Method and device for generating attack path prediction model based on network attack graph

Abstract

The present application discloses a method and device for generating an attack path prediction model based on a network attack graph, which relates to the field of industrial control security technology. The method comprises the following steps: obtaining industrial control network data and vulnerability data from a national vulnerability database to generate network vulnerability information of the entire industrial control network; generating a network attack graph for each area of the industrial control network based on the network vulnerability information; extracting information required for adversarial training of the attack and defense game from the network attack graph and performing adversarial training to obtain an attack path selection probability; quantifying the weights of directed edges of the network attack graph based on the attack path selection probability; calculating the vulnerability exploitability based on the network attack graph and the network vulnerability information; quantifying the weights of the nodes of the network attack graph based on the vulnerability exploitability; and, based on the quantified network attack graph, using a DDQN algorithm and a federated learning algorithm to train an attack path prediction model for the entire industrial control network, thereby solving the problem of attack path prediction under a large-scale network structure.

Description

Technical Field

[0001] The present application relates to the field of industrial control security technology, and specifically to a method and device for generating an attack path prediction model based on a network attack graph. Background Art

[0002] With the continuous development of informatization and industrialization, the once closed industrial control network has become open. In this open industrial control network environment, the function and production efficiency of industrial control networks have been improved, but they also face many security issues. To date, industrial control security issues have become increasingly prominent, so early warning methods for industrial control network security issues are of great significance to solving industrial control network security problems.

[0003] Network vulnerability assessment is a method that can prevent attacks before they occur. It is developed from hacker attack and defense technology. It obtains the possible behavior and status of the system and performs analysis and calculation based on this. Among them, network attack graph technology is an important means of network vulnerability assessment.

[0004] However, the industrial control security field still faces the following challenges:

[0005] 1. As the connectivity between industrial control network environments and the outside world continues to increase, the security risks of industrial control networks are attracting more and more attention;

[0006] Second, industrial control networks must handle cyberattacks with high precision and low latency. To meet these requirements, methods used to handle Internet attacks cannot be directly copied.

[0007] 3. Multi-step attacks on industrial control networks are difficult to counter due to their concealment and complexity.

[0008] Fourth, attack prediction methods for industrial control networks often perform poorly in large-scale network environments, and generating attack graphs for large-scale networks is time-consuming and ineffective.

[0009] 5. The currently commonly used Bayesian attack graph method for predicting attack paths calculates the probability of attack paths based on vulnerability scores and the correlation between vulnerabilities. This method does not take into account past attacks on industrial control networks or possible adjustments made by attackers to attack paths during the offensive and defensive game. This information is also valuable for predicting attack paths.

[0010] In summary, in the field of industrial control security, how to predict possible attacks in known industrial control networks; how to improve the accuracy of obtaining vulnerability exploitability in known industrial control networks; how to analyze the correlation between vulnerabilities; how to reasonably predict vulnerability information and the relationship between vulnerabilities without being attacked by the network; how to solve the problem of inefficiency in generating attack graphs for large-scale networks; how to analyze and predict multi-step attacks that are more covert and difficult to deal with; how to reasonably predict the attack path of possible attacks by integrating information such as network structure, vulnerability exploitability, and historical attack data; and how to solve the problem of attack path prediction under large-scale network structures have become urgent problems to be solved by technical personnel in this field. Summary of the Invention

[0011] To this end, the present application provides a method and device for generating an attack path prediction model based on a network attack graph to solve the problem in the prior art that it is difficult to predict the attack path of a possible attack in a large-scale industrial control network structure. The present application provides the following technical solutions:

[0012] In a first aspect, a method for generating an attack path prediction model based on a network attack graph includes:

[0013] Step 1: Obtain industrial control network data and vulnerability data from a national vulnerability database, and generate network vulnerability information for the entire industrial control network based on the industrial control network data and the vulnerability data;

[0014] Step 2: Generate a network attack graph for each area of the industrial control network based on the network vulnerability information;

[0015] Step 3: Extracting information required for adversarial training of the attacker and defender from the network attack graph, and performing adversarial training based on the extracted information to obtain the probability of attack path selection;

[0016] Step 4: quantifying the weights of directed edges of the network attack graph according to the attack path selection probability;

[0017] Step 5: Calculate vulnerability exploitability based on the network attack graph and the network vulnerability information;

[0018] Step 6: quantifying the weights of the nodes in the network attack graph according to the exploitability of the vulnerability;

[0019] Step 7: Based on the quantized network attack graph, the DDQN algorithm and the federated learning algorithm are used to train an attack path prediction model for the entire industrial control network.

[0020] Furthermore, the network attack graph in step 2 is generated using MulVAL.

[0021] Furthermore, the network attack graph in step 2 is an unweighted Bayesian attack graph generated using a Bayesian attack graph generation algorithm.

[0022] Furthermore, in step 3, adversarial training is performed based on the extracted information, specifically including:

[0023] Step 301: The attacker and defender detect the current network status;

[0024] Step 302: The attacker and defender implement their respective attack and defense strategies in turn according to their expected strategy payoff functions;

[0025] Step 303: The attacker and defender calculate their respective actual gains;

[0026] Step 304: The network system enters the next security state;

[0027] Step 305: Repeat steps 301 to 304 until the attack and defense reach a balanced state.

[0028] Furthermore, the vulnerability exploitability in step 5 is calculated based on the direct vulnerability exploitability, the historical vulnerability exploitability, and the recommended vulnerability exploitability.

[0029] Furthermore, the initial model of the attack path prediction model in step 7 is a Markov decision model.

[0030] Furthermore, the federated learning algorithm in step 7 is a federated averaging algorithm.

[0031] In a second aspect, a device for generating an attack path prediction model based on a network attack graph includes:

[0032] A network vulnerability information acquisition module is used to obtain industrial control network data and vulnerability data from the national vulnerability database, and generate network vulnerability information of the entire industrial control network based on the industrial control network data and the vulnerability data;

[0033] An attack graph generation module, configured to generate a network attack graph for each area of the industrial control network based on the network vulnerability information;

[0034] An attack-defense game adversarial training module is used to extract information required for attack-defense game adversarial training from the network attack graph, and perform adversarial training based on the extracted information to obtain the attack path selection probability;

[0035] and quantifying the weights of directed edges of the network attack graph according to the attack path selection probability;

[0036] A vulnerability exploitability evaluation module, configured to calculate the vulnerability exploitability based on the network attack graph and the network vulnerability information;

[0037] and quantifying the weights of the nodes of the network attack graph according to the exploitability of the vulnerability;

[0038] The attack path prediction model is used to obtain an attack path prediction model for the entire industrial control network based on the quantized network attack graph using the DDQN algorithm and the federated learning algorithm.

[0039] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of a method for generating an attack path prediction model based on a network attack graph.

[0040] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of generating an attack path prediction model based on a network attack graph.

[0041] Compared with the prior art, this application has at least the following beneficial effects:

[0042] The present application provides a method and device for generating an attack path prediction model based on a network attack graph. The method generates network vulnerability information of the entire industrial control network by acquiring industrial control network data and vulnerability data from the national vulnerability database, generates network attack graphs for each area of the industrial control network based on the network vulnerability information, extracts information required for adversarial training of the attack and defense game from the network attack graph and conducts adversarial training, obtains the probability of attack path selection, quantifies the weights of the directed edges of the network attack graph based on the attack path selection probability, calculates the vulnerability exploitability based on the network attack graph and the network vulnerability information, quantifies the weights of the nodes of the network attack graph based on the vulnerability exploitability, and uses the DDQN algorithm and the federated learning algorithm to train the attack path prediction model of the entire industrial control network based on the quantized network attack graph. The attack path prediction model trained by the present application can reasonably predict the attack paths of possible attacks in a known industrial control network, solving the problem of attack path prediction under a large-scale network structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] To more intuitively illustrate the prior art and the present application, several exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be considered as limiting conditions for implementing the present application; for example, based on the technical concepts disclosed in the present application and the exemplary drawings, those skilled in the art are capable of easily making routine adjustments or further optimizations to the addition / reduction / attribution division, specific shapes, positional relationships, connection methods, dimensional ratios, etc. of certain units (components).

[0044] Figure 1 A flowchart of a method for generating an attack path prediction model based on a network attack graph provided in Example 1 of the present application;

[0045] Figure 2 This is a schematic diagram of the structure of the attack path prediction model generated in Example 1 of the present application;

[0046] Figure 3 A schematic diagram of the structure of an attack path prediction model generation device based on a network attack graph provided in Example 2 of the present application. DETAILED DESCRIPTION

[0047] The present application will be further described below in detail through specific embodiments in conjunction with the accompanying drawings.

[0048] In the description of this application: unless otherwise specified, the meaning of "plurality" is two or more. The terms "first", "second", "third", etc. in this application are intended to distinguish the objects referred to and do not have any special meaning in terms of technical connotation (for example, they should not be understood as emphasizing the importance or order, etc.). Expressions such as "including", "comprising", "having", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).

[0049] Terms such as "upper," "lower," "left," "right," and "center" used in this application are generally intended to facilitate intuitive understanding when compared with the accompanying drawings and are not intended to be absolute limitations on positional relationships in actual products. Changes to these relative positional relationships are considered within the scope of this application without departing from the technical concepts disclosed herein.

[0050] With the continuous development of artificial intelligence (AI), more and more technical fields are incorporating AI technologies, achieving promising results. The Double DQN (DDQN) algorithm is an improvement on the DQN algorithm. DDQN is a value-based model-free learning algorithm. Q represents the policy quality function Q(s,a), which expresses the expected return of taking action a under a given state s. DQN uses the same neural network to generate target Q-values and estimated Q-values, and employs an experience replay mechanism to address data correlation. This approach decouples the selection process from the target Q-value calculation process, effectively addressing the overestimation of Q-values that often occurs in the DQN algorithm.

[0051] Federated learning is a distributed machine learning technology. Its core concept is to conduct distributed model training between data sources with local data. Federated learning does not require the exchange of local individual or sample data. Instead, it builds a global model by exchanging model parameters or intermediate results. Federated learning eliminates the need to collect raw data, reducing communication and computing costs while also effectively addressing data silos and privacy issues.

[0052] Example 1

[0053] See also Figure 1 This embodiment provides a method for generating an attack path prediction model based on a network attack graph, including:

[0054] S1: Obtain industrial control network data and vulnerability data from the national vulnerability database, and generate network vulnerability information for the entire industrial control network based on the industrial control network data and vulnerability data;

[0055] Specifically, industrial control network data includes industrial control network topology and industrial control vulnerability information.

[0056] S2: Generate network attack graphs for each area of the industrial control network based on network vulnerability information;

[0057] Specifically, the network attack graph is generated using the MulVAL tool. The network attack graph uses an attribute attack graph. The initial nodes are assigned probability values, and directed edges are used to represent the relationships between nodes. The conditional probabilities of other nodes can be derived based on the probability values of the initial nodes and the relationships between nodes.

[0058] When using MulVAL for network vulnerability analysis, Datalog language is used as the model language. Its input data includes:

[0059] Vulnerability warning,This embodiment uses the Open Vulnerability Assessment Language to,standardize the vulnerability definition, and then converts it into Datalog,language, for example: vulExists(webServer,′CAN-2002-0392′,httpd);

[0060] Host configuration: Use the OVAL scanner to extract host configuration parameters and convert them into Datalog language, for example: networkService(fileServer,nfsd,rpc,100003,root);

[0061] Network configuration, which models the network configuration as an abstract host access control list (HACL). This information can be provided by firewall management tools;

[0062] Subject, which maps subject symbols to their users on the network host;

[0063] Interactively, in a multi-stage attack, the semantics of the vulnerability and the operating system determine the adversary’s choices at each stage.

[0064] Based on the network vulnerability information input above, an unweighted Bayesian attack graph is generated using the Bayesian attack graph generation algorithm.

[0065] S3: Extract the information required for adversarial training of the attacker and defender from the network attack graph, and conduct adversarial training based on the extracted information to obtain the probability of attack path selection;

[0066] This step is designed to counteract the current multi-step attacks that are highly concealed and difficult to counter. At each stage of the attack-defense game, the attacker and defender each perform their own offensive and defensive actions and receive immediate rewards. The cumulative sum of the gains from each stage is the total gain for both parties over the entire confrontation. The goal of the attack-defense game is to maximize the total gain.

[0067] First, the generated network attack graph is used to extract the information required for the adversarial training of the attacker and defender, such as attack and defense actions, attack and defense strategies, attack and defense costs, and network status. The attack cost, attack benefit, defense cost, and defense benefit are calculated based on the information obtained. The attack cost and attack benefit of different vulnerabilities can be set with reference to the CVSS vulnerability score. The vulnerability defense cost can be calculated by the sum of the cost of collecting attack information, the adverse impact of the defense strategy on the system, and the implementation cost. The vulnerability defense benefit can be calculated as the sum of the inverse of the vulnerability's dangerousness and the value of the information left by the attacker.

[0068] The specific implementation steps of the offensive and defensive game confrontation training are as follows:

[0069] S301: The attacker and defender detect the current network status;

[0070] S302: The attacker and defender implement their respective attack and defense strategies in turn according to their expected strategy payoff functions;

[0071] S303: The attacker and defender calculate their respective actual gains;

[0072] S304: The network system enters the next security state;

[0073] S305: Repeat S301 to S304 until the offense and defense reach a balanced state.

[0074] By using this game model to learn and reason about different attack behaviors, we can eventually obtain the priority of a node in the network to choose different paths (i.e., the probability of attack path selection).

[0075] S4: Quantify the weights of directed edges in the network attack graph based on the attack path selection probability;

[0076] This step uses the attack path selection probability obtained from the game model to quantify the weights of the directed edges in the generated unweighted Bayesian attack graph. The weights of the directed edges in the network attack graph are the probability of attacking the subsequent node after the predecessor node vulnerability is successfully exploited.

[0077] S5: Calculate vulnerability exploitability based on the network attack graph and network vulnerability information;

[0078] Specifically, the vulnerability exploitability rate is calculated based on the direct vulnerability exploitability rate, historical vulnerability exploitability rate, and recommended vulnerability exploitability rate.

[0079] Direct vulnerability exploitability rate, by referring to the vulnerability data of the National Information Security Vulnerability Database, we obtain the CVSS2.0 security vulnerability basic scoring indicators, including the specific scores of attack path, attack complexity, authentication, confidentiality, integrity and availability, and then substitute them into the security vulnerability basic scoring formula to obtain the direct vulnerability exploitability rate Vdirect of vulnerability i i .

[0080] Historical vulnerability exploitability: When a node with a vulnerability in the network joins the network, it starts recording the interaction between the node and other nodes in the entire network and the event information of the attack, and obtains the historical reputation value of the node. i Obey the beta distribution, that is:

[0081]

[0082] In formula (1),

[0083]

[0084] In formula (2), α i represents the number of times node i successfully sends or receives data, β i Indicates the number of times node i fails to send or receive data.

[0085] Then calculate the historical vulnerability exploitability Vhistory based on the historical reputation value of the node where the vulnerability is located i :

[0086] Vhistory i =1-Thistory i (3)

[0087] Recommended vulnerability exploitability rate, calculated by the number of vulnerability exploitation events that occurred in the recent period of time i .

[0088] In summary, the vulnerability exploitability rate Vfinal i for:

[0089] Vfinal i =a×Vdirect i +b×Vhistory i+c×Vrecommend i (4)

[0090] In formula (4), a+b+c=1, a>b>c.

[0091] In the process of calculating vulnerability exploitability, the basic vulnerability exploitability calculated according to CVSS2.0 accounts for the highest proportion. This score reflects the severity of the vulnerability. The historical vulnerability exploitability and recommended vulnerability exploitability assess the severity of the vulnerability through past attack behaviors and simulation and speculation of future attack behaviors, and account for a lower proportion.

[0092] S6: Quantify the weights of network attack graph nodes according to vulnerability exploitability;

[0093] This step quantifies the weights of the nodes in the generated network attack graph according to the obtained vulnerability exploitability. The weight of the node is the vulnerability exploitability.

[0094] S7: Based on the quantized network attack graph, the DDQN algorithm and federated learning algorithm are used to train an attack path prediction model for the entire industrial control network.

[0095] This step uses a horizontal federated learning algorithm to complete the training of the attack path prediction model of the entire industrial control network, and uses a client / server architecture as the system architecture of federated learning. According to the regional division of the industrial control network, the participants of federated learning are divided into several different training parties. Each subnet can be used as a training party, and each training party is responsible for training the model of a region. Each training party calculates the gradient locally and sends the encrypted gradient to the aggregation server. The aggregation server performs secure aggregation and sends the aggregated results to each participant. Each participant decrypts the received gradient and updates their own model parameters. The specific federated learning model structure and the DDQN learning process of each training party are as follows. Figure 2 shown.

[0096] This embodiment formally describes the network vulnerability information of each region and the state space and action space of the optimal attack path problem, models the network attack process as a Markov decision model, uses the deep reinforcement learning DDQN algorithm to train the intelligent agent, and obtains the optimal attack path through interactive learning with the environment.

[0097] Among them, the Markov decision model is based on the four-tuple<S,A,R,T> It is characterized by the following formula: S represents the current network state; A represents the set of vulnerability exploitation operations that the agent can take when obtaining the current network authority, that is, the set of all successor nodes of the current node in the network attack graph; R represents the reward function for the agent to obtain the score after taking a certain operation; T represents the state transition function, that is, the weight of the edge in the attack graph with the current node as the starting node.

[0098] The purpose of the DDQN algorithm is to train a neural network. The current network state is input, and the neural network outputs a number of Q values, allowing the agent to select the action with the maximum Q value based on the neural network's output and enter the next state. To address the algorithm's slow delivery of rewards to the target state, a prioritized experience replay method is introduced. This method uses temporal differential deviation to measure the learning value of each experience. A memory space is used to store previous experiences. The experiences in the experience pool are sorted by the absolute value of the temporal differential deviation, and those with high deviation are selected to update the network.

[0099] The training process uses M rounds of training, and each round of training performs N attack actions. Each round of training is as follows:

[0100] First, the environment state is initialized, and the agent selects action a according to the current network state. n =argmax a Q(s n+1 ,a,θ), execute action a n , get the corresponding reward r n and the next state s n+1 , calculate (s n ,a n ,r n ,s n+1 ) and stores the sequence in the experience pool D; using the priority experience replay method, the sequence with high deviation (s i ,a i ,r i ,s i+1 ) is used as the quality function to calculate the target Q value, which is:

[0101]

[0102] In formula (5), θ i represents the parameters of the current Q network, and Represents the parameters of the target Q network.

[0103] Calculate the loss function, the loss function is:

[0104] L(θ i )=E (s,a,r,s′) [(r i+1 +γQ target (s t+1 ,argmax a ((s i+1 ,a)))-Q(s i ,a i )) 2 ] (6)

[0105] Update the target network parameters and repeat the above operations until N steps are reached. This round of training ends and the next round of training begins.

[0106] To address the federated optimization problem, this step uses the federated averaging algorithm, which can be applied to the non-convex loss function encountered in neural network training in the DDQN algorithm. The parameter ρ controls the proportion of participants performing computations in each round; the parameter S controls the number of training steps each participant takes on their local dataset in each round; and the parameter M sets the size of the mini-batch used by each participant during updates.

[0107] Update the global model parameters θ in the mth round of training m When the kth participant will calculate the current model parameter θ m The average gradient of local data The coordinator aggregates these gradients and updates the model parameter information Then the updated model parameters θ m+1 The parameters are sent to each participant, and the participant starts a new round of training based on the new parameters obtained.

[0108] To ensure the security of industrial control network information, the attack path prediction model generation method based on the network attack graph provided in this embodiment selects to independently draw the network attack graph of each area of the industrial control network, and uses a federated learning model to train the attack graph of each area to obtain the optimal attack path for the entire industrial control network. To improve the vulnerability utilization rate of the attack graph, which is 100% by default, the vulnerability exploitability rate of the nodes in the network is evaluated, thereby improving the accuracy of the network attack graph.

[0109] Example 2

[0110] See also Figure 3 This embodiment provides a device for generating an attack path prediction model based on a network attack graph, comprising:

[0111] A network vulnerability information acquisition module is used to obtain industrial control network data and vulnerability data from the national vulnerability database, and generate network vulnerability information of the entire industrial control network based on the industrial control network data and the vulnerability data;

[0112] An attack graph generation module, configured to generate a network attack graph for each area of the industrial control network based on the network vulnerability information;

[0113] An attack-defense game adversarial training module is used to extract information required for attack-defense game adversarial training from the network attack graph, and perform adversarial training based on the extracted information to obtain the attack path selection probability;

[0114] and quantifying the weights of directed edges of the network attack graph according to the attack path selection probability;

[0115] A vulnerability exploitability evaluation module, configured to calculate the vulnerability exploitability based on the network attack graph and the network vulnerability information;

[0116] and quantifying the weights of the nodes of the network attack graph according to the exploitability of the vulnerability;

[0117] The attack path prediction model is used to obtain an attack path prediction model for the entire industrial control network based on the quantized network attack graph using the DDQN algorithm and the federated learning algorithm.

[0118] Regarding the specific limitations of the device for generating an attack path prediction model based on a network attack graph, please refer to the limitations of the method for generating an attack path prediction model based on a network attack graph above, which will not be repeated here.

[0119] Example 3

[0120] This embodiment provides a computer device including a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of a method for generating an attack path prediction model based on a network attack graph are implemented.

[0121] Example 4

[0122] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program implements the steps of generating an attack path prediction model based on a network attack graph.

[0123] In summary, the method and device for generating an attack path prediction model based on a network attack graph provided by this application have the following advantages:

[0124] (1) Compared with the existing attack graph quantification method that generally adopts the vulnerability scoring system, the vulnerability assessment method of this application comprehensively considers the criticality of the node in the entire network, its own security, whether the node's software contains vulnerabilities in the national vulnerability database, whether it has been attacked or exists in the historical attack path, etc., and further divides the characteristics of the node into functional characteristics, performance characteristics and security characteristics. By performing a weighted sum operation on the node characteristics, the current confidence and historical confidence of the node are calculated, and the key nodes are evaluated to provide a quantified node exploitability.

[0125] (2) The attack and defense game confrontation training of this application uses the generated network attack graph to extract information used for the attack and defense game, and calculates the different vulnerability attack costs and benefits of each node as well as the defense costs and benefits. Both the attacker and the defender adopt the current optimal strategy to play the game until a balance is reached, and the benefits of selecting different attack paths are obtained as the weights of the attack graph edges. It can predict multi-step attacks that are highly concealed and difficult to deal with on the current network;

[0126] (3) The existing attack path analysis method based on attack graph performs poorly on large-scale networks. The attack path prediction module of this application combines the attack graph with deep reinforcement learning and adopts a federated learning model. Each subnet is used as a training party. Each training party uses the feature data of the local attack graph of the subnet to train the same neural network for predicting network attack paths; at the same time, each training party uses a link to upload gradient information to the server, and the server also needs to send the aggregated model parameters to each training party, thereby completing the entire industrial control network attack warning function.

[0127] The technical features of the above embodiments can be combined arbitrarily (as long as there is no contradiction in the combination of these technical features). In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described; these embodiments that are not explicitly written should also be considered to be within the scope of this specification.

[0128] The above description of the present application is relatively specific and detailed through general explanations and specific embodiments. It should be understood that, based on the technical concept of the present application, several conventional adjustments or further innovations can be made to these specific embodiments; however, as long as they do not deviate from the technical concept of the present application, the technical solutions obtained by such conventional adjustments or further innovations also fall within the scope of protection of the claims of the present application.

Claims

1. A method for generating an attack path prediction model based on a network attack graph, characterized in that: include: Step 1: Obtain industrial control network data and vulnerability data from a national vulnerability database, and generate network vulnerability information for the entire industrial control network based on the industrial control network data and the vulnerability data; Step 2: Generate a network attack graph for each area of the industrial control network based on the network vulnerability information; Step 3: Extracting information required for adversarial training of the attacker and defender from the network attack graph, and performing adversarial training based on the extracted information to obtain the probability of attack path selection; Step 4: quantifying the weights of directed edges of the network attack graph according to the attack path selection probability; Step 5: Calculate vulnerability exploitability based on the network attack graph and the network vulnerability information; Step 6: quantifying the weights of the nodes in the network attack graph according to the exploitability of the vulnerability; Step 7: Based on the quantized network attack graph, the DDQN algorithm and the federated learning algorithm are used to train an attack path prediction model for the entire industrial control network.

2. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: The network attack graph in step 2 is generated using MulVAL.

3. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: The network attack graph in step 2 is an unweighted Bayesian attack graph generated using a Bayesian attack graph generation algorithm.

4. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: In step 3, adversarial training is performed based on the extracted information, specifically including: Step 301: The attacker and defender detect the current network status; Step 302: The attacker and defender implement their respective attack and defense strategies in turn according to their expected strategy payoff functions; Step 303: The attacker and defender calculate their respective actual gains; Step 304: The network system enters the next security state; Step 305: Repeat steps 301 to 304 until the attack and defense reach a balanced state.

5. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: The vulnerability exploitability rate in step 5 is calculated based on the direct vulnerability exploitability rate, the historical vulnerability exploitability rate, and the recommended vulnerability exploitability rate.

6. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: The initial model of the attack path prediction model in step 7 is a Markov decision model.

7. The method for generating an attack path prediction model based on a network attack graph according to claim 1, wherein: The federated learning algorithm in step 7 is a federated averaging algorithm.

8. A device for generating an attack path prediction model based on a network attack graph, characterized in that: include: A network vulnerability information acquisition module is used to obtain industrial control network data and vulnerability data from the national vulnerability database, and generate network vulnerability information of the entire industrial control network based on the industrial control network data and the vulnerability data; An attack graph generation module, configured to generate a network attack graph for each area of the industrial control network based on the network vulnerability information; An attack-defense game adversarial training module is used to extract information required for attack-defense game adversarial training from the network attack graph, and perform adversarial training based on the extracted information to obtain the attack path selection probability; and quantifying the weights of directed edges of the network attack graph according to the attack path selection probability; A vulnerability exploitability evaluation module, configured to calculate the vulnerability exploitability based on the network attack graph and the network vulnerability information; and quantifying the weights of the nodes of the network attack graph according to the exploitability of the vulnerability; The attack path prediction model is used to obtain an attack path prediction model for the entire industrial control network based on the quantized network attack graph using the DDQN algorithm and the federated learning algorithm.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images