A security control method, system and device of an industrial control network and a storage medium

Abstract

The application discloses a kind of security control method, system, equipment and storage medium of industrial control network, comprising: the minimum check unit is executed, according to each minimum check unit corresponding evaluation function and self-check function, obtain actual evaluation score and environmental variable;While according to the historical evaluation score and environmental variable recorded by minimum check unit, the evaluation score of this time is predicted, and whether the error between actual evaluation score and the evaluation score of this time obtained by prediction meets the normal distribution condition determined by historical error is judged, when meeting the condition, then according to the statistical function corresponding to each core check item, the statistical score corresponding to each core check item is obtained, and according to the statistical score corresponding to each core check item and its evaluation weight, the security score is calculated;When the security score is lower than set threshold, then the corresponding vulnerability repair scheme corresponding to the vulnerability is loaded, the security vulnerability existing in the industrial control network can be repaired in time by the application.

Description

Technical Field

[0001] This invention belongs to the field of industrial control security technology, and relates to a security control method, system, device and storage medium for industrial control networks. Background Technology

[0002] With the widespread application of computer technology in industrial environments, general-purpose computing devices and operating systems have begun to be used in the implementation of industrial control networks. Industrial control protocols have also begun to be built based on the TCP / IP protocol. Traditional industrial control networks have gradually broken down their previous closed and proprietary nature, causing the threats faced by traditional Internet systems to spread to the industrial control network environment. At the same time, due to system compatibility issues, industrial control networks are usually not upgraded or patched. Therefore, industrial control networks that have been running for a long time will accumulate a large number of security vulnerabilities. These defects make industrial control networks very vulnerable to network attacks. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a security control method, system, device and storage medium for industrial control networks. This method, system, device and storage medium can promptly repair security vulnerabilities in industrial control networks.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: In one aspect, the present invention provides a security control method for industrial control networks, comprising: 1) Based on the data stored in the full-text index database, set up several minimum inspection units for industrial control network security assessment, and configure corresponding evaluation functions and self-test functions for each minimum inspection unit. Construct several core inspection items using the set minimum inspection units, and configure corresponding statistical functions and their evaluation weights for each core inspection item. The data stored in the full-text index database includes the attributes, vulnerabilities, and corresponding vulnerability remediation schemes of devices in the industrial control network. 2) Execute the minimum inspection unit, and obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, predict the current evaluation score according to the historical evaluation score and environmental variables recorded by the minimum inspection unit, and determine whether the error between the actual evaluation score and the predicted current evaluation score meets the normal distribution condition determined by the historical error; if it meets the condition, proceed to step 3); otherwise, update the evaluation weight of the statistical function. 3) Based on the statistical function corresponding to each core inspection item, obtain the statistical score corresponding to each core inspection item, and calculate the safety score based on the statistical score and evaluation weight of each core inspection item. 4) When the security score is lower than the set threshold, the corresponding vulnerability remediation plan is loaded to achieve security control of the industrial control network.

[0005] The higher the security score, the stronger the security of the corresponding core inspection item.

[0006] Also includes: 11) Use scanning tools to detect open ports on the device and predict all services corresponding to the detected ports; 12) Traverse the mapping between ports and services to identify the service corresponding to a port; 13) Iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; 14) Based on the parsed device attributes, match the corresponding vulnerabilities from the vulnerability expert database and obtain the vulnerability remediation solutions for each matched vulnerability; 15) The obtained device attributes, vulnerabilities, and corresponding vulnerability remediation solutions are associated with the geographical location and then saved in the full-text index database as documents.

[0007] The specific operation of step 12) is as follows: Run all possible service scripts corresponding to the port in sequence until the service corresponding to the port is identified based on the results of the service script execution. If the service corresponding to the port is still not identified after all service scripts have been run, then run web parsing using HTTP and HTTPS protocols.

[0008] The specific operation of step 13) is as follows: The request packet is constructed according to the definition of the specific protocol packet, and the communication process with the device is simulated in accordance with the protocol interaction rules. At the same time, the device's response packet is collected, and fingerprint feature information is obtained from the response packet to parse the device attributes.

[0009] The device attributes include the device manufacturer, type, and firmware version.

[0010] In a second aspect, the present invention provides a security control system for industrial control networks, comprising: The verification configuration module is used to set up several minimum inspection units for industrial control network security assessment based on the data stored in the full-text index database, and to configure corresponding evaluation functions and self-test functions for each minimum inspection unit. It also uses the set minimum inspection units to construct several core inspection items and configures corresponding statistical functions and their evaluation weights for each core inspection item. The data stored in the full-text index database includes the attributes, vulnerabilities, and corresponding vulnerability remediation schemes of devices in the industrial control network. The verification execution module is used to execute the minimum inspection unit, obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, based on the historical evaluation scores and environmental variables recorded by the minimum inspection unit, it predicts the current evaluation score and determines whether the error between the actual evaluation score and the predicted current evaluation score conforms to the normal distribution condition determined by the historical error; if it does, the security assessment module is executed; otherwise, the evaluation weight of the statistical function is updated. The security assessment module is used to obtain the statistical score corresponding to each core inspection item based on the statistical function corresponding to each core inspection item, and to calculate the security score based on the statistical score and evaluation weight of each core inspection item. The vulnerability remediation module is used to load the corresponding vulnerability remediation scheme when the security score is lower than a set threshold, so as to realize the security control of the industrial control network.

[0011] Also includes: The port scanning module is used to detect open ports on a device using scanning tools and predict all services corresponding to the detected ports. The service identification module is used to traverse the mapping between ports and services and identify the service corresponding to a port. The fingerprint recognition module is used to iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; The vulnerability matching module is used to match corresponding vulnerabilities from the vulnerability expert database based on the parsed device attributes, and obtain the vulnerability remediation solutions for each matched vulnerability. The data storage module is used to associate the acquired device attributes, vulnerabilities, and corresponding vulnerability remediation solutions with geographical location, and then save them in the full-text index database in document form.

[0012] In three aspects, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the security control method of the industrial control network.

[0013] In four aspects, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the security control method for the industrial control network.

[0014] The present invention has the following beneficial effects: The security control method, system, device, and storage medium for industrial control networks described in this invention employs the working principle of a linear three-layer perceptron. It sets up several minimum inspection units for security assessment of the industrial control system, configures corresponding evaluation and self-test functions for each minimum inspection unit, and constructs several core inspection items using these minimum inspection units. Each core inspection item is then configured with corresponding statistical functions and evaluation weights. By executing all minimum inspection units and corresponding core inspection items, the security of devices in the industrial control network is assessed in real time, and security vulnerabilities in the industrial control network are repaired promptly. The method is simple, convenient, and has good real-time performance. Attached Figure Description

[0015] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a system structure diagram of the present invention; Figure 2 This is a schematic diagram illustrating the working principle of a linear three-layer perceptron. Detailed Implementation

[0016] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0017] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1 The security control method for industrial control networks described in this invention includes: 1) Use scanning tools to detect the open ports of the device and predict all services corresponding to the detected ports; 2) Traverse the mapping between ports and services to identify the service corresponding to a port; Specifically, all possible service scripts corresponding to the port are run sequentially until the service corresponding to the port is identified based on the execution results of the service scripts. Furthermore, the service identification module is used to perform web parsing using HTTP and HTTPS protocols if the service corresponding to the port has not been identified after all service scripts have been run.

[0019] 3) Iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; Specifically, a request packet is constructed according to the definition of the specific protocol packet, and the communication process with the device is simulated according to the protocol interaction rules. At the same time, the device's response packet is collected, and fingerprint feature information is obtained from the response packet to parse the device attributes. The device attributes include at least the device manufacturer, type, and firmware version.

[0020] 4) Based on the parsed device attributes, match the corresponding vulnerabilities from the vulnerability expert database and obtain the vulnerability remediation solutions for each matched vulnerability; 5) The acquired device attributes, vulnerabilities, and corresponding vulnerability remediation solutions are associated with the geographical location and then saved in the full-text index database as documents; 6) Based on the data stored in the full-text index database, set up several minimum inspection units for industrial control network security assessment, and configure corresponding evaluation functions and self-test functions for each minimum inspection unit. Construct several core inspection items using the set minimum inspection units, and configure corresponding statistical functions and their evaluation weights for each core inspection item. 7) Execute the minimum inspection unit, and obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, predict the current evaluation score according to the historical evaluation score and environmental variables recorded by the minimum inspection unit, and determine whether the error between the actual evaluation score and the predicted current evaluation score meets the normal distribution condition determined by the historical error; if it meets the condition, proceed to step 8); otherwise, update the evaluation weight of the statistical function. 8) Obtain the statistical score corresponding to each core inspection item based on the statistical function corresponding to each core inspection item; at the same time, calculate the security score based on the statistical score and evaluation weight of each core inspection item, wherein the higher the security score, the higher the security strength of the corresponding core inspection item. 9) When the security score is lower than the set threshold, the corresponding vulnerability remediation plan is loaded to improve the security of the industrial control network.

[0021] Example 2 refer to Figure 1 The security control system for industrial control networks described in this invention includes: The port scanning module is used to detect open ports on a device using scanning tools and predict all services corresponding to the detected ports. The service identification module is used to traverse the mapping between ports and services and identify the service corresponding to a port. The fingerprint recognition module is used to iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; The vulnerability matching module is used to match corresponding vulnerabilities from the vulnerability expert database based on the parsed device attributes, and obtain the vulnerability remediation solutions for each matched vulnerability. The data storage module is used to associate the acquired device attributes, vulnerabilities, and corresponding vulnerability remediation solutions with the geographical location, and then save them in the full-text index database in document form. The verification configuration module is used to set up several minimum inspection units for industrial control network security assessment based on the data stored in the full-text index database, and to configure corresponding evaluation functions and self-test functions for each minimum inspection unit. It also uses the set minimum inspection units to construct several core inspection items and configures corresponding statistical functions and their evaluation weights for each core inspection item. The data stored in the full-text index database includes the attributes, vulnerabilities, and corresponding vulnerability remediation schemes of devices in the industrial control network. The verification execution module is used to execute the minimum inspection unit, obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, based on the historical evaluation scores and environmental variables recorded by the minimum inspection unit, it predicts the current evaluation score and determines whether the error between the actual evaluation score and the predicted current evaluation score conforms to the normal distribution condition determined by the historical error; if it does, the security assessment module is executed; otherwise, the evaluation weight of the statistical function is updated. The security assessment module is used to obtain the statistical score corresponding to each core inspection item based on the statistical function corresponding to each core inspection item, and to calculate the security score based on the statistical score and evaluation weight of each core inspection item. The vulnerability remediation module is used to load the corresponding vulnerability remediation scheme when the security score is lower than a set threshold, so as to realize the security control of the industrial control network.

[0022] It should be noted that, to accelerate the scanning and detection of massive numbers of device nodes, the various modules of the industrial control network asset identification system are distributed across multiple servers. However, the exact number of nodes allocated to each module needs to be determined based on classic experience and a comprehensive evaluation of the physical performance of the scanning devices and network bandwidth. In short, it is essential to ensure a balance between message production and consumption across all modules, avoiding prolonged message backlogs on any single module. Message backlogs indicate an unreasonable configuration of the scanning system's node count, failing to fully leverage the performance gains from pipelined operations, resulting in some modules being overworked while others are excessively idle.

[0023] In this embodiment, port scanning and service probing can produce certain side effects. To reduce irrelevant traffic in the network and minimize the impact on network devices, traffic monitoring can be used to assist in the identification of controlled network assets. For normal network communication, tcpdump can be used to monitor traffic packets, obtaining MAC information at the data link layer, IP information at the network layer, and port information at the transport layer. The transmitted information can then be used for industrial control protocol analysis.

[0024] tcpdump packet capture is a relatively simple passive identification method. However, many industrial control protocols often involve multiple network interaction processes, which means that multiple data packets need to be combined to identify an industrial control device. At this time, professional traffic monitoring tools are needed, such as IPS and IDS tools (e.g., Suricata). These tools can be programmed to perform corresponding actions when encountering specific characteristics.

[0025] Similarly, the passively identified industrial control fingerprint features also need to be added to our fingerprint database in a timely manner so that the system can continuously evolve itself and identify industrial control assets and equipment more quickly and accurately.

[0026] Therefore, to reduce network traffic and minimize the impact on network devices, a combined active and passive scanning approach can be reasonably adopted for industrial control asset identification. First, a passive method is used to monitor network traffic without impact, identifying live hosts. The identified MAC addresses can serve as candidate criteria for subsequent vendor identification. If the monitored traffic contains a corresponding industrial control interaction packet that matches an existing fingerprint database, the discovered device is recorded. For the remaining unidentified devices, an active identification method can be used. Because active identification involves multiple steps, if a step has already yielded results in the passive identification stage, the active identification stage can skip this step and continue to subsequent stages.

[0027] In one embodiment of the present invention, the minimum inspection unit is a functional module subdivided into many minimum states that can be evaluated for scores. It is atomic and independent. For example, in vulnerability scanning, the minimum evaluation unit is to independently evaluate the details of a single vulnerability detected.

[0028] Considering that simple linear models without feedback mechanisms can amplify errors, and that overly complex network models place high demands on the system's computational power and time, this invention configures a corresponding self-test function for each smallest inspection unit. Furthermore, when an evaluation score is obtained as input to a core inspection item, an environment variable derived from the self-test function is also generated.

[0029] Assuming the system generates 100 evaluation scores and environmental variable records after 100 runs, the system will calculate the linear regression equation between the input and environmental variables for each inspection unit during idle time, and use the sum of squared errors to represent the loss function. The error is influenced by many factors and can be considered as the sum of these factors (random variables). Therefore, the error between the actual and predicted values ​​follows a normal distribution. If an input that does not conform to this distribution is found, the system will perform a self-check against its environmental variables. If a system configuration problem is found, it will be reported to the system presentation layer; if it is a parameter problem, the system will adjust the weights by adding or subtracting them based on the simulated error magnitude. Generally, the larger the error, the greater the decrease in the corresponding weight coefficient.

[0030] Specifically, methods for determining whether the error between the actual evaluation score and the current predicted evaluation score conforms to the normal distribution condition determined by the recorded historical errors include: Obtain the historical errors of records with the same environmental variables, and construct a normal distribution function with the error as the independent variable; The error between the actual evaluation score and the predicted evaluation score is substituted into the normal distribution function to calculate the corresponding probability value. If the probability value is less than the preset value, then the normal distribution condition is not met.

[0031] In this embodiment, each inspection unit has a memory analysis system or a periodic self-circulating system for its input, which ensures that the system's security score will not fluctuate due to a single human configuration or system parameter error over a long period of time. Moreover, the error range is guaranteed from the bottom layer, increasing the robustness of the system evaluation model.

[0032] Furthermore, due to the complexity and suddenness of the system, each smallest inspection unit is at the lowest level and each error adjustment requires the accumulation of a certain number of samples, which makes the timeliness of system adjustment insufficient. Therefore, it is necessary to design complementary intervention configuration schemes.

[0033] Specifically, each core inspection item is also configured with a corresponding bias, which is generally designed by evaluating the weights using w, i.e., y=x. w is obtained without human intervention; however, by adding a bias b, the final result becomes y=x. w+b effectively incorporates human decision-making, allowing for complementary optimization of errors through both systemic and human intervention.

[0034] like Figure 2 As shown, drawing on the working principle of a linear three-layer perceptron, this invention establishes several minimum inspection units for industrial control system security assessment. Each minimum inspection unit is configured with a corresponding evaluation function and self-test function. At least two core inspection items are constructed using these minimum inspection units, and each core inspection item is configured with a corresponding statistical function and evaluation weight. By executing all minimum inspection units and their corresponding core inspection items, and combining this with previously recorded data from the minimum inspection units, the invention determines whether the error conforms to a normal distribution, thereby adjusting the weight parameters of the statistical function. Therefore, this invention avoids error amplification during forward propagation from deep to surface, thus ensuring the final assessment result is as accurate as possible.

[0035] Example 3 A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of a security control method for an industrial control network. The memory may include main memory, such as high-speed random access memory (RAM), or it may also include non-volatile memory, such as at least one disk storage device. The processor, network interface, and memory are interconnected via an internal bus, which may be an industry-standard architecture bus, a peripheral component interconnection standard bus, or an extended industry-standard architecture bus. The bus can be categorized as an address bus, data bus, or control bus. The memory stores the program; specifically, the program may include program code, which includes computer operation instructions. The memory may include main memory and non-volatile memory, and it provides instructions and data to the processor.

[0036] Example 4 A computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a security control method for an industrial control network. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0037] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0038] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0039] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0040] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A security control method for industrial control networks, characterized in that, include: 1) Based on the data stored in the full-text index database, set up several minimum inspection units for industrial control network security assessment, and configure corresponding evaluation functions and self-test functions for each minimum inspection unit. Construct several core inspection items using the set minimum inspection units, and configure corresponding statistical functions and their evaluation weights for each core inspection item. The data stored in the full-text index database includes the attributes, vulnerabilities, and corresponding vulnerability remediation schemes of devices in the industrial control network. 2) Execute the minimum inspection unit, and obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, predict the current evaluation score according to the historical evaluation score and environmental variables recorded by the minimum inspection unit, and determine whether the error between the actual evaluation score and the predicted current evaluation score meets the normal distribution condition determined by the historical error; if it meets the condition, proceed to step 3); otherwise, update the evaluation weight of the statistical function. 3) Based on the statistical function corresponding to each core inspection item, obtain the statistical score corresponding to each core inspection item, and calculate the safety score based on the statistical score and evaluation weight of each core inspection item. 4) When the security score is lower than the set threshold, the corresponding vulnerability remediation plan is loaded to achieve security control of the industrial control network; Also includes: 11) Use scanning tools to detect open ports on the device and predict all services corresponding to the detected ports; 12) Traverse the mapping between ports and services to identify the service corresponding to a port; 13) Iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; 14) Based on the parsed device attributes, match the corresponding vulnerabilities from the vulnerability expert database and obtain the vulnerability remediation solutions for each matched vulnerability; 15) The obtained device attributes, vulnerabilities, and corresponding vulnerability remediation solutions are associated with the geographical location and then saved in the full-text index database as documents.

2. The security control method for industrial control networks according to claim 1, characterized in that, The higher the security score, the stronger the security of the corresponding core inspection item.

3. The security control method for industrial control networks according to claim 1, characterized in that, The specific operation of step 12) is as follows: Run all possible service scripts corresponding to the port in sequence until the service corresponding to the port is identified based on the results of the service script execution. If the service corresponding to the port is still not identified after all service scripts have been run, then run web parsing using HTTP and HTTPS protocols.

4. The security control method for industrial control networks according to claim 1, characterized in that, The specific operation of step 13) is as follows: The request packet is constructed according to the definition of the specific protocol packet, and the communication process with the device is simulated in accordance with the protocol interaction rules. At the same time, the device's response packet is collected, and fingerprint feature information is obtained from the response packet to parse the device attributes.

5. The security control method for industrial control networks according to claim 4, characterized in that, The device attributes include the device manufacturer, type, and firmware version.

6. A security control system for an industrial control network, characterized in that, include: The verification configuration module is used to set up several minimum inspection units for industrial control network security assessment based on the data stored in the full-text index database, and to configure corresponding evaluation functions and self-test functions for each minimum inspection unit. It also uses the set minimum inspection units to construct several core inspection items and configures corresponding statistical functions and their evaluation weights for each core inspection item. The data stored in the full-text index database includes the attributes, vulnerabilities, and corresponding vulnerability remediation schemes of devices in the industrial control network. The verification execution module is used to execute the minimum inspection unit, obtain the actual evaluation score and environmental variables according to the evaluation function and self-check function corresponding to each minimum inspection unit; at the same time, based on the historical evaluation scores and environmental variables recorded by the minimum inspection unit, it predicts the current evaluation score and determines whether the error between the actual evaluation score and the predicted current evaluation score conforms to the normal distribution condition determined by the historical error; if it does, the security assessment module is executed; otherwise, the evaluation weight of the statistical function is updated. The security assessment module is used to obtain the statistical score corresponding to each core inspection item based on the statistical function corresponding to each core inspection item, and to calculate the security score based on the statistical score and evaluation weight of each core inspection item. The vulnerability remediation module is used to load the corresponding vulnerability remediation scheme when the security score is lower than a set threshold, so as to realize the security control of the industrial control network. Also includes: The port scanning module is used to detect open ports on a device using scanning tools and predict all services corresponding to the detected ports. The service identification module is used to traverse the mapping between ports and services and identify the service corresponding to a port. The fingerprint recognition module is used to iteratively identify the mapping from the service corresponding to the port to the fingerprint in order to parse out the device attributes; The vulnerability matching module is used to match corresponding vulnerabilities from the vulnerability expert database based on the parsed device attributes, and obtain the vulnerability remediation solutions for each matched vulnerability. The data storage module is used to associate the acquired device attributes, vulnerabilities, and corresponding vulnerability remediation solutions with geographical location, and then save them in the full-text index database in document form.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the security control method for industrial control networks as described in any one of claims 1-5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the security control method for industrial control networks as described in any one of claims 1-5.

Images