessment result items are embedded into the corresponding display positions of the set assessment display template to generate the risk assessment result containing each of the assessment result items.

[0132] The industrial control risk assessment device provided in this application embodiment can realize all the processes of the above-described industrial control risk assessment method embodiment and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0133] Figure 6 This is a structural diagram of a computer device provided in an embodiment of this application. As shown in the figure, the computer device 6 of this embodiment includes: at least one processor 60 ( Figure 6The computer device 6 can be a desktop computer, a notebook computer, a palm computer, a cloud server, etc. The computer device 6 can include, but is not limited to, a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and executable on the processor 60, wherein the processor 60 implements the steps in any of the above method embodiments when executing the computer program 62.

[0134] The computer device 6 can be a desktop computer, a notebook computer, a palm computer, a cloud server, etc. The computer device 6 can include, but is not limited to, a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and executable on the processor 60, wherein the processor 60 implements the steps in any of the above method embodiments when executing the computer program 62. Figure 6 The computer device 6 is merely an example and does not constitute a limitation on the computer device 6, and can include more or fewer components than shown, or combine certain components, or include different components, for example, the computer device can also include an input / output device, a network access device, a bus, etc.

[0135] The processor 60 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0136] The memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or a memory of the computer device 6. The memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 61 can include both an internal storage unit and an external storage device of the computer device 6. The memory 61 is used to store the computer program and other programs and data required by the computer device. The memory 61 can also be used to temporarily store data that has been output or will be output.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be realized in the form of hardware or software. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0138] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0139] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0140] In the embodiments provided in the present application, it should be understood that the disclosed devices / computer equipment and methods can be implemented in other ways. For example, the device / computer equipment embodiments described above are only schematic, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed each other can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0141] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0142] In addition, each of the function units in each of the embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0143] The integrated module / unit, if realized in the form of a software function unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be implemented by a computer program instructing related hardware to complete, and the computer program can be stored in a computer-readable storage medium. The computer program can implement the steps of each method embodiment when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms. The computer-readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the computer-readable medium can include appropriate contents according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0144] The above-mentioned embodiment methods can also be implemented by a computer program product, which, when running on a computer device, causes the computer device to execute the steps of the above-mentioned embodiment methods.

[0145] The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for assessing industrial control system risks, characterized in that, include: Based on the network information of industrial control equipment, a physical industrial control simulation system is configured and generated. The physical industrial control simulation system includes industrial control simulation equipment and the network relationship between the industrial control simulation equipment. Configure the network range system based on the network range hardware environment; An industrial control network control system to be evaluated is created in the network test range system to obtain an industrial control network virtual test range. The industrial control network control system is used to realize industrial control of the industrial control simulation equipment. Establish the data transmission relationship between the virtual test range of the industrial control network and the physical industrial control simulation system; In accordance with the risk assessment task, risk assessment operations are performed in the industrial control network virtual test range and the physical industrial control simulation system that have established the data transmission relationship, under the set risk assessment scenario, and risk assessment results are generated.

2. The method according to claim 1, characterized in that, The configuration and generation of a physical industrial control simulation system based on the industrial control equipment networking information includes: The network information of the industrial control equipment is analyzed to determine the physical industrial control equipment and the network relationship between the physical industrial control equipment; Match the industrial control simulation equipment to the corresponding industrial control physical equipment; Configure the industrial control simulation equipment and the networking relationship between the industrial control simulation equipment to obtain the physical industrial control simulation system.

3. The method according to claim 2, characterized in that, The configuration of the industrial control simulation equipment and the networking relationship between the industrial control simulation equipment to obtain the physical industrial control simulation system includes: Configure the industrial control simulation equipment and the networking relationship between the industrial control simulation equipment to obtain a preliminary industrial control simulation system; The preliminary industrial control simulation system is structurally compared with the physical industrial control system. If the configuration structure of the preliminary industrial control simulation system and the physical industrial control system are consistent, the preliminary industrial control simulation system is identified as the physical industrial control simulation system.

4. The method according to claim 1, characterized in that, The step involves performing a risk assessment operation under a set risk assessment scenario in the industrial control network virtual test range and the physical industrial control simulation system, which have established the data transmission relationship, according to the risk assessment task, and generating risk assessment results, including: According to the risk assessment task, the risk test data is input into the industrial control network virtual test range or the physical industrial control simulation system, and based on the data transmission relationship, the test results of the industrial control network virtual test range and the physical industrial control simulation system are collected to obtain risk assessment data samples; Based on the established risk analysis dimensions, the risk assessment data sample is analyzed to obtain the risk assessment results.

5. The method according to claim 4, characterized in that, The step of analyzing the risk assessment data sample according to the set risk analysis dimensions to obtain the risk assessment result includes: Based on the set risk analysis dimensions, the risk assessment data sample is analyzed to obtain assessment result items corresponding to each set risk analysis dimension; The assessment result items are embedded into the corresponding display positions of the set assessment display template to generate the risk assessment result containing each of the assessment result items.

6. An industrial control risk assessment device, characterized in that, include: The first configuration module is used to configure and generate a physical industrial control simulation system based on the network information of the industrial control equipment. The physical industrial control simulation system includes industrial control simulation equipment and the network relationship between the industrial control simulation equipment. The second configuration module is used to configure the network range system based on the network range hardware environment, create an industrial control network control system to be evaluated in the network range system, and obtain an industrial control network virtual range. The industrial control network control system is used to realize industrial control of the industrial control simulation equipment. The relationship establishment module is used to establish the data transmission relationship between the industrial control network virtual test range and the physical industrial control simulation system. The risk assessment module is used to perform risk assessment operations under a set risk assessment scenario in the industrial control network virtual test range and the physical industrial control simulation system that have established the data transmission relationship, in accordance with the risk assessment task, and generate risk assessment results.

7. The apparatus according to claim 6, characterized in that, The first configuration module is specifically used for: The network information of the industrial control equipment is analyzed to determine the physical industrial control equipment and the network relationship between the physical industrial control equipment; Match the industrial control simulation equipment to the corresponding industrial control physical equipment; Configure the industrial control simulation equipment and the networking relationship between the industrial control simulation equipment to obtain the physical industrial control simulation system.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 5.

Images