Attack path analysis method, system and medium based on risk association

Abstract

The present invention discloses an attack path analysis method, system and medium based on risk association, the method comprising: obtaining basic information from a vulnerability knowledge base according to a description of a system to be tested input by a user, the basic information including vulnerability vectors, attack condition vectors and network configuration vectors; identifying asset entities from the system to be tested according to the basic information; deploying an entity probe identification agent program at the gateway of each device in the system to be tested, deploying an entity probe program on a core network switching node, scanning and detecting asset entities existing in the system to be tested, and obtaining identification information; analyzing risk status information of the system to be tested based on an attack model according to the identification information; generating attack paths and forming a threat tree according to the risk status information and combining the correlation between asset risks. The present invention has high risk identification efficiency, comprehensive information collection, clear risk relationships and accurate risk analysis results.

Description

Technical Field

[0001] The present invention relates to the field of threat identification and risk analysis of interactive services on the user side of a power system, and in particular to a risk association-based attack path analysis method, system and medium. Background Art

[0002] As the construction of new power systems continues to accelerate, the connotation and extension of power systems continue to evolve and develop, massive distributed power sources, third-party terminals, load aggregators and other entities are connected to the power grid, and the interaction between the internal power network and the external Internet is becoming increasingly frequent. The power network space has transformed from a traditional relatively closed private network to a wide-area open network integrated with the Internet. The network security risks faced by new power systems in terms of access form, interaction mode, resource management and control are more severe, posing a huge challenge to power safety production. There are still many technical problems in network security that need to be solved urgently.

[0003] In order to cope with the network security challenges brought about by the more diverse participants in power grid business, more blurred network boundaries and the forward shift of some regulation and control functions of the power system under the background of new power system construction, it is necessary to identify risks and propose security strategies for non-controlled terminal businesses on the user side; second, it is necessary to realize the attack perception capability of the controllable edge devices' ontological business applications, and then execute convenient and accurate security management and control strategies under the condition of anchoring abnormal applications; third, it is necessary to realize refined real-time monitoring of user-side businesses and automated intelligent decision-making response capabilities.

[0004] Attack graph is a model-based network vulnerability assessment method. Attack graph technology can associate the vulnerabilities on each host in the network for in-depth analysis, discover the attack path that threatens network security and display it in the form of a graph. Security managers can use attack graphs to intuitively observe the relationship between various vulnerabilities in the network and choose the lowest cost to compensate for network vulnerabilities.

[0005] Due to the particularity of the power system, the traditional attack graph method is not accurate enough in analyzing the power system assets and risks, and it is difficult to reflect the real security status and attack path of the power system in a targeted manner. There may be problems such as low risk identification efficiency, incomplete information collection, and unclear risk relationships.

[0006] In view of this, this application is hereby filed. Summary of the invention

[0007] The technical problem to be solved by the present invention is that the traditional attack graph method is not accurate enough for the analysis of power system assets and risks, and it is difficult to reflect the real security status and attack path of the power system in a targeted manner. There may be problems such as low risk identification efficiency, incomplete information collection, and unclear risk relationships.

[0008] The purpose of the present invention is to provide an attack path analysis method, system and medium based on risk association. The method obtains the association between asset entities and risk status through system status detection, further obtains risk relationships and weights through attack behavior association, and finally generates attack paths to provide references for system security reinforcement, attack warning response, intrusion monitoring, etc. The present invention performs asset detection in the power system environment, has strong pertinence, and is suitable for new power system scenarios; adopts probes and agents to improve the comprehensiveness, effectiveness and detection accuracy through information encapsulation; adopts attack models and cluster analysis methods to effectively obtain attack path information; the present invention has high risk identification efficiency, comprehensive information collection, clear risk relationships, and accurate risk analysis results.

[0009] The present invention is achieved through the following technical solutions:

[0010] In a first aspect, the present invention provides an attack path analysis method based on risk association, the method comprising:

[0011] According to the description of the system to be tested input by the user, basic information is obtained from the vulnerability knowledge base. The basic information includes vulnerability vectors, attack condition vectors and network configuration vectors. According to the basic information, asset entities are identified from the system to be tested.

[0012] Deploy an entity probe identification agent program on the gateway of each device, and deploy an entity probe program at the core network switching node of the system to be tested to scan and detect the asset entities in the system to be tested to obtain identification information; the identification information includes the IP address, asset ID, asset type, etc. of the target asset entity;

[0013] According to the identification information, the risk status information of the system to be tested is analyzed based on the attack model; according to the risk status information, combined with the correlation between asset risks, the attack path is generated and a threat tree is formed.

[0014] Furthermore, the vulnerability vector describes six types of vulnerability indicators of the system under test: code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation;

[0015] The attack conditions describe the service operation status, login permissions, firewall rules, etc. of the system under test;

[0016] The network configuration describes the host IP address, network address, gateway configuration, routing algorithm, etc. of the system under test.

[0017] Furthermore, the asset entities existing in the system under test are scanned and detected to obtain identification information, including:

[0018] At a preset time interval t, the entity probe program sends detection information to the entity probe identification agent program in a broadcast manner; the data packet encapsulation format of the detection information is the data packet type, data packet length, IP address, first timestamp and first checksum; the IP address is the address of the detection party, and the timestamp is the time when the detection party initiates the detection;

[0019] The online entity probe identification agent receives the detection information and replies to the detection information with a response information; the data packet encapsulation format of the response information is data packet type, data packet length, IP address, asset identifier, asset type, risk status information, running time, second timestamp and second checksum;

[0020] The entity probe program parses the data packet of the response information to obtain the corresponding asset information; and replies the maintenance information to the entity probe identification agent program to establish a detection connection, providing a communication channel for subsequent risk assessment and attack path modeling; the data packet PM encapsulation format of the maintenance information is data packet type, data packet length, IP address, asset identification, first maintenance, second maintenance, third timestamp and third checksum.

[0021] Furthermore, the attack model is based on the existing threat modes to build possible attack modes associated with the asset entity and take corresponding defense measures.

[0022] Further, according to the identification information, the risk status information of the system to be tested is analyzed based on the attack model, including:

[0023] Take the asset entity corresponding to the asset identifier as the root node, find all asset entities that interact with the asset entity and form a related node set;

[0024] Analyze the risk status information of the system under test based on the attack model, which includes asset entities and various threats;

[0025] Find the attack entry objects in the relevant node set, analyze the threats faced by each node according to the attack model; and combine the correlation between asset risks to obtain the attack path;

[0026] By analyzing the direct risks and associated risks of each asset entity, a threat tree is formed; and the node and path information in the threat tree is filled into the maintenance field of the data packet PM of the maintenance information.

[0027] Furthermore, the steps for determining the correlation between asset risks are:

[0028] Step M: Set the current asset state set to A = {a1, a2, ..., a n}, the state set of the next adjacent asset node is B = {b1, b2, …, b m}, the relationship between A and B is R = {r1, r2, …, r mn}, r i is the association weight, given by domain experts; m and n are both positive integers;

[0029] Step N: Use the k-means algorithm to divide all the association states represented by the association relationship R between A and B into two clusters; and select a cluster with larger sample data, and repeat the k-means algorithm to perform the binary operation, and then enter step C after obtaining k clusters; wherein, the k-means algorithm is used to perform the binary operation, including:

[0030] Let V represent the initial unclassified space, and set the counter km=1;

[0031] Take a subcluster from V, denoted by N i , calculate the evaluation function where x i is the association weight of the actual observation; r i * is the expected value of the association weight;

[0032] Select a subcluster with the smallest SSE value of the evaluation function and add it to V, and increase the counter km+1 until km=k, and the algorithm terminates;

[0033] Step O: Determine the risk association relationship. For each association r in R j , 1≤r j ≤mn, calculate Select Δ j The one with the smallest value is added to the attack path; SSE* is the best among the SSE values ​​of the evaluation function.

[0034] Furthermore, the systems to be tested include the power collection system, distribution system, control system, etc. in the new power system.

[0035] In a second aspect, the present invention further provides an attack path analysis system based on risk association, the system using the above-mentioned attack path analysis method based on risk association; the system comprises:

[0036] A basic information acquisition unit, used to acquire basic information from a vulnerability knowledge base according to a description of the system to be tested input by a user, the basic information including vulnerability vectors, attack condition vectors and network configuration vectors;

[0037] An asset entity identification unit, used to identify the asset entity from the system under test based on basic information;

[0038] The detection unit is used to deploy an entity probe identification agent program at the gateway of each device in the system to be tested, deploy an entity probe program on the core network switching node, scan and detect the asset entities in the system to be tested, and obtain identification information; the identification information includes the IP address, asset ID, asset type, etc. of the target asset entity;

[0039] A risk status information analysis unit, used to analyze the risk status information of the system to be tested based on the attack model according to the identification information;

[0040] The attack path and threat tree forming unit is used to generate an attack path and form a threat tree based on risk status information and the correlation between asset risks.

[0041] Furthermore, the vulnerability vector describes six types of vulnerability indicators of the system under test: code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation;

[0042] The attack conditions describe the service operation status, login permissions, firewall rules, etc. of the system under test;

[0043] The network configuration describes the host IP address, network address, gateway configuration, routing algorithm, etc. of the system under test.

[0044] In a third aspect, the present invention further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned risk association-based attack path analysis method is implemented.

[0045] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0046] 1. The present invention performs asset detection in the power system environment, has strong pertinence, and is applicable to new power system scenarios;

[0047] 2. The present invention adopts probe and agent mode, and improves the comprehensiveness, effectiveness and detection accuracy through information encapsulation;

[0048] 3. The present invention adopts the attack model and cluster analysis method to effectively obtain the attack path information;

[0049] 4. The present invention has high risk identification efficiency, comprehensive information collection, clear risk relationships and accurate risk analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0051] Figure 1This is a flow chart of the attack path analysis method based on risk association of the present invention;

[0052] Figure 2 The attack path analysis method and system structure diagram based on risk association of the present invention;

[0053] Figure 3 A diagram showing the data packet encapsulation format of the detection information of the present invention;

[0054] Figure 4 It is a data packet encapsulation format diagram of the response information of the present invention;

[0055] Figure 5 A diagram of a data packet encapsulation format for maintenance information of the present invention;

[0056] Figure 6 This is the attack model diagram of the present invention;

[0057] Figure 7 This is a schematic diagram of the threat tree of the present invention;

[0058] Figure 8 This is a structural block diagram of the attack path analysis system based on risk association of the present invention. DETAILED DESCRIPTION

[0059] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0060] Due to the particularity of the power system, the traditional attack graph method is not accurate enough in analyzing the power system assets and risks, and it is difficult to reflect the real security status and attack path of the power system in a targeted manner. There may be problems such as low risk identification efficiency, incomplete information collection, and unclear risk relationships.

[0061] In view of the above problems, the present invention designs an attack path analysis method, system and medium based on risk association. The method obtains the association between asset entities and risk status through system status detection, further obtains risk relationship and weight through attack behavior association, and finally generates an attack path to provide a reference for system security reinforcement, attack warning response, intrusion monitoring, etc.

[0062] The present invention performs asset detection on the power system environment, has strong pertinence, and is suitable for new power system scenarios; adopts probe and agent methods, and improves the comprehensiveness, effectiveness and detection accuracy through information encapsulation; adopts attack model and cluster analysis methods to effectively obtain attack path information; the present invention has high risk identification efficiency, comprehensive information collection, clear risk relationship, and accurate risk analysis results.

[0063] Example 1

[0064] like Figure 1 As shown, the present invention is based on the risk association attack path analysis method, the method comprises:

[0065] Step 1: According to the description of the system to be tested input by the user, basic information is obtained from the vulnerability knowledge base. The basic information includes the vulnerability vector vul = {v1, v2, ..., v n}、Attack condition vector con={con1,con2,…,con n} and network configuration vector cfg = {cfg1, cfg2, ..., cfg n}; Based on the basic information, identify the asset entity from the system under test;

[0066] Among them, the vulnerability vector describes six types of vulnerability indicators of the system under test: code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation;

[0067] The attack conditions describe the service operation status, login permissions, firewall rules, etc. of the system under test;

[0068] The network configuration describes the host IP address, network address, gateway configuration, routing algorithm, etc. of the system under test.

[0069] Step 2, asset entity detection process: Before the system to be tested is deployed, an entity probe identification agent is deployed on the gateway of each device, and an entity probe program is deployed at the core network switching node of the system to be tested to scan and detect the asset entities in the system to be tested to obtain identification information; the identification information includes the IP address, asset ID, asset type, etc. of the target asset entity;

[0070] The detection parameters are set according to the network configuration vector cfg. The specific detection process is as follows:

[0071] (1) At a preset time interval t, the entity probe program broadcasts a group detection message Hello to the entity probe identification agent program; Figure 3 As shown, the data packet encapsulation format of the detection information is data packet type, data packet length, IP address, first timestamp and first checksum; type field Type (data packet type), Type=1 means detection; length LEN (data packet length), in bytes; IP address is the address of the detection party, and the first timestamp T1 is the time when the detection party initiates the detection; the first checksum Chk1 is implemented using a general algorithm.

[0072] Among them, the entity probe identification agent is deployed on the gateway node, responsible for detecting directly connected asset information from the network data packets flowing through, such as MAC address, asset identification, asset type, etc. The entity probe program is deployed on the core network switching node, and realizes the detection of asset entities and the issuance of instructions by communicating with the entity probe identification agent.

[0073] (2) The online entity probe identification agent receives the detection information and replies to the detection information with a response message res-Hello; the data packet of the response information includes six data items: IP address, asset identifier, asset type, risk status information, running time, and timestamp; Figure 4 As shown, the data packet encapsulation format of the response information is data packet type, data packet length, IP address, asset identifier, asset type, risk status information, running time, second timestamp and second checksum;

[0074] Among them, the type field Type (data packet type), Type=2 indicates a response; the length LEN (data packet length) is in bytes; and the second checksum Chk2 is implemented using a general algorithm.

[0075] (3) The entity probe program parses the response information data packet to obtain the corresponding asset information; and replies to the entity probe identification agent program with maintenance information, establishes a detection connection, and provides a communication channel for subsequent risk assessment and attack path modeling; Figure 5 As shown, the PM encapsulation format of the maintenance information data packet is data packet type, data packet length, IP address, asset identifier, first maintenance, second maintenance, ..., third timestamp and third checksum.

[0076] Among them, the type field Type (packet type), Type=2 indicates response; the length LEN (packet length) is in bytes; the maintenance field (first maintenance, second maintenance, ..., etc.) can be expanded as needed; the third checksum Chk2 is implemented using a general algorithm.

[0077] Step 3, risk status identification process: According to the identification information, the risk status information of the system to be tested is analyzed based on the attack model; according to the risk status information, combined with the correlation between asset risks, attack paths of different risk levels are generated and a threat tree is formed. Among them, the identification parameters are set according to the vulnerability vector vul and the attack condition vector con.

[0078] The steps to construct a threat tree are as follows:

[0079] Step 1: Take the asset entity corresponding to the asset identifier Z-ID as the root node, and find all asset entities that interact with the asset entity to form a related node set;

[0080] Root node: Z-ID,

[0081] Related nodes: Z1, Z2, …, Zt.

[0082] Step 2: Analyze the risk status information of the system under test based on the attack model, where the risk status information includes asset entities and various threats;

[0083] like Figure 6 As shown, the attack model is provided by security experts, which builds possible attack methods associated with asset entities based on existing threat methods and takes corresponding defense measures.

[0084] The results of this step are as follows:

[0085] Risk Status:

[0086] Z1: a1, a2, a3, ... / / Asset entity Z1 (such as smart meter): eavesdropping threat a1, forgery threat a2, denial threat a3, ...

[0087] Z2: b1, b2, b3, …

[0088] Z3: c1, c2, c3, ...

[0089] …

[0090] Zt: x1, x2, x3, ...

[0091] Step 3: Find the attack entry objects in the relevant node set, analyze the threats faced by each node according to the attack model, and combine the correlation between asset risks to obtain the attack path; Figure 7 shown.

[0092] Step 4: Analyze the direct risks and associated risks of each asset entity to form a threat tree; and fill the node and path information in the threat tree into the maintenance field of the maintenance information data packet PM. The format is as follows:

[0093] Pi = {asset status || next node}

[0094] Among them, || represents string concatenation; the number of maintenance fields can be changed according to the length of the attack path.

[0095] As a further implementation, the steps to determine the correlation between asset risks are:

[0096] Step M: Set the current asset state set to A = {a1, a2, ..., a n}, the state set of the next adjacent asset node is B = {b1, b2, …, b m}, the relationship between A and B is R = {r1, r2, …, r mn}, r i is the association weight, given by domain experts; m and n are both positive integers;

[0097] Step N: Use the k-means algorithm with a parameter of 2 to divide all the association states represented by the association relationship R between A and B into two clusters; and select a cluster with a larger sample data, and repeat the k-means algorithm to perform the binary operation, and then enter step C after obtaining k clusters; wherein, the k-means algorithm is used to perform the binary operation, including:

[0098] Let V represent the initial unclassified space, and set the counter km=1;

[0099] Take a subcluster from V, denoted by N i , calculate the evaluation function where x i is the association weight of the actual observation; r i * is the expected value of the association weight;

[0100] Select a subcluster with the smallest SSE value of the evaluation function and add it to V, and increase the counter km+1 until km=k, and the algorithm terminates;

[0101] Step O: Determine the risk association relationship. For each association r in R j , 1≤r j ≤mn, calculate Select Δ j The one with the smallest value is added to the attack path; SSE* is the best among the SSE values ​​of the evaluation function.

[0102] As a further implementation, in a specific implementation, the system to be tested includes a power collection system, a power distribution system, a control system, etc. in a new power system, and any of the above systems can use the method of the present invention to perform attack path analysis.

[0103] Example 2

[0104] like Figure 8 As shown, the difference between this embodiment and embodiment 1 is that this embodiment further provides an attack path analysis system based on risk association, which uses the attack path analysis method based on risk association of embodiment 1; the system includes:

[0105] A basic information acquisition unit, used to acquire basic information from a vulnerability knowledge base according to a description of the system to be tested input by a user, the basic information including vulnerability vectors, attack condition vectors and network configuration vectors;

[0106] An asset entity identification unit, used to identify the asset entity from the system under test based on basic information;

[0107] The detection unit is used to deploy an entity probe identification agent program at the gateway of each device in the system to be tested, deploy an entity probe program on the core network switching node, scan and detect the asset entities in the system to be tested, and obtain identification information; the identification information includes the IP address, asset ID, asset type, etc. of the target asset entity;

[0108] A risk status information analysis unit, used to analyze the risk status information of the system to be tested based on the attack model according to the identification information;

[0109] The attack path and threat tree forming unit is used to generate an attack path and form a threat tree based on risk status information and the correlation between asset risks.

[0110] In this embodiment, the vulnerability vector describes six types of vulnerability indicators of the system under test: code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation;

[0111] The attack conditions describe the service operation status, login permissions, firewall rules, etc. of the system under test;

[0112] The network configuration describes the host IP address, network address, gateway configuration, routing algorithm, etc. of the system under test.

[0113] Among them, the execution process of each unit can be executed according to the process steps of the attack path analysis method based on risk association in Example 1, and will not be repeated one by one in this embodiment.

[0114] At the same time, the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned attack path analysis method based on risk association is implemented.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. The attack path analysis method based on risk association is characterized by: The method includes: According to the description of the system to be tested input by the user, basic information is obtained from the vulnerability knowledge base, wherein the basic information includes vulnerability vectors, attack condition vectors, and network configuration vectors; and according to the basic information, asset entities are identified from the system to be tested; Deploy an entity probe identification agent program at the gateway of each device in the system to be tested, deploy an entity probe program on the core network switching node, scan and detect asset entities existing in the system to be tested, and obtain identification information; According to the identification information, risk status information of the system to be tested is analyzed based on the attack model; according to the risk status information, combined with the correlation relationship between asset risks, an attack path is generated and a threat tree is formed; The steps for determining the correlation between the asset risks are as follows: Step M: Set the current asset state set to A = {a1, a2, ..., a n }, the state set of the next adjacent asset node is B = {b1, b2, ..., b m }, the relationship between A and B is R = {r 11 ,r 12 ,...,r ij ,...,r mn }, r ij is the association weight, given by domain experts; m and n are both positive integers; Step N: Use the k-means algorithm to divide all the association states represented by the association relationship R between A and B into two clusters; and select a cluster with larger sample data, and repeat the k-means algorithm to perform the binary operation, and then enter step C after obtaining k clusters; wherein, the k-means algorithm is used to perform the binary operation, including: Let V represent the initial unclassified space, and set the counter km=1; Take a subcluster from V, denoted by N i , calculate the evaluation function where x i is the association weight of the actual observation; r i * is the expected value of the association weight; Select a subcluster with the smallest SSE value of the evaluation function and add it to V, and increase the counter km+1 until km=k, and the algorithm terminates; Step O: Determine the risk association relationship. For each association r in R j , 1≤r j ≤mn, calculate Select Δ j The one with the smallest value is added to the attack path; SSE* is the best among the SSE values ​​of the evaluation function.

2. The attack path analysis method based on risk association according to claim 1 is characterized in that: The vulnerability vector describes six types of vulnerability indicators of the system under test, namely, code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation. The attack condition vector describes the service operation status, login permissions, and firewall rules of the system to be tested; The network configuration vector describes the host IP address, network address, gateway configuration, and routing algorithm of the system under test.

3. The attack path analysis method based on risk association according to claim 1 is characterized in that: Scan and detect asset entities in the system under test to obtain identification information, including: At preset time intervals, the entity probe program broadcasts detection information to the entity probe identification agent program in batches in a broadcast manner; the data packet encapsulation format of the detection information is data packet type, data packet length, IP address, first timestamp and first checksum; the IP address is the address of the detection party, and the timestamp is the time when the detection party initiates the detection; The entity probe identification agent receives the detection information and replies to the detection information with a response information; the data packet encapsulation format of the response information is data packet type, data packet length, IP address, asset identifier, asset type, risk status information, running time, second timestamp and second checksum; The entity probe program parses the data packet of the response information to obtain the corresponding asset information; and replies maintenance information to the entity probe identification agent program to establish a detection connection, providing a communication channel for subsequent risk assessment and attack path modeling; the data packet encapsulation format of the maintenance information is data packet type, data packet length, IP address, asset identification, first maintenance, second maintenance, third timestamp and third checksum.

4. The attack path analysis method based on risk association according to claim 1 is characterized in that: The attack model is based on existing threat modes to build possible attack modes associated with asset entities and take corresponding defense measures.

5. The attack path analysis method based on risk association according to claim 4 is characterized in that: According to the identification information, risk status information of the system to be tested is analyzed based on the attack model, including: Take the asset entity corresponding to the asset identifier as the root node, find all asset entities that interact with the asset entity and form a related node set; Analyze risk status information of the system under test based on the attack model, wherein the risk status information includes asset entities and various threats; Find the attack entry object in the relevant node set, analyze the threat faced by each node according to the attack model; and obtain the attack path by combining the correlation between asset risks; A threat tree is formed by analyzing the direct risk and associated risk of each asset entity; and the node and path information in the threat tree is filled into the maintenance field of the data packet of the maintenance information.

6. The attack path analysis method based on risk association according to claim 1 is characterized in that: The system to be tested includes the power collection system, distribution system and control system in the new power system.

7. The attack path analysis system based on risk association is characterized by: The system includes: A basic information acquisition unit, used to acquire basic information from a vulnerability knowledge base according to a description of the system to be tested input by a user, wherein the basic information includes a vulnerability vector, an attack condition vector and a network configuration vector; An asset entity identification unit, used to identify the asset entity from the system to be tested according to the basic information; The detection unit is used to deploy an entity probe identification agent program at the gateway of each device in the system to be tested, deploy an entity probe program on the core network switching node, scan and detect asset entities existing in the system to be tested, and obtain identification information; A risk status information analysis unit, configured to analyze the risk status information of the system to be tested based on the attack model according to the identification information; An attack path and threat tree forming unit, used to generate an attack path and form a threat tree according to the risk status information and in combination with the correlation relationship between asset risks; The steps for determining the correlation between the asset risks are as follows: Step M: Set the current asset state set to A = {a1, a2, ..., a n }, the state set of the next adjacent asset node is B = {b1, b2, ..., b m }, the relationship between A and B is R = {r 11 ,r 12 ,...,r ij ,...,r mn }, r ij is the association weight, given by domain experts; m and n are both positive integers; Step N: Use the k-means algorithm to divide all the association states represented by the association relationship R between A and B into two clusters; and select a cluster with larger sample data, and repeat the k-means algorithm to perform the binary operation, and then enter step C after obtaining k clusters; wherein, the k-means algorithm is used to perform the binary operation, including: Let V represent the initial unclassified space, and set the counter km=1; Take a subcluster from V, denoted by N i , calculate the evaluation function where x i is the association weight of the actual observation; r i * is the expected value of the association weight; Select a subcluster with the smallest SSE value of the evaluation function and add it to V, and increase the counter km+1 until km=k, and the algorithm terminates; Step O: Determine the risk association relationship. For each association r in R j , 1≤r j ≤mn, calculate Select Δ j The one with the smallest value is added to the attack path; SSE* is the best among the SSE values ​​of the evaluation function.

8. The risk association-based attack path analysis system according to claim 7, characterized in that: The vulnerability vector describes six types of vulnerability indicators of the system under test, namely, code, configuration, environment, software, hardware, and network. The vulnerability vector is selected by the user according to the business situation. The attack condition vector describes the service operation status, login permissions, and firewall rules of the system to be tested; The network configuration vector describes the host IP address, network address, gateway configuration, and routing algorithm of the system under test.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the attack path analysis method based on risk association as described in any one of claims 1 to 6 is implemented.

Images