Methods, apparatus, media and equipment for repairing electronic equipment within the target industrial control network
By acquiring information on vulnerabilities and attack types in electronic devices and determining critical attack type scores, the problem of a lack of scientific basis for patching electronic device vulnerabilities is solved, improving accuracy and efficiency and ensuring the security of industrial control networks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HANGZHOU GUYI NETWORK TECH CO LTD
- Filing Date
- 2024-02-19
- Publication Date
- 2026-05-26
AI Technical Summary
The lack of clear remediation solutions for vulnerabilities in different electronic devices in the current technology has affected the normal operation of electronic devices and the security of industrial control networks.
By acquiring vulnerability sets and attack type sets of electronic devices, we can identify key attack types and their scores, determine the urgency of remediation based on the scores, and carry out targeted remediation.
It enables accurate assessment and orderly repair of vulnerabilities in electronic devices, improves the accuracy and efficiency of vulnerability repair, and maintains the security of industrial control networks.
Smart Images
Figure CN118054945B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security testing technology, and in particular to a method, apparatus, medium and electronic equipment for repairing electronic equipment within a target industrial control network. Background Technology
[0002] With the development of information technology, vulnerabilities in electronic devices within industrial control networks (ICS) have become increasingly prominent, severely impacting the security and stability of electronic devices and even the entire ICS network. Therefore, patching these vulnerabilities is crucial. However, current technologies lack clear solutions for patching different electronic device vulnerabilities. This lack of scientific basis for vulnerability patching may affect the normal operation of electronic devices and could even lead to ICS network security incidents. Summary of the Invention
[0003] The technical problem this application aims to solve is: how to perform targeted repairs for different electronic device vulnerabilities, thereby improving the accuracy and efficiency of electronic device vulnerability repair.
[0004] To address the aforementioned technical problems, according to the first aspect of this application, a method for repairing electronic devices within a target industrial control network is provided, comprising:
[0005] S100, acquire the vulnerabilities existing in the electronic device to be tested, so as to obtain the target vulnerability set D = (D1, D2, ..., Di, ..., Dn); i = 1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability existing in the electronic device to be tested; n is the number of target vulnerabilities existing in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network;
[0006] S200, obtain the attack steps corresponding to each of the several preset attack types to obtain the attack type set G = (G1, G2, ..., Gj, ..., Gm); j = 1, 2, ..., m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj = (Gj1, Gj2, ..., Gja, ..., Gjf(j)); a = 1, 2, ..., f(j); where Gja is the preset a-th attack step of the j-th attack type; f(j) is the number of attack steps of the j-th attack type.
[0007] S300, based on D and G, we obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq); p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; a critical attack type contains at least one attack step corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack steps of the p-th critical attack type; Mpb is the b-th critical attack step of the p-th critical attack type; a critical attack step is the attack step corresponding to the target vulnerability.
[0008] S400, based on M, we obtain the critical attack type score set E = (E1, E2, ..., Ep, ..., Eq); where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep = e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; Kp represents the severity score corresponding to Fp;
[0009] S500, based on E, determines the repair urgency level of the electronic device under test as ED;
[0010] S600, based on ED, determines the repair urgency level of the electronic device under test and repairs the electronic device under test.
[0011] According to a second aspect of this application, an electronic device repair apparatus within a target industrial control network is provided, comprising:
[0012] The vulnerability acquisition module is used to acquire vulnerabilities in the electronic device to be tested, so as to obtain a target vulnerability set D = (D1, D2, ..., Di, ..., Dn); i = 1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability in the electronic device to be tested; n is the number of target vulnerabilities in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network.
[0013] The type acquisition module is used to acquire the attack links corresponding to each of several preset attack types, so as to obtain the attack type set G = (G1, G2, ..., Gj, ..., Gm); j = 1, 2, ..., m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj = (Gj1, Gj2, ..., Gja, ..., Gjf(j)); a = 1, 2, ..., f(j); where Gja is the preset j-th attack type a-th attack link; f(j) is the preset j-th attack type number of attack links;
[0014] The critical type acquisition module is used to obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq) based on D and G; p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; a critical attack type contains at least one attack link corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack links of the p-th critical attack type; Mpb is the b-th critical attack link of the p-th critical attack type; a critical attack link is the attack link corresponding to the target vulnerability;
[0015] The scoring determination module is used to obtain the critical attack type score set E = (E1, E2, ..., Ep, ..., Eq) based on M; where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep = e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; Kp represents the severity score corresponding to Fp;
[0016] The repair score acquisition module is used to determine the repair urgency score ED of the electronic device under test based on E.
[0017] The repair module is used to determine the repair urgency level of the electronic device under test based on the ED (Emergency Detection) and to repair the electronic device under test.
[0018] According to a third aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, and the at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned method for repairing electronic equipment within an industrial control network.
[0019] According to a fourth aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.
[0020] This application has at least the following beneficial effects:
[0021] The method for repairing electronic devices within a target industrial control network provided in this application involves the following steps: First, vulnerabilities in the electronic device under test are identified to obtain a target vulnerability set D. Here, for the industrial control network containing the electronic device under test, there may be several electronic devices with vulnerabilities; each target vulnerability corresponds to at least one attack link. Second, the attack links corresponding to each of several preset attack types are obtained to obtain an attack type set G. Then, based on D and G, a critical attack type set M is obtained. Here, based on the vulnerabilities in the electronic device under test and several preset attack types, several critical attack types are determined, each critical attack type containing at least one attack link corresponding to any target vulnerability; that is, critical attack types are attack types that may launch attacks on the electronic device under test. Afterwards, a critical attack type score is obtained for each critical attack type based on the completeness of the attack chain (the proportion of its critical attack links to the total attack links) and the severity score of each critical attack type. Here, the higher the completeness of the attack chain of a critical attack type, the greater the likelihood that the critical attack type will launch an attack on the electronic device under test. Each preset attack type has a corresponding severity score, meaning that the degree of harm posed by each preset attack type to the electronic device under test is different. The higher the severity score of a preset attack type, the greater its harm to the electronic device under test, and vice versa. Therefore, in this application, when scoring each key attack type, not only the completeness of the attack chain for each key attack type is considered, but also the severity score of each key attack type. If the severity score of a certain key attack type is low, it means that if the electronic device under test is attacked by that key attack type, the degree of harm to the electronic device under test and its associated devices is low; even if its attack chain completeness is high (the probability of the electronic device under test being attacked by that key attack type is high), the overall harm to the electronic device under test is still low. Conversely, if the severity score of a certain key attack type is high, it means that if the electronic device under test is attacked by that key attack type, the degree of harm to the electronic device under test and its associated devices is high; even if its attack chain completeness is low (the probability of the electronic device under test being attacked by that key attack type is low), the overall harm to the electronic device under test is still low (the probability of occurrence is low). Next, a repair urgency score is obtained for the electronic device under test. Finally, based on the repair urgency score, the repair urgency level of the electronic device under test is determined, and different repair methods are set for electronic devices under test with different repair urgency levels.This application considers both the severity score and the attack chain integrity for each critical attack type. Compared to considering only the attack chain integrity, it also considers the severity of the attack type on the tested electronic device and its associated devices, resulting in a more accurate comprehensive severity assessment of the critical attack type based on the urgency score. Furthermore, different repair methods are set for electronic devices with different repair urgency levels. This enables accurate assessment of the vulnerability of electronic devices and allows for orderly repair based on the repair urgency, thus better maintaining the security environment of the tested electronic device and its associated industrial control network. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 A flowchart illustrating a method for repairing electronic devices within a target industrial control network, as provided in one embodiment of this application;
[0024] Figure 2 This is a structural block diagram of an electronic device repair device within a target industrial control network, provided as an embodiment of this application. Detailed Implementation
[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0026] like Figure 1 As shown, an embodiment of this application provides a method for repairing electronic devices within a target industrial control network, comprising:
[0027] S100, acquire the vulnerabilities existing in the electronic device to be tested, so as to obtain the target vulnerability set D = (D1, D2, ..., Di, ..., Dn); i = 1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability existing in the electronic device to be tested; n is the number of target vulnerabilities existing in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network.
[0028] Specifically, the electronic device to be tested can be any vulnerable electronic device within the target industrial control network. All vulnerabilities present in the electronic device to be tested are identified as target vulnerabilities, resulting in D. Here, each target vulnerability corresponds to at least one attack stage, and multiple attack stages can constitute an attack type.
[0029] S200, obtain the attack links corresponding to each of the several preset attack types to obtain the attack type set G = (G1, G2, ..., Gj, ..., Gm); j = 1, 2, ..., m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj = (Gj1, Gj2, ..., Gja, ..., Gjf(j)); a = 1, 2, ..., f(j); where Gja is the preset a-th attack link of the j-th attack type; f(j) is the number of attack links of the j-th attack type.
[0030] Specifically, each of the several preset attack types has at least one corresponding attack step. All attack steps corresponding to each attack type are obtained. Here, the aforementioned vulnerability corresponds to at least one attack step in G, while the electronic device under test may have multiple vulnerabilities. That is, vulnerabilities in the electronic device under test may correspond to different attack types. Here, different attack types may cause different attack intensities (severity of harm) to the electronic device under test or other associated devices of the electronic device under test.
[0031] S300, based on D and G, we obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq); p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; a critical attack type contains at least one attack step corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack steps of the p-th critical attack type; Mpb is the b-th critical attack step of the p-th critical attack type; a critical attack step is the attack step corresponding to the target vulnerability.
[0032] Specifically, based on the attack links corresponding to all target vulnerabilities of the electronic device under test, key attack types that can be matched with the electronic device under test are determined. A key attack type is one that contains at least one attack link corresponding to any target vulnerability of the electronic device under test. Each key attack type also includes several key attack links; and each key attack link is the attack link corresponding to the target vulnerability. Here, based on the attack links corresponding to all target vulnerabilities of the electronic device under test, key attack types containing attack links corresponding to any target vulnerability and key attack links corresponding to each key attack type are determined. Therefore, a key attack type indicates that the electronic device under test is more likely to be attacked by that attack type. That is, the more key attack types the electronic device under test corresponds to, the more different attack types the electronic device under test may be attacked by, indicating that the electronic device under test and its associated devices are more vulnerable; here, associated devices are other electronic devices that can directly communicate with and control the electronic device under test. On the other hand, for two different key attack types, the more key attack links they contain, the greater the likelihood that that key attack type will attack the electronic device under test.
[0033] S400, based on M, we obtain the critical attack type score set E = (E1, E2, ..., Ep, ..., Eq); where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep = e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; and Kp represents the severity score corresponding to Fp.
[0034] Specifically, for each critical attack type, the higher the completeness of its attack chain (the proportion of its critical attack link to the total attack links), the greater the likelihood that the critical attack type will attack the electronic device under test. Conversely, for critical attack types with a very low degree of attack chain completeness, the likelihood that the critical attack type will attack the electronic device under test is very low.
[0035] Each preset attack type has a corresponding severity score, meaning that the degree of harm posed by each preset attack type to the electronic device under test is different. The higher the severity score of a preset attack type, the greater its harm to the electronic device under test, and vice versa. Therefore, in this embodiment, when scoring each key attack type, not only the completeness of the attack chain for each key attack type is considered, but also the severity score of each key attack type. For example, if the severity score of a certain key attack type is low, it means that if the electronic device under test is attacked by this key attack type, the degree of harm to the electronic device under test and its associated devices is low; even if its attack chain completeness is high (the probability of the electronic device under test being attacked by this key attack type is high), the overall harm to the electronic device under test is still low. Conversely, if the severity score of a certain key attack type is high, it means that if the electronic device under test is attacked by this key attack type, the degree of harm to the electronic device under test and its associated devices is high; even if its attack chain completeness is low (the probability of the electronic device under test being attacked by this key attack type is low), the overall harm to the electronic device under test is still low (the probability of occurrence is low).
[0036] In summary, in this embodiment, the critical attack type score for critical attack types considers both the severity score corresponding to each critical attack type and the completeness of the attack chain corresponding to each critical attack type. Compared to only considering the completeness of the attack chain corresponding to each critical attack type, this approach considers both the possibility of being attacked by that critical attack type and the severity of that critical attack type, resulting in a more accurate comprehensive severity assessment of the critical attack type.
[0037] In one exemplary embodiment of this application, Ep may also satisfy the following condition: Ep = e Wp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type.
[0038] Specifically, this embodiment determines the critical attack type score of the electronic device under test based on the completeness of the attack chain. According to the function trend, for the electronic device under test, when the completeness of the attack chain corresponding to a certain critical attack type is low, the probability of the electronic device under test being attacked by that critical attack type is relatively small; conversely, as the completeness of the attack chain corresponding to a critical attack type increases, the probability of the electronic device under test being attacked by that critical attack type increases significantly, and this increase is faster than the increase trend when the attack chain completeness is low. In other words, the more complete the attack chain corresponding to a critical attack type becomes, the faster the probability of it attacking the electronic device under test increases. This achieves accurate evaluation of the critical attack type score of the electronic device under test.
[0039] In one exemplary embodiment of this application, Ep may also satisfy the following condition: Ep = e GpWp Where Gp is the total device impact value of all associated devices corresponding to the electronic device under test; the associated devices communicate directly with and control the electronic device under test; Wp is the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp is the number of attack links corresponding to the p-th critical attack type.
[0040] Specifically, within the industrial control network where the electronic device under test is located, the electronic device under test has corresponding associated devices (electronic devices that can communicate directly with and control the electronic device under test); each associated device of the electronic device under test has a corresponding device influence value, that is, the influence value of the electronic device under test. Here, the larger the device influence value of the associated devices of the electronic device under test, the greater the harm to the electronic device under test and its associated devices if the electronic device under test is attacked by a certain key attack type.
[0041] Therefore, in this embodiment, when scoring each critical attack type, not only the completeness of the attack chain for each critical attack type is considered, but also the total device impact value of all associated devices corresponding to the electronic device under test. For example, if the total device impact value of a certain critical attack type is low, it means that if the electronic device under test is attacked by that critical attack type, the degree of harm to the electronic device under test and its associated devices is low; even if its attack chain completeness is high (the probability of the electronic device under test being attacked by that critical attack type is high), the overall harm to the electronic device under test is still low. Conversely, if the total device impact value of a certain critical attack type is high, it means that if the electronic device under test is attacked by that critical attack type, the degree of harm to the electronic device under test and its associated devices is high; even if its attack chain completeness is low (the probability of the electronic device under test being attacked by that critical attack type is low), the overall harm to the electronic device under test is still low (the probability of occurrence is low).
[0042] In summary, this embodiment considers both the total device impact value corresponding to each critical attack type and the completeness of the attack chain corresponding to each critical attack type when scoring the critical attack type. Compared to only considering the completeness of the attack chain corresponding to each critical attack type, this embodiment takes into account the probability of being attacked by the critical attack type and also considers the degree of harm of the critical attack type to the electronic device under test and its associated devices. The comprehensive harm of the critical attack type represented by the obtained critical attack type score is more accurate.
[0043] S500, based on E, determines the urgency level of repair for the electronic device under test, categorized as ED.
[0044] Specifically, step S500 includes:
[0045] S510, obtain the key attack type scores in E that are greater than the preset attack type score, and obtain the target attack type score set B = (B1, B2, ..., Bc, ..., Bd); c = 1, 2, ..., d; where Bc is the key attack type score of the c-th key attack type score that is greater than the preset attack type score; y is the number of key attack type scores that are greater than the preset attack type score; d ≤ q.
[0046] Here, since different preset attack types may contain some common basic attack links, a particular attack link corresponding to a vulnerability in the electronic device under test may match most preset attack types. However, if the completeness of the attack chain of a certain preset attack type is extremely low, its impact on the final calculation of the urgency score for remediation is minimal. Nevertheless, to comprehensively consider the influence of multiple effective critical attack types as much as possible, this embodiment sets a preset attack type score. The critical attack type score in E that is greater than the preset attack type score is considered a valid critical attack type score (target attack type score).
[0047] S520, according to B, the repair urgency score of the electronic device under test is obtained as ED = g1*B1 + g2*B2 + ... + gc*Bc + ... + gd*Bd; where g1, g2, ..., gc, ..., gd are preset attack type weights.
[0048] Specifically, after determining the effective critical attack type scores, they are weighted and summed to obtain the final repair urgency score ED of the electronic device under test. Here, z1, z2, ..., zx, ..., zy can be determined according to the severity of the corresponding critical attack type, that is, the greater the severity of the critical attack type, the greater the weight value.
[0049] In summary, this embodiment sets a preset attack type score to comprehensively consider the impact of multiple effective critical attack types on the electronic device under test. Attack type scores in E that are greater than the preset attack type score are considered valid critical attack type scores (target attack type scores). These scores are then weighted and summed to obtain the final repair urgency score (ED) of the electronic device under test. Critical attack types that have little impact on the calculation of the final repair urgency score are filtered out, reducing the computational load and improving the accuracy of the repair urgency score (ED).
[0050] In one exemplary embodiment of this application, a new method for obtaining ED is provided, including the following steps:
[0051] S540, obtain the key attack type scores in E corresponding to attack chain completeness greater than the preset attack chain completeness, and obtain the target attack type score set L = (L1, L2, ..., Lx, ..., Ly); x = 1, 2, ..., y; where Lx is the key attack type score corresponding to the xth attack chain completeness greater than the preset attack chain completeness; y is the number of key attack type scores corresponding to the attack chain completeness greater than the preset attack chain completeness; y ≤ q.
[0052] Specifically, since different preset attack types may contain some common basic attack steps, a particular attack step corresponding to a vulnerability in the electronic device under test may match most preset attack types. However, if the completeness of the attack chain for a certain preset attack type is extremely low, its impact on the final remediation urgency score is minimal. Nevertheless, to comprehensively consider the influence of multiple effective critical attack types as much as possible, this embodiment sets a preset attack chain completeness level. The critical attack type score in E with an attack chain completeness level greater than the preset attack chain completeness level is considered a valid critical attack type score.
[0053] S550, based on L, the repair urgency score of the electronic device under test is obtained as ED = z1*L1 + z2*L2 + ... + zx*Lx + ... + zy*Ly; where z1, z2, ..., zx, ..., zy are preset attack type weights.
[0054] Specifically, after determining the effective critical attack type scores, they are weighted and summed to obtain the final repair urgency score FD of the electronic device under test. Here, z1, z2, ..., zx, ..., zy can be determined according to the severity of the corresponding critical attack type, that is, the greater the severity of the critical attack type, the greater the weight value.
[0055] In summary, this embodiment sets a preset attack chain completeness level to comprehensively consider the impact of multiple effective critical attack types on the electronic device under test. Critical attack type scores in E with attack chain completeness levels greater than the preset attack chain completeness level are considered valid critical attack type scores. These scores are then weighted and summed to obtain the final repair urgency score (ED) for the electronic device under test. Critical attack types that have little impact on the calculation of the final repair urgency score are filtered out, reducing computational load and improving the accuracy of the repair urgency score (ED).
[0056] In one exemplary embodiment of this application, step S500 further includes:
[0057] S530, based on E, the repair urgency score of the electronic device under test is obtained as ED = MAX(E); where MAX() is a preset maximum value determination function.
[0058] Specifically, the maximum value in E is taken as the repair urgency score of the electronic device under test. The calculation process is simpler and more efficient.
[0059] S600, based on ED, determines the repair urgency level of the electronic device under test and repairs the electronic device under test.
[0060] Specifically, step S600 includes:
[0061] S610, based on ED, determine the repair urgency level DJ of the electronic device under test; DJ meets the following conditions:
[0062] If ED≤FY1, the repair urgency level of the electronic device under test is determined to be Level 3; if FY1<ED<FY2, the repair urgency level of the electronic device under test is determined to be Level 2; if ED≥FY2, the repair urgency level of the electronic device under test is determined to be Level 1; where FY1 is the preset first repair urgency threshold and FY2 is the preset second repair urgency threshold.
[0063] Here, the repair urgency level of the electronic device under test is first determined based on the repair urgency score of the electronic device under test, the preset first vulnerability score threshold, and the second vulnerability score threshold.
[0064] S620, according to the DJ's traversal of the preset repair list library, adds the corresponding identifier of the electronic device to be tested to the corresponding target repair list; wherein, the repair list library contains several repair lists; each repair list corresponds to a repair method and a repair urgency level; any two repair lists correspond to different repair methods; any two repair lists correspond to different repair urgency levels.
[0065] Here, the preset repair list library contains several repair lists, and each repair list corresponds to a repair method and a repair urgency level; that is, different repair urgency levels are applicable to different repair methods; however, different electronic devices under test belonging to the same repair urgency level may have different repair urgency scores. Although the same repair method can be used, the repair priority is different. That is, for different electronic devices under test belonging to the same repair urgency level, the higher the repair urgency score, the higher the repair priority.
[0066] S630 repairs the electronic device under test according to the corresponding repair list.
[0067] Here, the electronic device under test is repaired based on the repair method corresponding to the repair list it belongs to, and the repair priority corresponding to the vulnerability score of the electronic device under test in that repair list. That is, there may be several vulnerable electronic devices within the industrial control network where the electronic device under test is located. Each electronic device has a different vulnerability score. The repair method and repair priority for each electronic device (including the electronic device under test) are determined according to the above method, and each vulnerable electronic device is repaired.
[0068] Embodiments of this application also provide an electronic device repair device 100 within a target industrial control network, such as... Figure 2 As shown, it includes:
[0069] The vulnerability acquisition module 110 is used to acquire vulnerabilities existing in the electronic device to be tested, so as to obtain a target vulnerability set D = (D1, D2, ..., Di, ..., Dn); i = 1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability existing in the electronic device to be tested; n is the number of target vulnerabilities existing in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network.
[0070] The type acquisition module 120 is used to acquire the attack links corresponding to each attack type from a number of preset attack types, so as to obtain the attack type set G = (G1, G2, ..., Gj, ..., Gm); j = 1, 2, ..., m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj = (Gj1, Gj2, ..., Gja, ..., Gjf(j)); a = 1, 2, ..., f(j); where Gja is the preset j-th attack type a-th attack link; f(j) is the preset j-th attack type number of attack links;
[0071] The critical type acquisition module 130 is used to obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq) based on D and G; p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; the critical attack type contains at least one attack link corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack links of the p-th critical attack type; Mpb is the b-th critical attack link of the p-th critical attack type; the critical attack link is the attack link corresponding to the target vulnerability;
[0072] The scoring determination module 140 is used to obtain a critical attack type score set E = (E1, E2, ..., Ep, ..., Eq) based on M; where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep = e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; Kp represents the severity score corresponding to Fp;
[0073] Repair score acquisition module 150 is used to determine the repair urgency score ED of the electronic device under test based on E;
[0074] Repair module 160 is used to determine the repair urgency level of the electronic device under test based on ED, and to repair the electronic device under test.
[0075] Embodiments of this application also provide a computer program product including program code that, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above according to various exemplary embodiments of this application.
[0076] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.
[0077] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0078] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.
[0079] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."
[0080] An electronic device according to this embodiment of the present application. The electronic device is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of this application.
[0081] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).
[0082] The memory stores program code that can be executed by a processor, causing the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this application.
[0083] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).
[0084] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.
[0085] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.
[0086] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be achieved through input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0087] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0088] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this application may also be implemented as a program product including program code, which, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this application described in the "Exemplary Methods" section above.
[0089] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0090] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.
[0091] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0092] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0093] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.
[0094] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0095] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A method for repairing electronic equipment within a target industrial control network, characterized in that, The method includes: S100, acquire the vulnerabilities existing in the electronic device to be tested, so as to obtain the target vulnerability set D=(D1, D2, ..., Di, ..., Dn); i=1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability existing in the electronic device to be tested; n is the number of target vulnerabilities existing in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network; S200, obtain the attack steps corresponding to each of several preset attack types to obtain the attack type set G=(G1, G2, ..., Gj, ..., Gm); j=1, 2, ..., m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj=(Gj1, Gj2, ..., Gja, ..., Gjf(j)); a=1, 2, ..., f(j); where Gja is the preset j-th attack type a-th attack step; f(j) is the preset j-th attack type number of attack steps; S300, based on D and G, we obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq); p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; a critical attack type contains at least one attack step corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack steps of the p-th critical attack type; Mpb is the b-th critical attack step of the p-th critical attack type; a critical attack step is the attack step corresponding to the target vulnerability. S400, based on M, we obtain the critical attack type score set E = (E1, E2, ..., Ep, ..., Eq); where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep = e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; Kp represents the severity score corresponding to Mp; S500, based on E, determines the repair urgency level of the electronic device under test as ED; S600, based on ED, determines the repair urgency level of the electronic device under test and repairs the electronic device under test.
2. The method for repairing electronic equipment within a target industrial control network according to claim 1, characterized in that, Step S500 includes: S510, obtain the key attack type scores in E that are greater than the preset attack type score, and obtain the target attack type score set B=(B1, B2, ..., Bc, ..., Bd); c=1, 2, ..., d; where Bc is the key attack type score of the c-th key attack type score that is greater than the preset attack type score; y is the number of key attack type scores that are greater than the preset attack type score; d≤q; S520, based on B, obtain the repair urgency level of the electronic device under test. Where g1, g2, ..., gc, ..., gd are preset attack type weights.
3. The method for repairing electronic equipment within a target industrial control network according to claim 1, characterized in that, Step S500 includes: S530, based on E, the repair urgency score of the electronic device under test is obtained as ED=MAX(E); where MAX() is a preset maximum value determination function.
4. The method for repairing electronic equipment within a target industrial control network according to claim 1, characterized in that, Step S600 includes: S610, based on ED, determine the repair urgency level DJ of the electronic device under test; S620, according to the DJ's traversal of the preset repair list library, adds the corresponding identifier of the electronic device to be tested to the corresponding target repair list; wherein, the repair list library contains several repair lists; each repair list corresponds to a repair method and a repair urgency level; any two repair lists correspond to different repair methods; any two repair lists correspond to different repair urgency levels; S630 repairs the electronic device under test according to the corresponding repair list.
5. The equipment repair method according to claim 3, characterized in that, DJs must meet the following criteria: If ED≤FY1, then the emergency repair level of the electronic device under test is determined to be Level 3; if FY1<ED<FY2, then the emergency repair level of the electronic device under test is determined to be Level 2. If ED≥FY2, then the repair urgency level of the electronic device under test is determined to be Level 1; where FY1 is the preset first repair urgency threshold and FY2 is the preset second repair urgency threshold.
6. An electronic equipment repair device within a target industrial control network, characterized in that, The device includes: The vulnerability acquisition module is used to acquire vulnerabilities in the electronic device to be tested, so as to obtain a target vulnerability set D=(D1, D2, ..., Di, ..., Dn); i=1, 2, ..., n; where Di is the vulnerability identifier of the i-th target vulnerability in the electronic device to be tested; n is the number of target vulnerabilities in the electronic device to be tested; each target vulnerability corresponds to at least one attack link; the electronic device to be tested is any electronic device with a vulnerability in the target industrial control network; The type acquisition module is used to acquire the attack links corresponding to each of several preset attack types, so as to obtain the attack type set G=(G1, G2, ..., Gj, ..., Gm); j=1,2, ...,m; where m is the number of preset attack types; Gj is the preset j-th attack type; Gj=(Gj1, Gj2, ..., Gja, ..., Gjf(j)); a=1,2, ...,f(j); where Gja is the preset j-th attack type a-th attack link; f(j) is the preset j-th attack type number of attack links; The critical type acquisition module is used to obtain the critical attack type set M = (M1, M2, ..., Mp, ..., Mq) based on D and G; p = 1, 2, ..., q; where q is the number of critical attack types; Mp is the p-th critical attack type; a critical attack type contains at least one attack link corresponding to any target vulnerability; Mp = (Mp1, Mp2, ..., Mpb, ..., Mpf(p)); b = 1, 2, ..., f(p); f(p) is the number of critical attack links of the p-th critical attack type; Mpb is the b-th critical attack link of the p-th critical attack type; a critical attack link is the attack link corresponding to the target vulnerability. The scoring determination module is used to obtain the critical attack type score set E=(E1, E2, ..., Ep, ..., Eq) based on M; where Ep is the critical attack type score corresponding to Mp; Ep satisfies the following condition: Ep=e KpWp Where Wp represents the completeness of the attack chain for the p-th critical attack type; Wp = f(p) / NUMp; NUMp represents the number of attack links corresponding to the p-th critical attack type; Kp represents the severity score corresponding to Mp; The repair score acquisition module is used to determine the repair urgency score ED of the electronic device under test based on E. The repair module is used to determine the repair urgency level of the electronic device under test based on the ED (Emergency Detection) and to repair the electronic device under test.
7. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the method as described in any one of claims 1-5.
8. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 7.