Network situation assessment method, device and electronic equipment for industrial control system

Abstract

The present invention provides a network situation assessment method, device and electronic device for an industrial control system, the method comprising: obtaining an assessment detection instruction issued by a user about an industrial control system to be assessed, and obtaining system parameters of the industrial control system to be assessed when the assessment detection instruction is received; determining network security situation information of the industrial control system to be assessed based on the system parameters; calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be assessed into the network model, and obtaining a network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is obtained based on network model sample pre-training, and the network model is used to obtain a network situation value corresponding to the industrial control system to be assessed according to the network security situation information of the industrial control system to be assessed. Accurate and comprehensive network situation assessment of the industrial control system to be assessed is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network situation assessment method, device and electronic equipment for an industrial control system. Background Art

[0002] Due to the rapid development of network technology, network attack methods have become more diverse, which pose a serious threat to the information security of industrial control systems. Enterprises and countries are paying more and more attention to the network security protection of industrial control systems.

[0003] As we know from relevant technologies, network situation assessment is a new technology, which includes extracting, integrating and analyzing Internet data to form a quantitative description of the entire network security situation. However, in the process of network situation assessment, the focus is on attack events, while the situation of the network itself is ignored, which leads to the incomplete evaluation results and the inability to provide accurate network situation.

[0004] Therefore, finding a method that can accurately and comprehensively assess the network situation of the industrial control system to be assessed has become a current research hotspot. Summary of the invention

[0005] The present invention provides a network situation assessment method, device and electronic equipment for an industrial control system, which can achieve accurate and comprehensive network situation assessment of an industrial control system to be assessed.

[0006] The present invention provides a network situation assessment method for an industrial control system, the method comprising: obtaining an assessment detection instruction issued by a user regarding an industrial control system to be assessed, and obtaining system parameters of the industrial control system to be assessed upon receiving the assessment detection instruction; determining network security situation information of the industrial control system to be assessed based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be assessed; calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be assessed into the network model, obtaining a network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be assessed according to the network security situation information of the industrial control system to be assessed.

[0007] According to a network situation assessment method for an industrial control system provided by the present invention, the network model sample is obtained in the following manner: obtaining multiple groups of industrial control system samples; obtaining sample system parameters of each industrial control system sample for each industrial control system sample; determining target sample network security situation information of the industrial control system sample based on the sample system parameters; calling a pre-maintained first mapping table, wherein the first mapping table includes a correspondence between different sample network security situation information and different situation information situation values; obtaining a target situation information situation value corresponding to the target sample network security situation information based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, and the target sample network security situation information; determining a sample network situation value corresponding to the industrial control system sample based on the target situation information situation value; constructing the network model sample based on the target sample network security situation information and the sample network situation value.

[0008] According to a network situation assessment method for an industrial control system provided by the present invention, before determining the sample network situation value corresponding to the industrial control system sample based on the target situation information situation value, the method further includes: constructing a multi-level indicator system for the industrial control system sample based on the sample system parameters, wherein the multi-level indicator system includes multiple hierarchical indicators, the lower-level indicators are obtained by fine-grained division of the upper-level indicators, and the lowest-level indicators are composed of the target sample network security situation information; determining the sample network situation value corresponding to the industrial control system sample based on the target situation information situation value The network situation value specifically includes: determining the indicator situation value of the level indicator in the upper-level indicator corresponding to each of the target sample network security situation information in the lower-level indicator based on the target situation information situation value, and determining the indicator situation value of the upper-level indicator in the upper-level indicator corresponding to each of the level indicators in the upper-level indicator based on the indicator situation value of the level indicator in the upper-level indicator, until the indicator situation value of each upper-level indicator in the upper-level indicator is obtained; determining the sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the upper-level indicators.

[0009] According to a network situation assessment method for an industrial control system provided by the present invention, the method of determining a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the top-level indicators specifically includes: calling a pre-maintained second mapping table, wherein the second mapping table includes a ranking of the degree of influence of different hierarchical indicators on the network situation of the industrial control system sample; determining a ranking of the degree of influence of the network situation of the industrial control system sample based on the ranking of the degree of influence of different hierarchical indicators on the industrial control system sample in the second mapping table and the top-level indicators; determining a hierarchical basic weight value of each of the top-level indicators according to the ranking of the degree of influence of the network situation corresponding to each of the top-level indicators and a hierarchical analysis algorithm; determining a hierarchical compensation weight value of the top-level indicator, and obtaining a comprehensive weight value corresponding to the top-level indicator based on the hierarchical basic weight value and the hierarchical compensation weight value; determining a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the top-level indicators and the comprehensive weight value corresponding to each of the top-level indicators.

[0010] According to a network situation assessment method for an industrial control system provided by the present invention, the hierarchical compensation weight value of the top-level indicator is determined in the following manner: for any one of the top-level indicators, the correlation of the top-level indicator with respect to other top-level indicators is calculated; based on the correlation, the uncertainty of the top-level indicator with respect to other top-level indicators is calculated; based on the uncertainty, the information entropy value of the top-level indicator with respect to other top-level indicators is obtained; based on the information entropy value, the hierarchical compensation weight value of the top-level indicator is determined.

[0011] According to a network situation assessment method for an industrial control system provided by the present invention, after obtaining the network situation value corresponding to the industrial control system to be assessed output by the network model, the method further includes: performing a network situation assessment on the industrial control system to be assessed based on the network situation value.

[0012] The present invention also provides a network situation assessment device for an industrial control system, the device comprising: an acquisition module, used to obtain an assessment detection instruction issued by a user regarding an industrial control system to be assessed, and upon receiving the assessment detection instruction, obtain system parameters of the industrial control system to be assessed; a determination module, used to determine network security situation information of the industrial control system to be assessed based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be assessed; a processing module, used to call a pre-trained network model, and input the network security situation information of the industrial control system to be assessed into the network model, to obtain a network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be assessed according to the network security situation information of the industrial control system to be assessed.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a network situation assessment method for an industrial control system as described in any one of the above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the network situation assessment method for an industrial control system as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the network situation assessment method for an industrial control system as described in any one of the above is implemented.

[0016] The network situation assessment method, device and electronic device of the industrial control system provided by the present invention obtain the assessment detection instruction issued by the user about the industrial control system to be assessed, and when receiving the assessment detection instruction, obtain the system parameters of the industrial control system to be assessed, determine the network security situation information of the industrial control system to be assessed based on the system parameters; call the pre-trained network model, and input the network security situation information of the industrial control system to be assessed into the network model, and obtain the network situation value corresponding to the industrial control system to be assessed output by the network model. Since the situation of the network itself is taken into account in the process of network situation assessment, the network situation assessment of the industrial control system to be assessed can be performed accurately and comprehensively. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is one of the flow charts of the network situation assessment method for an industrial control system provided by the present invention.

[0019] Figure 2 It is a schematic diagram of the process of obtaining network model samples provided by the present invention.

[0020] Figure 3 It is a flow chart of determining a sample network situation value corresponding to an industrial control system sample based on a target situation information situation value provided by the present invention.

[0021] Figure 4 It is a flow chart of determining a sample network situation value corresponding to an industrial control system sample based on the indicator situation value of each top-level indicator provided by the present invention.

[0022] Figure 5 It is a schematic diagram of a process for determining the hierarchical compensation weight value of the top-level indicator provided by the present invention.

[0023] Figure 6 It is a structural schematic diagram of a network situation assessment device for an industrial control system provided by the present invention.

[0024] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Most current network situation assessment methods are applicable to general networks and do not take into account the network characteristics of industrial control networks. At the same time, when conducting network situation assessment, traditional methods focus more on attack events and ignore the characteristics of the network itself. The network situation assessment method for industrial control systems provided by the present invention takes into account the situation of the network itself during the network situation assessment process, thereby being able to conduct accurate and comprehensive network situation assessment of the industrial control system to be assessed.

[0027] Figure 1 This is one of the flow charts of the network situation assessment method for an industrial control system provided by the present invention.

[0028] The following will be combined Figure 1 The process of the network situation assessment method for an industrial control system provided by the present invention is described.

[0029] In an exemplary embodiment of the present invention, Figure 1 It can be seen that the network situation assessment method of the industrial control system may include steps 110 to 130, and each step will be introduced below.

[0030] In step 110, an evaluation and detection instruction issued by a user regarding the industrial control system to be evaluated is obtained, and when the evaluation and detection instruction is received, system parameters of the industrial control system to be evaluated are obtained.

[0031] In step 120 , network security situation information of the industrial control system to be evaluated is determined based on the system parameters.

[0032] In one embodiment, an evaluation detection instruction issued by a user regarding an industrial control system to be evaluated can be obtained, and upon receiving the evaluation detection instruction, the system parameters of the industrial control system to be evaluated can be obtained. Thus, the network situation evaluation processing of the industrial control system to be evaluated can be performed according to user needs. Further, the network security situation information of the industrial control system to be evaluated is determined based on the system parameters. Among them, the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be evaluated. In one example, the network security situation information may include information on the number of changes in the real visible assets of key network devices and firewalls, and various web service configuration file information associated with the overall network.

[0033] In step 130, the pre-trained network model is called, and the network security situation information of the industrial control system to be evaluated is input into the network model to obtain a network situation value corresponding to the industrial control system to be evaluated output by the network model.

[0034] In another embodiment, the network model can be a network model in which the Inception module of the GoogleNet deep neural network replaces the convolutional layer of the traditional convolutional neural network. In the process of training based on the network model sample, the ant colony algorithm can be used to optimize the initial connection weights in the training model of the convolutional neural network, and the Gaussian mutation operator is added as a self-feedback factor in the modified Inception-CNN convolutional neural network to perform fast model training and accelerate convergence. In this embodiment, the convolutional neural network optimized by ant colony is used to evaluate the network situation, which has a higher accuracy rate and is more in line with the actual situation, providing managers with accurate network situation and facilitating subsequent defense decisions.

[0035] In another embodiment, a pre-trained network model can be called, and the network security situation information of the industrial control system to be evaluated is input into the network model to obtain a network situation value corresponding to the industrial control system to be evaluated output by the network model. It should be noted that the network model is obtained based on the pre-training of the network model sample, wherein the network model can be used to obtain a network situation value corresponding to the industrial control system to be evaluated based on the network security situation information of the industrial control system to be evaluated. Since the network security situation information takes into account the situation of the network itself, the network situation value obtained based on the output of the network model can accurately and comprehensively evaluate the network situation of the industrial control system to be evaluated.

[0036] The network situation assessment method for an industrial control system provided by the present invention obtains the assessment detection instruction issued by the user about the industrial control system to be assessed, and obtains the system parameters of the industrial control system to be assessed when the assessment detection instruction is received; determines the network security situation information of the industrial control system to be assessed based on the system parameters; calls the pre-trained network model, and inputs the network security situation information of the industrial control system to be assessed into the network model to obtain the network situation value corresponding to the industrial control system to be assessed output by the network model. Since the situation of the network itself is taken into account in the network situation assessment process, the network situation assessment of the industrial control system to be assessed can be performed accurately and comprehensively.

[0037] Figure 2 It is a schematic diagram of the process of obtaining network model samples provided by the present invention.

[0038] The following will be combined Figure 2 The process of obtaining network model samples is explained.

[0039] In an exemplary embodiment of the present invention, Figure 2 It can be seen that obtaining a network model sample may include steps 210 to 270, and each step will be introduced below.

[0040] In step 210 , multiple groups of industrial control system samples are obtained.

[0041] In step 220, for each industrial control system sample, a sample system parameter of each industrial control system sample is obtained.

[0042] In step 230, target sample network security situation information of the industrial control system sample is determined based on the sample system parameters.

[0043] In one embodiment, multiple groups of industrial control system samples can be obtained, and for each industrial control system sample, sample system parameters of each industrial control system sample can be obtained. Further, based on the sample system parameters, target sample network security situation information of each industrial control system sample is determined. It should be noted that the target sample network security situation information is the same as the network security situation information of the industrial control system to be evaluated in the previous text, except that one is used to characterize the network complete situation information of the sample, and the other is used to characterize the network security situation information of the industrial control system to be evaluated.

[0044] In step 240, a pre-maintained first mapping table is called, wherein the first mapping table includes a correspondence between different sample network security situation information and different situation information situation values.

[0045] In step 250, based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, and the target sample network security situation information, a target situation information situation value corresponding to the target sample network security situation information is obtained.

[0046] In step 260, based on the target situation information situation value, a sample network situation value corresponding to the industrial control system sample is determined.

[0047] In step 270, a network model sample is constructed based on the target sample network security situation information and the sample network situation value.

[0048] In another embodiment, the first mapping table of the pre-dimension can also be called, and based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, the target situation information situation value corresponding to the target sample network security situation information is obtained. In one example, when the target sample network security situation information is the quantity change information of the real visible assets of the network key equipment and the firewall, the target situation information situation value corresponding to the quantity change information of the real visible assets of the network key equipment and the firewall can be determined based on the first mapping table.

[0049] In another embodiment, a sample network situation value corresponding to the industrial control system sample can be determined based on the obtained target situation information situation value. Among them, the sample network situation value can represent the situation value corresponding to the entire industrial control system sample. In the application process, a network model sample can be constructed based on the target sample network security situation information and the sample network situation value corresponding to the entire industrial control system sample. It can be understood that in the process of training the network model, the target sample network security situation information can be used as the input of the network model to obtain the output of the network model, that is, the sample network situation value prediction value, and the loss function is determined in combination with the sample network situation value and the sample network situation value prediction value until the loss function converges, thereby obtaining a trained network model.

[0050] Figure 3 It is a flow chart of determining a sample network situation value corresponding to an industrial control system sample based on a target situation information situation value provided by the present invention.

[0051] The following will be combined Figure 3 The process of determining a sample network situation value corresponding to an industrial control system sample based on a target situation information situation value is described.

[0052] In an exemplary embodiment of the present invention, Figure 3 It can be seen that determining the sample network situation value corresponding to the industrial control system sample based on the situation value of the target situation information may include steps 310 to 330, and each step will be introduced below.

[0053] In step 310, a multi-level indicator system of the industrial control system sample is constructed based on the sample system parameters, wherein the multi-level indicator system includes multiple hierarchical indicators, the next-level indicators are obtained by fine-grained division of the previous-level indicators, and the lowest-level indicators are composed of the target sample network security situation information.

[0054] In step 320, based on the situation value of the target situation information, the indicator situation value of the level indicator in the upper-level indicator corresponding to the network security situation information of each target sample in the lowest-level indicator is determined, and based on the indicator situation value of the level indicator in the upper-level indicator, the indicator situation value of the upper-level indicator in the upper-level indicator corresponding to each level indicator in the upper-level indicator is determined, until the indicator situation value of each upper-level indicator in the upper-level indicator is obtained.

[0055] In step 330, based on the indicator status values ​​of the uppermost level indicators, a sample network status value corresponding to the industrial control system sample is determined.

[0056] In one embodiment, a multi-level indicator system of industrial control system samples can also be constructed based on sample system parameters. The multi-level indicator system can include multiple level indicators, where the next level indicators are obtained by fine-grained division of the previous level indicators, and the lowest level indicators are composed of target sample network security situation information.

[0057] In another example, a three-level indicator system can be used as an example for explanation. In the application process, the top-level indicators are asset indicators, vulnerability indicators, availability indicators and threat indicators. Among them, asset indicators refer to the basic asset indicators for evaluating the network security status, which can be specifically divided into two categories: hardware assets and software assets. Hardware assets refer to the changes in the number of real and visible assets of key network equipment and firewalls. Software indicators refer to related information such as various web service configuration files associated with the overall network.

[0058] Vulnerability indicators refer to indicators that may be attacked by intrusions due to certain deficiencies in the entire network system itself when evaluating the network security status. They can be specifically divided into environmental vulnerability and device vulnerability. Environmental vulnerability indicators refer to certain environmental factors related to physical security vulnerabilities related to network security, including network topology, security equipment conditions, and the types and number of operating environment vulnerabilities. Device vulnerability indicators refer to certain host visa vulnerability factors that serve the entire network system, including factors such as device development ports, device operating system types, device vulnerability types, and the number of infected hosts.

[0059] Availability indicators refer to key availability indicators for evaluating the security status of a network, which can be specifically divided into environmental availability indicators and equipment availability indicators. Environmental availability indicators refer to key information indicators related to network traffic and data packets, while equipment availability refers to factors such as the survival time of key equipment, equipment response time, data packet change rate, and trouble-free response time.

[0060] Threat indicators refer to the indicators that measure the potential and existing security attacks that may harm the entire network system when evaluating the network security status. They can be divided into human threats and environmental threats. Human threat indicators refer to the potential risks that network equipment may face due to improper operation and management by managers, including the risk of key information being stolen, illegal authorization of system resources, and lack of system operation monitoring.

[0061] It can be understood that, when the top-level indicators are asset indicators, the corresponding bottom-level indicators, i.e., the target sample network security situation information, can be information on the number of changes in the real visible assets of key network devices and firewalls, as well as various web service configuration file information associated with the overall network. The corresponding upper-level indicators of the bottom-level indicators can be hardware asset indicators and software asset indicators. Through this embodiment, a three-level indicator system can be constructed.

[0062] In another embodiment, based on the situation value of the target situation information, the indicator situation value of the level indicator in the upper-level indicator corresponding to the network security situation information of each target sample in the lower-level indicator can be determined, and based on the indicator situation value of the level indicator in the upper-level indicator, the indicator situation value of the upper-level indicator in the upper-level indicator corresponding to each level indicator in the upper-level indicator can be determined, until the indicator situation value of each upper-level indicator in the upper-level indicator is obtained.

[0063] In another example, the case where the top-level indicators in the previous text are asset indicators is used as an example for explanation. The indicator situation values ​​of the hardware asset indicators and software asset indicators can be determined based on the target situation information situation values ​​of the quantity change information of the real visible assets of the network key equipment and the firewall, and the target situation information situation values ​​of the various web service configuration file information associated with the overall network. Further, based on the indicator situation value of the hardware asset indicator and the indicator situation value of the software asset indicator, the indicator situation value of the asset indicator is determined.

[0064] It can be understood that since in the aforementioned three-level indicator system, the top-level indicators are asset indicators, vulnerability indicators, availability indicators and threat indicators, respectively, the indicator situation values ​​of vulnerability indicators, availability indicators and threat indicators can be determined respectively in accordance with the aforementioned method of calculating the indicator situation value of asset indicators.

[0065] Furthermore, based on the indicator situation values ​​of each top-level indicator (corresponding to the indicator situation values ​​of the asset indicator, vulnerability indicator, availability indicator and threat indicator mentioned above), the sample network situation value corresponding to the industrial control system sample is determined.

[0066] Figure 4 It is a flow chart of determining a sample network situation value corresponding to an industrial control system sample based on the indicator situation value of each top-level indicator provided by the present invention.

[0067] The following will be combined Figure 4 The process of determining a sample network situation value corresponding to an industrial control system sample based on the indicator situation value of each top-level indicator is described.

[0068] In an exemplary embodiment of the present invention, Figure 4 It can be seen that determining the sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each top-level indicator can include steps 410 to 450, and each step will be introduced below.

[0069] In step 410, a pre-maintained second mapping table is called, wherein the second mapping table includes a ranking of the degree of influence of different hierarchical indicators on the network situation of the industrial control system sample.

[0070] In step 420, the network situation impact degree ranking of the industrial control system samples is performed based on different hierarchical indicators in the second mapping table, and the top-level indicators, and the network situation impact degree ranking corresponding to each top-level indicator is determined.

[0071] In step 430, the hierarchical basic weight value of each top-level indicator is determined according to the hierarchy analysis algorithm according to the ranking of the network situation impact degree corresponding to each top-level indicator.

[0072] In step 440, the hierarchical compensation weight value of the top-level indicator is determined, and based on the hierarchical basic weight value and the hierarchical compensation weight value, a comprehensive weight value corresponding to the top-level indicator is obtained.

[0073] In step 450, based on the indicator status values ​​of each top-level indicator and the comprehensive weight values ​​corresponding to each top-level indicator, a sample network status value corresponding to the industrial control system sample is determined.

[0074] In one embodiment, the pre-maintained second mapping table can be called, and the network situation impact degree of the industrial control system samples can be ranked according to different hierarchical indicators in the second mapping table to determine the network situation impact degree ranking corresponding to each top-level indicator. Further, based on the network situation impact degree ranking corresponding to each top-level indicator, the hierarchical basic weight value of each top-level indicator is determined according to the hierarchical analysis algorithm. .

[0075] In another embodiment, the hierarchical compensation weight value of the top level indicator can also be determined, and based on the hierarchical basic weight value and the level compensation weight value , and obtain the comprehensive weight value corresponding to the top-level indicator .

[0076] In one example, the game theory method can be used to calculate the weight of the hierarchy based on the and the level compensation weight value , and obtain the comprehensive weight value corresponding to the top-level indicator .

[0077] In another embodiment, the indicator status value of each top-level indicator and the comprehensive weight value corresponding to each top-level indicator can be used. , determine the sample network situation value corresponding to the industrial control system sample. In the application process, based on the weighted summation method, according to the indicator situation value of each top-level indicator and the comprehensive weight value corresponding to each top-level indicator, , determine the sample network situation value corresponding to the industrial control system sample.

[0078] It should be noted that, in the process of determining the indicator status value of the level indicator of any level indicator, it can also be determined in the manner of determining the sample network status value corresponding to the industrial control system sample. In this embodiment, no specific limitation is made.

[0079] Figure 5 It is a schematic diagram of a process for determining the hierarchical compensation weight value of the top-level indicator provided by the present invention.

[0080] The following will be combined Figure 5 The process of determining the hierarchical compensation weight value of the top-level indicator is explained.

[0081] In an exemplary embodiment of the present invention, Figure 5 It can be seen that determining the hierarchical compensation weight value of the top-level indicator may include steps 510 to 540, and each step will be introduced below.

[0082] In step 510, for any top-level indicator, the correlation of the top-level indicator with respect to other top-level indicators is calculated.

[0083] In step 520, based on the correlation, the uncertainty of the top-level indicator relative to other top-level indicators is calculated.

[0084] In step 530, based on the uncertainty, the information entropy value of the top-level indicator relative to other top-level indicators is obtained.

[0085] In step 540, based on the information entropy value, the hierarchical compensation weight value of the top-level indicator is determined.

[0086] In one embodiment, the top-level indicators are asset indicators, vulnerability indicators, availability indicators, and threat indicators. Any of the top-level indicators can be an asset indicator. During the application process, the correlation of the asset indicator with respect to the vulnerability indicator, availability indicator, and threat indicator can be determined; based on the correlation, the uncertainty of the asset indicator with respect to the vulnerability indicator, availability indicator, and threat indicator can be calculated; further, based on the uncertainty, the information entropy value of the asset indicator with respect to the vulnerability indicator, availability indicator, and threat indicator can be obtained. And based on the information entropy value, the hierarchical compensation weight value of the asset indicator is determined. .

[0087] In another exemplary embodiment of the present invention, continuing with the above Figure 1 Taking the above embodiment as an example, after obtaining the network situation value corresponding to the industrial control system to be evaluated output by the network model (corresponding to step 130), the network situation evaluation method of the industrial control system may further include the following steps:

[0088] Based on the network situation value, a network situation assessment is performed on the industrial control system to be assessed.

[0089] In one embodiment, the network situation assessment can be performed on the industrial control system to be assessed based on the network situation value. Since the network situation value is obtained by considering the situation of the network itself, it can be ensured that the network situation assessment can be performed accurately and comprehensively in the process of performing the network situation assessment on the industrial control system to be assessed based on the network situation value.

[0090] The network situation assessment method for industrial control systems provided by the present invention can cover all aspects of industrial control systems through a designed multi-level indicator system, providing a comprehensive assessment effect;

[0091] According to the foregoing description, the network situation assessment method for the industrial control system provided by the present invention obtains the assessment detection instruction issued by the user about the industrial control system to be assessed, and when the assessment detection instruction is received, obtains the system parameters of the industrial control system to be assessed, and determines the network security situation information of the industrial control system to be assessed based on the system parameters; calls the pre-trained network model, and inputs the network security situation information of the industrial control system to be assessed into the network model, and obtains the network situation value corresponding to the industrial control system to be assessed output by the network model. Since the situation of the network itself is taken into account in the network situation assessment process, it is possible to perform an accurate and comprehensive network situation assessment on the industrial control system to be assessed.

[0092] The network situation assessment device for an industrial control system provided by the present invention is described below. The network situation assessment device for an industrial control system described below and the network situation assessment method for an industrial control system described above can be referenced to each other.

[0093] Figure 6 It is a structural schematic diagram of a network situation assessment device for an industrial control system provided by the present invention.

[0094] The following will be combined Figure 6 The structure of the network situation assessment device for an industrial control system provided by the present invention is described.

[0095] In an exemplary embodiment of the present invention, Figure 6 It can be seen that the network situation assessment device of the industrial control system may include an acquisition module 610, a determination module 620 and a processing module 630, and each module will be introduced below.

[0096] The acquisition module 610 may be configured to acquire an evaluation and detection instruction issued by a user regarding the industrial control system to be evaluated, and acquire system parameters of the industrial control system to be evaluated upon receiving the evaluation and detection instruction;

[0097] The determination module 620 may be configured to determine the network security situation information of the industrial control system to be evaluated based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be evaluated;

[0098] The processing module 630 can be configured to call a pre-trained network model and input the network security situation information of the industrial control system to be evaluated into the network model to obtain a network situation value corresponding to the industrial control system to be evaluated output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be evaluated based on the network security situation information of the industrial control system to be evaluated.

[0099] In an exemplary embodiment of the present invention, the processing module 630 may obtain the network model sample in the following manner:

[0100] Obtain multiple sets of industrial control system samples;

[0101] For each of the industrial control system samples, obtaining a sample system parameter of each of the industrial control system samples;

[0102] Determining target sample network security situation information of the industrial control system sample based on the sample system parameters;

[0103] Calling a pre-maintained first mapping table, wherein the first mapping table includes a correspondence between different sample network security situation information and different situation information situation values;

[0104] Based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, and the target sample network security situation information, obtaining a target situation information situation value corresponding to the target sample network security situation information;

[0105] Based on the target situation information situation value, determining a sample network situation value corresponding to the industrial control system sample;

[0106] The network model sample is constructed based on the target sample network security situation information and the sample network situation value.

[0107] In an exemplary embodiment of the present invention, the processing module 630 may also be configured to:

[0108] Based on the sample system parameters, a multi-level indicator system of the industrial control system sample is constructed, wherein the multi-level indicator system includes multiple hierarchical indicators, the next-level indicators are obtained by fine-grained division of the previous-level indicators, and the lowest-level indicators are composed of target sample network security situation information;

[0109] The processing module 630 may determine the sample network situation value corresponding to the industrial control system sample based on the situation value of the target situation information in the following manner:

[0110] Based on the situation value of the target situation information, determine the indicator situation value of the level indicator in the upper level indicator corresponding to each of the target sample network security situation information in the lower level indicator, and based on the indicator situation value of the level indicator in the upper level indicator, determine the indicator situation value of the upper level indicator in the upper level indicator corresponding to each of the level indicators in the upper level indicator, until the indicator situation value of each upper level indicator in the upper level indicator is obtained;

[0111] Based on the indicator status value of each of the top-level indicators, a sample network status value corresponding to the industrial control system sample is determined.

[0112] In an exemplary embodiment of the present invention, the processing module 630 may determine the sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the uppermost level indicators in the following manner:

[0113] Calling a pre-maintained second mapping table, wherein the second mapping table includes a ranking of the degree of influence of different hierarchical indicators on the network situation of the industrial control system sample;

[0114] Based on the different hierarchical indicators in the second mapping table, the network situation impact degree ranking of the industrial control system samples and the top-level indicators are determined to determine the network situation impact degree ranking corresponding to each of the top-level indicators;

[0115] According to the ranking of the network situation impact degree corresponding to each of the top-level indicators, the hierarchical basic weight value of each of the top-level indicators is determined according to the hierarchical analysis algorithm;

[0116] Determine the hierarchical compensation weight value of the uppermost hierarchical indicator, and obtain a comprehensive weight value corresponding to the uppermost hierarchical indicator based on the hierarchical basic weight value and the hierarchical compensation weight value;

[0117] Based on the indicator status value of each of the top-level indicators and the comprehensive weight value corresponding to each of the top-level indicators, a sample network status value corresponding to the industrial control system sample is determined.

[0118] In an exemplary embodiment of the present invention, the processing module 630 may determine the hierarchical compensation weight value of the top-level indicator in the following manner:

[0119] For any of the top-level indicators, calculate the correlation of the top-level indicator with respect to other top-level indicators;

[0120] Based on the correlation, the uncertainty of the top-level indicator relative to other top-level indicators is calculated;

[0121] Based on the uncertainty, obtaining an information entropy value of the top-level indicator relative to other top-level indicators;

[0122] Based on the information entropy value, a hierarchical compensation weight value of the top-level indicator is determined.

[0123] In an exemplary embodiment of the present invention, the processing module 630 may also be configured to:

[0124] Based on the network situation value, a network situation assessment is performed on the industrial control system to be assessed.

[0125] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the network situation assessment method of the industrial control system, the method comprising: obtaining an assessment detection instruction issued by a user about the industrial control system to be assessed, and obtaining the system parameters of the industrial control system to be assessed when the assessment detection instruction is received; determining the network security situation information of the industrial control system to be assessed based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be assessed; calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be assessed into the network model, obtaining the network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain the network situation value corresponding to the industrial control system to be assessed according to the network security situation information of the industrial control system to be assessed.

[0126] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0127] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network situation assessment method for the industrial control system provided by the above-mentioned methods, the method including: obtaining an assessment and detection instruction issued by a user regarding the industrial control system to be assessed, and upon receiving the assessment and detection instruction, obtaining system parameters of the industrial control system to be assessed; determining the network security situation information of the industrial control system to be assessed based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be assessed; calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be assessed into the network model, to obtain a network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be assessed based on the network security situation information of the industrial control system to be assessed.

[0128] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the network situation assessment method for an industrial control system provided by the above-mentioned methods, the method comprising: obtaining an assessment and detection instruction issued by a user regarding the industrial control system to be assessed, and upon receiving the assessment and detection instruction, obtaining system parameters of the industrial control system to be assessed; determining network security situation information of the industrial control system to be assessed based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be assessed; calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be assessed into the network model, to obtain a network situation value corresponding to the industrial control system to be assessed output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be assessed based on the network security situation information of the industrial control system to be assessed.

[0129] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network situation assessment method for an industrial control system, characterized in that: The method comprises: Obtaining an evaluation and detection instruction issued by a user regarding the industrial control system to be evaluated, and upon receiving the evaluation and detection instruction, obtaining system parameters of the industrial control system to be evaluated; Determine the network security situation information of the industrial control system to be evaluated based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be evaluated; Calling a pre-trained network model, and inputting the network security situation information of the industrial control system to be evaluated into the network model, to obtain a network situation value corresponding to the industrial control system to be evaluated output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be evaluated according to the network security situation information of the industrial control system to be evaluated; The network model sample is obtained in the following way: Obtain multiple sets of industrial control system samples; For each of the industrial control system samples, obtaining a sample system parameter of each of the industrial control system samples; Determining target sample network security situation information of the industrial control system sample based on the sample system parameters; Calling a pre-maintained first mapping table, wherein the first mapping table includes a correspondence between different sample network security situation information and different situation information situation values; Based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, and the target sample network security situation information, obtaining a target situation information situation value corresponding to the target sample network security situation information; Based on the target situation information situation value, determining a sample network situation value corresponding to the industrial control system sample; Based on the target sample network security situation information and the sample network situation value, construct the network model sample; Wherein, before determining the sample network situation value corresponding to the industrial control system sample based on the situation value of the target situation information, the method further includes: Based on the sample system parameters, a multi-level indicator system of the industrial control system sample is constructed, wherein the multi-level indicator system includes multiple hierarchical indicators, the next-level indicators are obtained by fine-grained division of the previous-level indicators, and the lowest-level indicators are composed of target sample network security situation information; The determining, based on the target situation information situation value, a sample network situation value corresponding to the industrial control system sample specifically includes: Based on the situation value of the target situation information, determine the indicator situation value of the level indicator in the upper level indicator corresponding to each of the target sample network security situation information in the lower level indicator, and based on the indicator situation value of the level indicator in the upper level indicator, determine the indicator situation value of the upper level indicator in the upper level indicator corresponding to each of the level indicators in the upper level indicator, until the indicator situation value of each upper level indicator in the upper level indicator is obtained; Determining a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the top-level indicators; Wherein, determining the sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the uppermost level indicators specifically includes: Calling a pre-maintained second mapping table, wherein the second mapping table includes a ranking of the degree of influence of different hierarchical indicators on the network situation of the industrial control system sample; Based on the different hierarchical indicators in the second mapping table, the network situation impact degree ranking of the industrial control system samples and the top-level indicators are determined to determine the network situation impact degree ranking corresponding to each of the top-level indicators; According to the ranking of the network situation impact degree corresponding to each of the top-level indicators, the hierarchical basic weight value of each of the top-level indicators is determined according to the hierarchical analysis algorithm; Determine the hierarchical compensation weight value of the uppermost hierarchical indicator, and obtain a comprehensive weight value corresponding to the uppermost hierarchical indicator based on the hierarchical basic weight value and the hierarchical compensation weight value; Determine a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the uppermost level indicators and the comprehensive weight value corresponding to each of the uppermost level indicators; The hierarchical compensation weight value of the top-level indicator is determined in the following way: For any of the top-level indicators, calculate the correlation of the top-level indicator with respect to other top-level indicators; Based on the correlation, the uncertainty of the top-level indicator relative to other top-level indicators is calculated; Based on the uncertainty, obtaining an information entropy value of the top-level indicator relative to other top-level indicators; Based on the information entropy value, a hierarchical compensation weight value of the top-level indicator is determined.

2. The network situation assessment method for an industrial control system according to claim 1 is characterized in that: After obtaining the network situation value output by the network model and corresponding to the industrial control system to be evaluated, the method further includes: Based on the network situation value, a network situation assessment is performed on the industrial control system to be assessed.

3. A network situation assessment device for an industrial control system, characterized in that: The device comprises: An acquisition module is used to acquire an evaluation and detection instruction issued by a user regarding the industrial control system to be evaluated, and upon receiving the evaluation and detection instruction, acquire system parameters of the industrial control system to be evaluated; A determination module, configured to determine network security situation information of the industrial control system to be evaluated based on the system parameters, wherein the network security situation information is parameter information in the system parameters used to characterize the network situation of the industrial control system to be evaluated; A processing module, used to call a pre-trained network model, and input the network security situation information of the industrial control system to be evaluated into the network model, to obtain a network situation value corresponding to the industrial control system to be evaluated output by the network model, wherein the network model is pre-trained based on a network model sample, and the network model is used to obtain a network situation value corresponding to the industrial control system to be evaluated according to the network security situation information of the industrial control system to be evaluated; The network model sample is obtained in the following way: Obtain multiple sets of industrial control system samples; For each of the industrial control system samples, obtaining a sample system parameter of each of the industrial control system samples; Determining target sample network security situation information of the industrial control system sample based on the sample system parameters; Calling a pre-maintained first mapping table, wherein the first mapping table includes a correspondence between different sample network security situation information and different situation information situation values; Based on the correspondence between different sample network security situation information and different situation information situation values ​​in the first mapping table, and the target sample network security situation information, obtaining a target situation information situation value corresponding to the target sample network security situation information; Based on the target situation information situation value, determining a sample network situation value corresponding to the industrial control system sample; Based on the target sample network security situation information and the sample network situation value, construct the network model sample; Wherein, before determining the sample network situation value corresponding to the industrial control system sample based on the situation value of the target situation information, the method further includes: Based on the sample system parameters, a multi-level indicator system of the industrial control system sample is constructed, wherein the multi-level indicator system includes multiple hierarchical indicators, the next-level indicators are obtained by fine-grained division of the previous-level indicators, and the lowest-level indicators are composed of target sample network security situation information; The determining, based on the target situation information situation value, a sample network situation value corresponding to the industrial control system sample specifically includes: Based on the situation value of the target situation information, determine the indicator situation value of the level indicator in the upper level indicator corresponding to each of the target sample network security situation information in the lower level indicator, and based on the indicator situation value of the level indicator in the upper level indicator, determine the indicator situation value of the upper level indicator in the upper level indicator corresponding to each of the level indicators in the upper level indicator, until the indicator situation value of each upper level indicator in the upper level indicator is obtained; Determining a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the top-level indicators; Wherein, determining the sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the uppermost level indicators specifically includes: Calling a pre-maintained second mapping table, wherein the second mapping table includes a ranking of the degree of influence of different hierarchical indicators on the network situation of the industrial control system sample; Based on the different hierarchical indicators in the second mapping table, the network situation impact degree ranking of the industrial control system samples and the top-level indicators are determined to determine the network situation impact degree ranking corresponding to each of the top-level indicators; According to the ranking of the network situation impact degree corresponding to each of the top-level indicators, the hierarchical basic weight value of each of the top-level indicators is determined according to the hierarchical analysis algorithm; Determine the hierarchical compensation weight value of the uppermost hierarchical indicator, and obtain a comprehensive weight value corresponding to the uppermost hierarchical indicator based on the hierarchical basic weight value and the hierarchical compensation weight value; Determine a sample network situation value corresponding to the industrial control system sample based on the indicator situation value of each of the uppermost level indicators and the comprehensive weight value corresponding to each of the uppermost level indicators; The hierarchical compensation weight value of the top-level indicator is determined in the following way: For any of the top-level indicators, calculate the correlation of the top-level indicator with respect to other top-level indicators; Based on the correlation, the uncertainty of the top-level indicator relative to other top-level indicators is calculated; Based on the uncertainty, obtaining an information entropy value of the top-level indicator relative to other top-level indicators; Based on the information entropy value, a hierarchical compensation weight value of the top-level indicator is determined.

4. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the network situation assessment method for an industrial control system as described in any one of claims 1 to 2 is implemented.

5. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network situation assessment method for an industrial control system as described in any one of claims 1 to 2 is implemented.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the network situation assessment method for an industrial control system as described in any one of claims 1 to 2 is implemented.

Images