Network security analysis methods and systems

Abstract

This invention provides a network security analysis method and system. The method includes: querying a pre-built multi-source threat intelligence database to determine if a threat coefficient for a corresponding industrial control system exists; if not, acquiring all access IP data of the industrial control system and identifying active IPs; clustering the active IPs, performing attribute analysis on the obtained IP clusters, and obtaining the threat coefficient of the IP clusters; calculating a first network security score for the industrial control system based on the threat coefficient; if a threat coefficient exists, converting the queried threat coefficient of the industrial control system into a second network security score for the industrial control system according to the correspondence between the threat coefficient and the network security score of the industrial control system; and issuing a security alarm for industrial control systems whose first or second network security score is higher than a preset network security threshold. This method enables the management of threat intelligence for industrial control equipment and improves data reliability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security analysis method and system. Background Technology

[0002] As an extension and expansion of traditional information systems, industrial control systems have adopted many security measures that are widely used in the field of information technology and have proven to be effective.

[0003] In existing technologies, security measures include industrial firewalls and industrial control honeypots. Because industrial control systems have many characteristics that differ from traditional information systems, industrial firewalls need to support proprietary protocols within the industrial control system (such as DNP3, ICCP, Modbus, etc.) and the harsh environments of industrial control sites, such as high temperatures and humidity. Unlike traditional information systems, in industrial control scenarios, honeypots often simulate a PLC, RTU, or a specific control system (such as DCS, SCADA, etc.).

[0004] Therefore, it can be seen that, due to the many characteristics of industrial control systems that are different from traditional information systems, existing security measures often need to be adjusted and improved to adapt to the application needs and environment of the industrial control field. Moreover, the existing security measures have insufficient consideration for network security due to the large number of proprietary protocols and specifications, lack audit management of threat intelligence for industrial control equipment, and the data sources are unreliable. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a network security analysis method and system to solve the problems of insufficient consideration for network security, lack of audit management of threat intelligence for industrial control equipment, and unreliable data sources in the prior art.

[0006] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0007] The first aspect of this invention discloses a network security analysis method, the method comprising:

[0008] Query whether the corresponding threat coefficient of the industrial control system exists in the pre-built multi-source threat intelligence database;

[0009] If not, obtain all access IP data of the industrial control system, and analyze the activity of the IPs based on the access IP data to determine the active IPs;

[0010] The active IPs are clustered, and the resulting IP clusters are analyzed for attributes to obtain the threat coefficient of the IP clusters.

[0011] Calculate the first network security score of the industrial control system based on the threat coefficient;

[0012] If it exists, based on the correspondence between the threat coefficient and the network security score of the industrial control system, the queried threat coefficient of the industrial control system is converted into a second network security score of the industrial control system.

[0013] The first network security score or the second network security score is compared with a preset network security threshold, and a security alarm is issued for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

[0014] Optionally, the step of acquiring all access IP data of the industrial control system and analyzing the activity of the IPs based on the access IP data to determine active IPs includes:

[0015] Based on a multi-source security threat intelligence database, all access IPs of the industrial control system and the Uniform Resource Locator URLs connected to the access IPs are obtained, and there is a mapping relationship between the access IPs and the URLs connected to the access IPs.

[0016] The activity level of the accessing IP is obtained based on the access cycle of the accessing IP to the industrial control system;

[0017] If the activity level is low, the accessing IP is determined to be an inactive IP, and the accessing IP is filtered out.

[0018] If the activity level is high, the accessing IP is determined to be an active IP.

[0019] Optionally, the step of clustering the active IPs and performing attribute analysis on the resulting IP clusters to obtain the threat coefficient of the IP clusters includes:

[0020] The active IP is parsed to obtain the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs;

[0021] Based on the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs, the active IP is clustered to obtain multiple IP clusters;

[0022] For each IP cluster, an access method analysis is performed on the IP cluster to obtain the access method of the IP cluster, which includes benevolent access method and threatening access method;

[0023] Based on the access method, the type of the IP cluster and the type of the URL accessing the IP connection in the IP cluster are determined. The type of the IP cluster includes benevolent IP clusters and threatening IP clusters, and the type of the URL includes benevolent URLs and threatening URLs.

[0024] Perform time feature analysis on the IP clusters to obtain the time features of the IP clusters, which include the total access duration and the duration of a single access.

[0025] Spatial feature analysis is performed on the IP clusters to obtain the spatial features of the IP clusters. The spatial features include at least the geographical distribution of the accessing IPs, the network segment distribution, and the URL connectivity. The URL connectivity refers to the URLs connected to the accessing IPs in the IP clusters and the connectivity of the URLs connected to the accessing IPs.

[0026] Operational feature analysis is performed on the IP clusters to obtain the operational features of the IP clusters. The operational features include at least legal operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program downloading, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification.

[0027] The threat coefficient of the IP cluster is obtained based on the type of the URL, the time characteristics, the spatial characteristics, and the operational characteristics.

[0028] Optionally, calculating the first cybersecurity score of the industrial control system based on the threat coefficient includes:

[0029] Based on the threat coefficient of the IP clusters, the number of threatening IP clusters and the number of benevolent IP clusters in the IP clusters of the industrial control system are obtained;

[0030] Based on the number of threat IP clusters, the number of benevolent IP clusters, and the threat coefficient of the IP clusters, a first network security score for the industrial control system is calculated, wherein the first network security score is the sum of the weighted threat coefficients of the threat IP clusters.

[0031] Optional, also includes:

[0032] The threat coefficients of the IP clusters are matched with the threat coefficients in the existing threat intelligence data. The existing threat intelligence data includes at least commercial threat intelligence data, open source threat intelligence data, publicly available industrial control system threat information sets on the Internet, industrial control system threat trapping datasets, and audited and labeled result data.

[0033] If the threat coefficient of the IP cluster matches the threat coefficient in the existing threat intelligence data, the data of the threat coefficient of the IP cluster is determined to be correct, and the threat coefficient of the approved IP cluster is obtained.

[0034] If the threat coefficient of any IP cluster does not match the threat coefficient in the existing threat intelligence data, the data for the threat coefficient of the IP cluster is determined to be incorrect, and the threat coefficient of the IP cluster that fails the review is obtained.

[0035] Optionally, after obtaining the threat coefficients of the approved IP clusters and the unapproved IP clusters, the method further includes:

[0036] The threat coefficients of the approved IP clusters are added to the multi-source threat intelligence database, and the threat coefficients of the unapproved IP clusters are backed up to the pre-built threat intelligence database awaiting re-approval.

[0037] A second aspect of this invention discloses a network security analysis system, the system comprising:

[0038] The query module is used to query whether the corresponding threat coefficient of the industrial control system exists in the pre-built multi-source threat intelligence database. If it does not exist, the first processing module is executed; if it exists, the second processing module is executed.

[0039] The first processing module is used to acquire all access IP data of the industrial control system, analyze the activity of the IPs based on the access IP data, and determine the active IPs; cluster the active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters; and calculate the first network security score of the industrial control system based on the threat coefficient.

[0040] The second processing module is used to convert the queried threat coefficient of the industrial control system into a second network security score of the industrial control system based on the correspondence between the threat coefficient and the network security score of the industrial control system.

[0041] The comparison and alarm module is used to compare the first network security score or the second network security score with a preset network security threshold, and to issue a security alarm for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

[0042] Optionally, the first processing module for acquiring all access IP data of the industrial control system, analyzing the activity of IPs based on the access IP data, and determining active IPs includes:

[0043] The acquisition unit is used to acquire all access IPs of the industrial control system and the Uniform Resource Locator URLs connected to the access IPs based on a multi-source security threat intelligence database, wherein there is a mapping relationship between the access IPs and the URLs connected to the access IPs.

[0044] The obtaining unit is used to obtain the activity level of the accessing IP based on the access cycle of the accessing IP to the industrial control system;

[0045] The first determining unit is configured to determine the accessing IP as an inactive IP if the activity level is low, and to filter the accessing IP.

[0046] The second determining unit is used to determine the accessing IP as an active IP if the activity level is high activity level.

[0047] Optionally, the first processing module for clustering the active IPs, performing attribute analysis on the obtained IP clusters, and obtaining the threat coefficient of the IP clusters includes:

[0048] The parsing unit is used to parse the active IP to obtain the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs.

[0049] The clustering unit is used to cluster the active IPs based on the mapping relationship between the active IPs and the URLs connected to the active IPs, the network segment where the active IPs are located, and the region to which the active IPs belong, to obtain multiple IP clusters.

[0050] The first analysis unit is used to analyze the access methods of each IP cluster to obtain the access methods of the IP cluster, including benevolent access methods and threatening access methods.

[0051] The determining unit is configured to determine the type of the IP cluster and the type of the URL accessing the IP connection in the IP cluster based on the access method. The type of the IP cluster includes benevolent IP clusters and threatening IP clusters, and the type of the URL includes benevolent URLs and threatening URLs.

[0052] The second analysis unit is used to perform time feature analysis on the IP clusters to obtain the time features of the IP clusters, including the total access duration and the single access duration.

[0053] The third analysis unit is used to perform spatial feature analysis on the IP clusters to obtain the spatial features of the IP clusters. The spatial features include at least the geographical distribution of the accessing IPs, the network segment distribution, and the URL connectivity. The URL connectivity refers to the URLs connected to the accessing IPs in the IP clusters and the connectivity of the URLs connected to the accessing IPs.

[0054] The fourth analysis unit is used to perform operational feature analysis on the IP clusters to obtain the operational features of the IP clusters. The operational features include at least legal operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program downloading, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification.

[0055] The unit is used to obtain the threat coefficient of the IP cluster based on the type of the URL, the time feature, the spatial feature, and the operation feature.

[0056] Based on the above embodiments of the present invention, a network security analysis method and system are provided. The method includes: querying a pre-built threat intelligence database to determine if a threat coefficient corresponding to an industrial control system exists; if not, acquiring all access IP data of the industrial control system and analyzing the activity of the IPs based on the access IP data to determine active IPs; clustering the active IPs and performing attribute analysis on the obtained IP clusters to obtain the threat coefficient of the IP clusters; calculating a first network security score for the industrial control system based on the threat coefficient; if it exists, converting the queried threat coefficient of the industrial control system into a second network security score for the industrial control system according to the correspondence between the threat coefficient and the network security score of the industrial control system; comparing the first network security score or the second network security score with a preset network security threshold, and issuing a security alarm for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold. In this solution, when a threat coefficient for a corresponding industrial control system is not found in the threat intelligence database, the active IPs in the acquired access IP data are clustered to obtain IP clusters. Attribute analysis is then performed to obtain the threat coefficient of each IP cluster, and a first network security score for the industrial control system is calculated. When a threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the threat coefficient is converted into a second network security score based on the correspondence between the threat coefficient and the network security score of the industrial control system. Security alerts are then issued to industrial control systems whose first or second network security scores exceed a preset network security threshold. This allows for the management of threat intelligence for industrial control equipment and improves data reliability. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0058] Figure 1 A flowchart illustrating a network security analysis method provided in an embodiment of the present invention;

[0059] Figure 2 A network security analysis framework diagram for an industrial control system provided in this embodiment of the invention;

[0060] Figure 3 A schematic diagram of a process for determining an active IP address is provided in an embodiment of the present invention;

[0061] Figure 4 This is a schematic diagram illustrating the preprocessing of obtaining the access IP and the URL of the access IP connection, provided by an embodiment of the present invention.

[0062] Figure 5 This is a flowchart illustrating the attribute analysis of the obtained IP clusters provided in an embodiment of the present invention.

[0063] Figure 6 This is a schematic diagram of IP clustering provided in an embodiment of the present invention;

[0064] Figure 7 This is a schematic diagram illustrating threat intelligence generation as provided in an embodiment of the present invention;

[0065] Figure 8 A schematic flowchart illustrating the calculation of a first network security score for an industrial control system, provided as an embodiment of the present invention;

[0066] Figure 9 This is a schematic diagram of the structure of a network security analysis system provided in an embodiment of the present invention. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein.

[0070] As can be seen from the background technology, existing security measures suffer from insufficient consideration of network security due to the large variety of proprietary protocols and standards, lack of audit management of threat intelligence for industrial control equipment, and unreliable data sources.

[0071] Therefore, this invention provides a network security analysis method and system. When a threat coefficient for a corresponding industrial control system is not found in the threat intelligence database, the active IPs in the acquired access IP data are clustered to obtain IP clusters and their attributes are analyzed to obtain the threat coefficients of the IP clusters. A first network security score for the industrial control system is then calculated. When a threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the threat coefficient is converted into a second network security score for the industrial control system based on the correspondence between the threat coefficient and the network security score of the industrial control system. Security alerts are issued to industrial control systems whose first or second network security scores are higher than a preset network security threshold. This enables the management of threat intelligence for industrial control equipment and improves data reliability.

[0072] like Figure 1 The diagram shown is a flowchart illustrating a network security analysis method provided in an embodiment of the present invention.

[0073] It should be noted that this network security analysis method can be applied to industrial control systems whose network security needs to be verified.

[0074] This method mainly includes the following steps:

[0075] Step S101: Query whether there is a threat coefficient for the corresponding industrial control system in the pre-built multi-source threat intelligence database. If not, proceed to step S102; if yes, proceed to step S105.

[0076] In the specific implementation of step S101, when it is necessary to perform network security analysis on an industrial control system whose network security needs to be confirmed, firstly, it is necessary to query whether there is a threat coefficient corresponding to the industrial control system in the pre-established multi-source threat intelligence database. If it does not exist, step S102 is executed. If it exists, the queried threat coefficient corresponding to the industrial control system is output, and step S105 is executed.

[0077] Step S102: Obtain all access IP data of the industrial control system, and analyze the activity of IPs based on the access IP data to determine active IPs.

[0078] In the specific implementation step S102, when it is found that there is no threat coefficient for the corresponding industrial control system in the multi-source threat intelligence database, all access IP data that have accessed the industrial control system are obtained. The activity level of the IPs in the access IP data is analyzed using the access IP data to obtain the activity level of the IPs. Based on the activity level of the IPs, the active IPs are determined.

[0079] Step S103: Cluster the active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters.

[0080] In step S103, attribute analysis includes, but is not limited to, the analysis of IP clusters in terms of access methods, time characteristics, spatial characteristics, and threat coefficients.

[0081] In the specific implementation step S103, active IPs are clustered to obtain multiple IP clusters. For each IP cluster, attribute analysis is performed to obtain the threat coefficient of the IP cluster.

[0082] Step S104: Calculate the first network security score of the industrial control system based on the threat coefficient.

[0083] In the specific implementation step S104, the network security score of the industrial control system is calculated using the threat coefficient to obtain the first network security score of the industrial control system.

[0084] Step S105: Based on the correspondence between the threat coefficient and the network security score of the industrial control system, convert the queried threat coefficient of the industrial control system into a second network security score of the industrial control system.

[0085] In the specific implementation of step S105, when a threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the threat coefficient of the industrial control system is output. Based on the correspondence between the threat coefficient and the network security score of the industrial control system, the threat coefficient of the industrial control system is converted to obtain the second network security score of the industrial control system.

[0086] Step S106: Compare the first network security score or the second network security score with the preset network security threshold respectively, and issue a security alarm for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

[0087] In the specific implementation step S106, after obtaining the first network security score or the second network security score, the obtained first network security score or the second network security score is compared with the preset network security threshold, and a security alarm is issued for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

[0088] Optionally, in one specific embodiment, high-risk IPs, IP access times, and IP access regions are statistically analyzed to obtain an IP security report, and security alarms are issued to the industrial control system based on the IP security report.

[0089] To better understand the network security analysis methods described above, such as Figure 2 The diagram shown is a network security analysis framework diagram of an industrial control system provided by an embodiment of the present invention.

[0090] exist Figure 2 First, check if the corresponding threat coefficient for the industrial control system exists in the multi-source threat intelligence database.

[0091] If it exists, output the threat coefficient of the industrial control system found in the query. Update the multi-source threat intelligence database with the threat coefficient of the industrial control system found in the query. Based on the correspondence between the threat coefficient and the network security score of the industrial control system, convert the threat coefficient of the industrial control system found in the query into a second network security score of the industrial control system.

[0092] If not, obtain access IP data for all IPs that have accessed the industrial control system, analyze the activity of the IPs based on the access IP data, identify active IPs, cluster the active IPs to obtain multiple IP clusters, perform attribute analysis on each IP cluster to obtain the threat coefficient of the IP cluster, and calculate the first network security score of the industrial control system based on the threat coefficient.

[0093] Next, the obtained first network security score or second network security score is compared with the preset network security threshold, and a security alarm is issued for industrial control systems whose first network security score or second network security score is higher than the preset network security threshold.

[0094] Based on the network security analysis method provided by this invention, when no threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the active IPs in the acquired access IP data are clustered to obtain IP clusters and perform attribute analysis to obtain the threat coefficient of the IP clusters and calculate the first network security score of the industrial control system. When a threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the threat coefficient of the industrial control system is converted into a second network security score based on the correspondence between the threat coefficient and the network security score of the industrial control system. Security alarms are issued for industrial control systems whose first or second network security scores are higher than a preset network security threshold, thereby enabling the management of threat intelligence for industrial control equipment and improving data reliability.

[0095] Based on the network security analysis method provided in the above embodiments of the present invention, step S102 involves obtaining all access IP data of the industrial control system, analyzing the activity of IPs based on the access IP data, and determining the active IPs, as follows: Figure 3 The diagram illustrates a process for determining an active IP address according to an embodiment of the present invention, which mainly includes the following steps:

[0096] Step S301: Based on the multi-source security threat intelligence database, obtain all access IPs and URLs (Uniform Resource Locators) of the industrial control system.

[0097] In step S301, there is a mapping relationship between the access IP and the URL of the access IP connection.

[0098] In the specific implementation step S301, the existing multi-source security threat intelligence database is used to obtain all access IPs and URLs of access IP connections that have accessed the industrial control system.

[0099] It should be noted that after obtaining all access IPs and URLs of access IP connections that have accessed the industrial control system using a multi-source security threat intelligence database, the obtained access IPs and URLs are preprocessed, specifically as follows: Figure 4 As shown.

[0100] exist Figure 4In this process, a multi-source security threat intelligence database is formed by aggregating commercial threat intelligence databases, open-source threat intelligence databases, publicly available industrial control system threat information sets on the Internet, industrial control system threat trapping datasets, and audited and tagged result data. Using the multi-source security threat intelligence database, the system obtains access IPs and URLs connected to those IPs, as well as their IP threat coefficients, to determine whether the access IPs and URLs connected to them pose a risk. If so, it determines that the current network security of the industrial control system is at risk, thereby enabling a prediction of the current network security of the industrial control system.

[0101] It should be noted that multi-source security threat intelligence database queries include, but are not limited to, threat systems, vulnerability database queries, website tampering, and IP reputation.

[0102] Step S302: Obtain the activity level of the accessing IP based on the access cycle of the accessing IP to the industrial control system.

[0103] In the specific implementation step S302, the activity level of the accessing IP is obtained based on the access cycle of the accessing IP to the industrial control system in history.

[0104] Step S303: Determine if the activity level is high. If yes, proceed to step S304; otherwise, proceed to step S305.

[0105] Step S304: Determine that the accessing IP is an active IP.

[0106] In the specific implementation step S304, the activity level of the accessing IP is determined to be high activity, and thus the accessing IP is determined to be an active IP.

[0107] Step S305: Determine that the accessing IP is an inactive IP and filter the accessing IP.

[0108] In the specific implementation step S305, the activity level of the accessing IP is determined to be low, thus determining that the accessing IP is an inactive IP and filtering out the accessing IP.

[0109] To illustrate the above, the access cycle for IP1 to access the industrial control system is 2 weeks, while the access cycle for IP2 to access the industrial control system is 1 week.

[0110] Based on the access cycles of IP1 and IP2 to the industrial control system, we can conclude that the activity level of IP1 is 14 days and that of IP2 is 7 days. Since the activity level of IP1 is greater than that of IP2, IP1 is considered an active IP due to its high activity level, while IP2 is considered an inactive IP due to its low activity level. Therefore, IP2 is filtered out.

[0111] According to the network security analysis method provided by the embodiments of the present invention, after obtaining the access IP and the URL connected to the access IP, the activity level of the access IP is analyzed. When the activity level of the access IP is determined to be high, the access IP is determined to be an active IP. When the activity level of the access IP is determined to be low, the access IP is determined to be an inactive IP, and inactive IPs are filtered out, thereby filtering out access IP data that does not meet the requirements and improving the accuracy of the data.

[0112] Based on the network security analysis method provided in the above embodiments of the present invention, the process of performing step S103 to cluster active IPs, performing attribute analysis on the obtained IP clusters, and obtaining the threat coefficient of the IP clusters is as follows: Figure 5 The diagram shown illustrates a flowchart of attribute analysis for obtained IP clusters according to an embodiment of the present invention, mainly including the following steps:

[0113] Step S501: Resolve the active IP to obtain the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs.

[0114] In the specific implementation step S501, the active IP is parsed to obtain the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs.

[0115] Step S502: Based on the mapping relationship between active IPs and the URLs connected to active IPs, the network segment where the active IPs are located, and the region to which the active IPs belong, cluster the active IPs to obtain multiple IP clusters.

[0116] Understandably, based on the mapping relationship between active IPs and the URLs connected to active IPs, the network segment where the active IPs are located, the region to which the active IPs belong, and the operational characteristics, it can be determined whether active IPs belong to the same IP cluster.

[0117] like Figure 6 The diagram shown is a schematic representation of IP clustering provided in an embodiment of the present invention.

[0118] exist Figure 6 In this process, based on the mapping relationship between IPs and the URLs connected to the IPs, the network segment where the IPs are located, the region to which the IPs belong, and the operational characteristics, all IPs are clustered to obtain multiple IP clusters.

[0119] Step S503: For each IP cluster, analyze the access methods of the IP cluster to obtain the access methods of the IP cluster.

[0120] In step S503, the access methods include benevolent access and threatening access.

[0121] Threatened access methods include access via malware, access via botnets, and access via threat URLs.

[0122] Step S504: Based on the access method, determine the type of IP cluster and the type of URL accessing the IP connection in the IP cluster.

[0123] In step S504, the types of IP clustering include benevolent IP clustering and threat IP clustering.

[0124] URLs can be categorized into benevolent URLs and threatening URLs.

[0125] In the specific implementation of step S504, if the access method of IP clustering is benign access, the IP clustering is determined as a benign IP clustering, and the benign URLs in the IP clustering are determined; if the access method of IP clustering is threatening access, the IP clustering is determined as a threatening IP clustering, and the threatening URLs in the IP clustering are determined.

[0126] Step S505: Perform time feature analysis on IP clusters to obtain the time features of IP clusters.

[0127] In step S505, the temporal characteristics of IP clustering include the total access duration and the duration of a single access.

[0128] Total access duration refers to the sum of the total time spent accessing the system via IP address.

[0129] The duration of a single access refers to the time period during which the IP address accesses the system.

[0130] Step S506: Perform spatial feature analysis on IP clusters to obtain the spatial features of IP clusters.

[0131] In step S506, the spatial features of IP clustering include at least the geographical distribution of accessing IPs, network segment distribution, and URL connectivity.

[0132] The geographic distribution of accessing IPs includes the geographic location of the accessing IPs within IP clusters.

[0133] Network segment distribution refers to the distribution of network segments where the accessing IPs are located in IP clusters.

[0134] URL connectivity refers to the connectivity between URLs accessing IP connections within an IP cluster.

[0135] Optionally, spatial characteristics of IP clustering may also include the geographical distribution of the visited IPs and the protocol types used by the visited IPs, but are not limited to these.

[0136] The geographic distribution of visited IPs includes the geographic location of the visited IPs within IP clusters.

[0137] Step S507: Perform operational feature analysis on IP clustering to obtain the operational features of IP clustering.

[0138] In step S507, the operational features of IP clustering include legitimate operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program downloading, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification.

[0139] Legitimate operations refer to the list of trusted operations that have been added to the IP whitelist in the industrial control system.

[0140] Industrial control port scanning refers to the operation of scanning industrial control ports when accessing an industrial control system via an IP address.

[0141] Industrial control system vulnerability scanning refers to the operation of scanning for vulnerabilities in an industrial control system when accessing it via an IP address.

[0142] Industrial control system vulnerability exploitation refers to the operation of exploiting vulnerabilities in an industrial control system when accessing it via an IP address.

[0143] Logic program download refers to the process by which an engineer's workstation resets or updates the logic program in an industrial control system via the network when accessing the system from an IP address.

[0144] Shutting down industrial control equipment refers to shutting down the industrial control equipment when accessing the industrial control system via IP.

[0145] Restarting industrial control equipment refers to restarting the industrial control equipment when accessing the industrial control system via IP.

[0146] Modifying process parameters refers to modifying the process parameters of an industrial control system when accessing it via IP.

[0147] Step S508: Obtain the threat coefficient of IP clustering based on the URL type, time characteristics, spatial characteristics, and operation characteristics.

[0148] For example, during the execution of step S508, the threat coefficient of IP clustering is calculated as follows.

[0149] T(IP) = F(URL) ip )*(pF(P ip )∩sF(S ip )∪oF(O ip )), (1),

[0150] Where T(P) is the threat coefficient of the accessing IP, and F(URL) is the threat coefficient of the accessing IP. ipF(P) represents the degree of goodwill of the URL corresponding to the accessed IP, and is a decimal number between [0,1] (rounded to two decimal places). ip F(S) is the time feature aggregation function for IP, p(Period) is its weight, and its value is a decimal between [0,1] (rounded to two decimal places). ip F(O) is the spatial feature aggregation function of IP, s(Space) is its weight, and its value is a decimal between [0,1] (rounded to two decimal places). ip ) is the aggregation function of the operation features of IP, and o(Operation) is its weight, which takes the value of a decimal between [0,1] (rounded to two decimal places).

[0151] Based on the network security analysis method provided by the embodiments of the present invention, after identifying active IPs, the active IPs are clustered to obtain multiple IP clusters, and attribute analysis is performed on the IP clusters to obtain the threat coefficient of the IP clusters. This provides a data foundation for subsequent calculation of the network security of industrial control systems based on the threat coefficient, and improves the reliability of the data.

[0152] Based on the network security analysis method provided by the above embodiments of the present invention, after executing step S508 to obtain the threat coefficient of the IP packet according to the type of the domain name, the time characteristics, and the spatial characteristics, the method further includes:

[0153] Step S11: Match the threat coefficients of IP clusters with the threat coefficients in existing threat intelligence data.

[0154] In step S11, the existing threat intelligence data includes at least commercial threat intelligence data, open-source threat intelligence data, publicly available industrial control system threat information sets on the Internet, industrial control system threat trapping datasets, and audited and labeled result data.

[0155] Step S12: Determine whether the threat coefficient of the IP cluster matches the threat coefficient in the existing threat intelligence data. If yes, proceed to step S13; otherwise, proceed to step S14.

[0156] In the specific implementation of step S12, it is determined whether the threat coefficient of the IP cluster matches the threat coefficient in the existing threat intelligence data. If yes, step S13 is executed; otherwise, it means that the threat coefficient of any IP cluster does not match the threat coefficient in the existing threat intelligence data, and step S14 is executed.

[0157] Step S13: Confirm that the data for the threat coefficient of the IP cluster is correct, and obtain the threat coefficient of the approved IP cluster.

[0158] In the specific implementation step S13, it is determined that the threat coefficients of the IP clusters all match the threat coefficients in the existing threat intelligence data, further confirming that the data of the threat coefficients of the IP clusters is correct, and obtaining the threat coefficients of the approved IP clusters.

[0159] Step S14: The data for determining the threat coefficient of the IP cluster is incorrect, resulting in the threat coefficient of the IP cluster that failed the review.

[0160] In the specific implementation step S14, it is determined that the threat coefficient of any IP cluster does not match the threat coefficient in the existing threat intelligence data. Further, it is determined that the data of the threat coefficient of the IP cluster is incorrect, and the threat coefficient of the IP cluster that failed the review is obtained.

[0161] Optionally, after obtaining the threat coefficients of the approved IP clusters and the threat coefficients of the unapproved IP clusters, the following steps are also included:

[0162] The threat coefficients of approved IP clusters are added to the multi-source threat intelligence database, while the threat coefficients of unapproved IP clusters are backed up to a pre-built threat intelligence database awaiting further review.

[0163] It should be noted that the threat coefficients of approved IP clusters are added to the multi-source threat intelligence database. In other words, the multi-source threat intelligence database is updated using the threat coefficients of approved IP clusters.

[0164] To better understand the above explanation, as follows: Figure 7 The diagram shown is a schematic representation of threat intelligence generation provided by an embodiment of the present invention.

[0165] exist Figure 7 In this study, for each IP cluster, the access method, time characteristics, spatial characteristics, and threat coefficient of the IP cluster are analyzed separately to obtain the access method, time characteristics, spatial characteristics, and threat coefficient of the IP cluster (the threat coefficient of the IP and the threat coefficient of the IP cluster).

[0166] The threat coefficients of IPs and IP clusters are used as the basic data for the threat intelligence database. The obtained threat coefficients of IPs and IP clusters are then reviewed to obtain the final threat intelligence.

[0167] The network security analysis method provided by this invention verifies the accuracy and reliability of the data by reviewing the threat coefficients of the obtained IPs and the threat coefficients of IP clusters.

[0168] Based on the network security analysis method provided in the above embodiments of the present invention, step S104 involves calculating the first network security score of the industrial control system based on the threat coefficient. Figure 8 The diagram shown illustrates a process for calculating a first network security score for an industrial control system according to an embodiment of the present invention, mainly including the following steps:

[0169] Step S801: Based on the threat coefficient of IP clustering, obtain the number of threatening IP clusters and benevolent IP clusters in the IP clustering of the industrial control system.

[0170] In the specific implementation step S801, based on the threat coefficient of the IP clusters calculated above, the threatening IP clusters and benevolent IP clusters in the IP clusters of the industrial control system are analyzed to obtain the number of threatening IP clusters and the number of benevolent IP clusters in the IP clusters of the industrial control system.

[0171] Step S802: Calculate the first network security score of the industrial control system based on the number of threat IP clusters, the number of benevolent IP clusters, and the threat coefficient of the IP clusters.

[0172] In step S802, the first network security score is the sum of the weighted threat coefficients of the threat IP clusters.

[0173] In the specific implementation step S802, the network security score of the industrial control system is calculated by using the number of threat IP clusters, the number of benevolent IP clusters, and the threat coefficient of IP clusters, and the first network security score of the industrial control system is obtained.

[0174] For example, the first network security score for an Industrial Control System (ICS) is calculated as follows:

[0175]

[0176] ICS stands for Industrial Control System, and T(ICS) C ) represents the first network score of ICS, IPC represents the cluster of accessing IPs, the number of benevolent IP clusters is 'a', and the number of threatening IP clusters is 'b'.

[0177] The network security analysis method provided by this invention calculates the first network security score of an industrial control system using a threat coefficient, thereby enabling security alerts based on the network security score and improving data reliability.

[0178] Compared with the above embodiments of the present invention Figure 1 Corresponding to the network security analysis method shown, this embodiment of the invention also provides a network security analysis system, such as... Figure 9As shown, the network security analysis system includes: a query module 901, a first processing module 902, a second processing module 903, and a comparison and alarm module 904.

[0179] The query module 901 is used to query whether the corresponding industrial control system threat coefficient exists in the pre-built multi-source threat intelligence database. If it does not exist, the first processing module is executed; if it exists, the second processing module is executed.

[0180] The first processing module 902 is used to acquire all access IP data of the industrial control system, analyze the activity of IPs based on the access IP data, and determine active IPs; cluster the active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters; and calculate the first network security score of the industrial control system based on the threat coefficient.

[0181] The second processing module 903 is used to convert the queried threat coefficient of the industrial control system into a second network security score of the industrial control system based on the correspondence between the threat coefficient and the network security score of the industrial control system.

[0182] The comparison and alarm module 904 is used to compare the first network security score or the second network security score with a preset network security threshold, and to issue a security alarm for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

[0183] It should be noted that the specific principles and execution processes of each module or unit in the network security analysis system disclosed in the above embodiments of the present invention are the same as those of the network security analysis method implemented in the above embodiments of the present invention. Please refer to the corresponding parts of the network security analysis method disclosed in the above embodiments of the present invention, and they will not be repeated here.

[0184] Based on the network security analysis system provided in this embodiment of the invention, when a threat coefficient for a corresponding industrial control system is not found in the threat intelligence database, the system clusters active IPs in the acquired access IP data, obtains IP clusters, performs attribute analysis, obtains the threat coefficient of the IP clusters, and calculates the first network security score of the industrial control system. When a threat coefficient for a corresponding industrial control system is found in the threat intelligence database, the system converts the found threat coefficient of the industrial control system into a second network security score based on the correspondence between the threat coefficient and the network security score of the industrial control system. The system then issues security alerts to industrial control systems whose first or second network security scores exceed a preset network security threshold, thereby enabling the management of threat intelligence for industrial control equipment and improving data reliability.

[0185] Optionally, based on the above Figure 9 The first processing module 902 shown is used to acquire all access IP data of the industrial control system, analyze the activity of IPs based on the access IP data, and determine active IPs. The first processing module 902 includes: an acquisition unit, a obtaining unit, a first determining unit, and a second determining unit.

[0186] The acquisition unit is used to acquire all access IPs and Uniform Resource Locators (URLs) of access IP connections to the industrial control system based on a multi-source security threat intelligence database.

[0187] There is a mapping relationship between the access IP and the URL connected to the access IP.

[0188] The unit is used to obtain the activity level of the accessing IP based on the access cycle of the accessing industrial control system.

[0189] The first determining unit is used to determine the accessing IP as an inactive IP if the activity level is low, and then filter the accessing IP.

[0190] The second determining unit is used to determine the accessing IP as an active IP if the activity level is high.

[0191] Based on the network security analysis system provided by the embodiments of the present invention, after obtaining the access IP and the URL connected to the access IP, the system analyzes the activity level of the access IP. When the activity level of the access IP is determined to be high, the access IP is determined to be an active IP. When the activity level of the access IP is determined to be low, the access IP is determined to be an inactive IP, and inactive IPs are filtered out. This filters out access IP data that does not meet the requirements, thereby improving the efficiency and accuracy of data analysis.

[0192] Optionally, based on the above Figure 9 The first processing module 902 shown is used to cluster active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters. The first processing module 902 includes: a parsing unit, a clustering unit, a first analysis unit, a first analysis processing unit, a second analysis unit, a third analysis unit, a fourth analysis unit, and an obtaining unit.

[0193] The resolution unit is used to resolve active IPs, obtain the mapping relationship between active IPs and the URLs connected to active IPs, the network segment where the active IPs are located, and the region to which the active IPs belong.

[0194] The clustering unit is used to cluster active IPs based on the mapping relationship between active IPs and the URLs connected to the active IPs, the network segment where the active IPs are located, and the region to which the active IPs belong, resulting in multiple IP clusters.

[0195] The first analysis unit is used to analyze the access methods of each IP cluster to obtain the access methods of the IP cluster.

[0196] The access methods include benevolent access and threatening access.

[0197] The determination unit is used to determine the type of IP cluster and the type of URL accessing the IP connection within the IP cluster based on the access method.

[0198] Among them, the types of IP clustering include benevolent IP clustering and threat IP clustering, and the types of URLs include benevolent URLs and threat URLs.

[0199] The second analysis unit is used to perform time feature analysis on IP clusters to obtain the time features of IP clusters.

[0200] The time characteristics include total access duration and single access duration.

[0201] The third analysis unit is used to perform spatial feature analysis on IP clusters to obtain the spatial features of IP clusters.

[0202] Among them, spatial features include at least the geographical distribution of accessing IPs, network segment distribution, and URL connectivity. URL connectivity refers to the URLs of accessing IPs in IP clusters and the connectivity of the URLs of IP connections.

[0203] The fourth analysis unit is used to perform operational feature analysis on the IP clusters to obtain the operational features of the IP clusters.

[0204] The operational characteristics include at least legitimate operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program downloading, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification; the resulting unit is used to obtain the threat coefficient of IP clustering based on the URL type, time characteristics, spatial characteristics, and operational characteristics.

[0205] Optionally, based on the above Figure 9 The first processing module 902 shown, which is used to cluster active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters, further includes: a matching unit, a first matching processing unit, and a second matching processing unit.

[0206] The matching unit is used to match the threat coefficients of IP clusters with the threat coefficients in multi-source security threat intelligence data. The multi-source security threat intelligence data includes at least commercial threat intelligence data, open-source threat intelligence data, publicly available industrial control system threat information sets on the Internet, industrial control system threat trapping datasets, and audited and labeled result data.

[0207] The first matching processing unit is used to determine the accuracy of the IP cluster threat coefficient data if all the threat coefficients of the IP clusters match the threat coefficients in the existing threat intelligence data, and to obtain the approved IP cluster threat coefficients.

[0208] The second matching processing unit is used to determine that the threat coefficient data of any IP cluster is incorrect if the threat coefficient of any IP cluster does not match the threat coefficient in the existing threat intelligence data, and to obtain the threat coefficient of the IP cluster that has not passed the review.

[0209] Optionally, after the first matching processing unit obtains the threat coefficient of the approved IP clusters, the first matching processing unit is further specifically used for:

[0210] The threat coefficients of the approved IP clusters are added to the multi-source threat intelligence database.

[0211] Optionally, after the second matching processing unit obtains the threat coefficient of the unapproved IP clusters, the second matching processing unit is further specifically used for:

[0212] Back up the threat coefficients of IP clusters that fail the review to a pre-built threat intelligence database awaiting further review.

[0213] The network security analysis system provided by this invention verifies the accuracy and reliability of data by reviewing the threat coefficients of obtained IPs and IP clusters.

[0214] Optionally, based on the above Figure 9 The first processing module 902 shown, specifically for calculating the first network security score of the industrial control system based on the threat coefficient, is used for:

[0215] Based on the threat coefficient of the IP and the threat coefficient of the IP cluster, the number of threatening IP clusters and the number of benevolent IP clusters in the IP cluster of the industrial control system are obtained; based on the number of threatening IP clusters, the number of benevolent IP clusters, and the threat coefficient of the IP cluster, the first network security score of the industrial control system is calculated.

[0216] The first network security score is the sum of the weighted threat coefficients of the threat IP clusters.

[0217] The network security analysis system provided by this invention calculates the first network security score of an industrial control system using a threat coefficient, thereby enabling security alerts based on the network security score and improving data reliability.

[0218] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0219] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0220] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network security analysis method, characterized in that, The method includes: Query whether the corresponding threat coefficient of the industrial control system exists in the pre-built multi-source threat intelligence database; If not, obtain all access IP data of the industrial control system, and analyze the activity of the IPs based on the access IP data to determine the active IPs; The active IPs are clustered, and attribute analysis is performed on the resulting IP clusters to obtain their threat coefficients. This includes: parsing the active IPs to obtain the mapping relationship between the active IPs and the URLs connected to them, the network segment where the active IPs are located, and the region to which the active IPs belong; clustering the active IPs based on the mapping relationship between the active IPs and the URLs connected to them, the network segment where the active IPs are located, and the region to which the active IPs belong, resulting in multiple IP clusters; for each IP cluster, access method analysis is performed to obtain the access methods of the IP clusters, including benevolent access methods and threatening access methods; based on the access methods, the type of the IP cluster and the type of URLs connecting to the accessing IPs within the IP clusters are determined, the IP cluster types including benevolent IP clusters and threatening IP clusters, and the UR... The types of L include benevolent URLs and threatening URLs; temporal feature analysis is performed on the IP clusters to obtain the temporal characteristics of the IP clusters, which include the total access duration and the duration of a single access; spatial feature analysis is performed on the IP clusters to obtain the spatial characteristics of the IP clusters, which at least include the geographical distribution of accessing IPs, network segment distribution, and URL connectivity, where URL connectivity refers to the URLs connected to the accessing IPs within the IP cluster and the connectivity of the URLs connected to the accessing IPs; operational feature analysis is performed on the IP clusters to obtain the operational characteristics of the IP clusters, which include legitimate operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program downloading, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification; based on the URL type, the temporal characteristics, the spatial characteristics, and the operational characteristics, the threat coefficient of the IP clusters is obtained; Calculating a first network security score for the industrial control system based on the threat coefficients includes: obtaining the number of threatening IP clusters and the number of benevolent IP clusters in the IP clusters of the industrial control system according to the threat coefficients of the IP clusters; calculating a first network security score for the industrial control system based on the number of threatening IP clusters, the number of benevolent IP clusters, and the threat coefficients of the IP clusters, wherein the first network security score is the sum of the weighted threat coefficients of the threatening IP clusters; If it exists, based on the correspondence between the threat coefficient and the network security score of the industrial control system, the queried threat coefficient of the industrial control system is converted into a second network security score of the industrial control system. The first network security score or the second network security score is compared with a preset network security threshold, and a security alarm is issued for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

2. The method according to claim 1, characterized in that, The process of acquiring all access IP data of the industrial control system and analyzing the activity of the IPs based on the access IP data to determine active IPs includes: Based on a multi-source security threat intelligence database, all access IPs of the industrial control system and the Uniform Resource Locator URLs connected to the access IPs are obtained, and there is a mapping relationship between the access IPs and the URLs connected to the access IPs. The activity level of the accessing IP is obtained based on the access cycle of the accessing IP to the industrial control system; If the activity level is low, the accessing IP is determined to be an inactive IP, and the accessing IP is filtered out. If the activity level is high, the accessing IP is determined to be an active IP.

3. The method according to claim 1, characterized in that, Also includes: The threat coefficients of the IP clusters are matched with the threat coefficients in existing threat intelligence data, wherein the existing threat intelligence data includes at least commercial threat intelligence data, open source threat intelligence data, publicly available industrial control system threat information sets on the Internet, industrial control system threat trapping datasets, and audited and labeled result data. If the threat coefficient of the IP cluster matches the threat coefficient in the existing threat intelligence data, the data of the threat coefficient of the IP cluster is determined to be correct, and the threat coefficient of the approved IP cluster is obtained. If the threat coefficient of any IP cluster does not match the threat coefficient in the existing threat intelligence data, the data for the threat coefficient of the IP cluster is determined to be incorrect, and the threat coefficient of the IP cluster that fails the review is obtained.

4. The method according to claim 3, characterized in that, After obtaining the threat coefficients of the approved IP clusters and the unapproved IP clusters, the method further includes: The threat coefficients of the approved IP clusters are added to the multi-source threat intelligence database, and the threat coefficients of the unapproved IP clusters are backed up to the pre-built threat intelligence database awaiting re-approval.

5. A network security analysis system, characterized in that, The system includes: The query module is used to query whether the corresponding threat coefficient of the industrial control system exists in the pre-built multi-source threat intelligence database. If it does not exist, the first processing module is executed; if it exists, the second processing module is executed. The first processing module is used to acquire all access IP data of the industrial control system, analyze the activity of the IPs based on the access IP data, and determine the active IPs; cluster the active IPs, perform attribute analysis on the obtained IP clusters, and obtain the threat coefficient of the IP clusters; and calculate the first network security score of the industrial control system based on the threat coefficient. The first processing module includes: a parsing unit, a clustering unit, a first analysis unit, a determination unit, a second analysis unit, a third analysis unit, a fourth analysis unit, and an obtaining unit; The parsing unit is used to parse the active IP to obtain the mapping relationship between the active IP and the URL connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs. The clustering unit is used to cluster the active IPs based on the mapping relationship between the active IP and the URLs connected to the active IP, the network segment where the active IP is located, and the region to which the active IP belongs, to obtain multiple IP clusters. The first analysis unit is used to analyze the access methods of each IP cluster to obtain the access methods of the IP cluster, including benevolent access methods and threatening access methods. The determining unit is configured to determine the type of the IP cluster and the type of the URL accessing the IP connection in the IP cluster based on the access method. The type of the IP cluster includes benevolent IP clusters and threatening IP clusters, and the type of the URL includes benevolent URLs and threatening URLs. The second analysis unit is used to perform time feature analysis on the IP clusters to obtain the time features of the IP clusters, the time features including total access duration and single access duration; The third analysis unit is used to perform spatial feature analysis on the IP clusters to obtain the spatial features of the IP clusters. The spatial features include at least the geographical distribution of the accessing IPs, the network segment distribution, and the URL connectivity. The URL connectivity refers to the URLs connected to the accessing IPs in the IP clusters and the connectivity of the URLs connected to the accessing IPs. The fourth analysis unit is used to perform operational feature analysis on the IP cluster to obtain the operational features of the IP cluster. The operational features include legal operations, industrial control port scanning, industrial control vulnerability scanning, industrial control vulnerability exploitation, logic program download, industrial control equipment shutdown, industrial control equipment restart, and process parameter modification. The obtaining unit is used to obtain the threat coefficient of the IP clustering based on the type of the URL, the time characteristics, the spatial characteristics, and the operation characteristics. The step of calculating the first network security score of the industrial control system based on the threat coefficient includes: obtaining the number of threatening IP clusters and the number of benevolent IP clusters in the IP clusters of the industrial control system according to the threat coefficient of the IP clusters; and calculating the first network security score of the industrial control system based on the number of threatening IP clusters, the number of benevolent IP clusters, and the threat coefficient of the IP clusters, wherein the first network security score is the sum of the weighted threat coefficients of the threatening IP clusters; The second processing module is used to convert the queried threat coefficient of the industrial control system into a second network security score of the industrial control system based on the correspondence between the threat coefficient and the network security score of the industrial control system. The comparison and alarm module is used to compare the first network security score or the second network security score with a preset network security threshold, and to issue a security alarm for industrial control systems whose first network security score or the second network security score is higher than the preset network security threshold.

6. The system according to claim 5, characterized in that, The first processing module for acquiring all access IP data of the industrial control system, analyzing the activity of IPs based on the access IP data, and determining active IPs includes: The acquisition unit is used to acquire all access IPs of the industrial control system and the Uniform Resource Locator URLs connected to the access IPs based on a multi-source security threat intelligence database, wherein there is a mapping relationship between the access IPs and the URLs connected to the access IPs. The obtaining unit is used to obtain the activity level of the accessing IP based on the access cycle of the accessing IP to the industrial control system; The first determining unit is configured to determine the accessing IP as an inactive IP if the activity level is low, and to filter the accessing IP. The second determining unit is used to determine the accessing IP as an active IP if the activity level is high activity level.

Images