Security baseline verification method based on SCAP

Abstract

The present invention provides a security baseline verification method based on SCAP, which belongs to the field of network security technology and includes the following steps: modeling industrial Internet devices based on the general configuration enumeration and general vulnerability enumeration standards of SCAP; customizing SCAP content according to the established device model, the SCAP content includes the Extensible Configuration Check Description Format (XCCDF) checklist, the Open Vulnerability and Assessment Language (OVAL) definition and the Common Platform Enumeration (CPE) dictionary; using the SCAP scanning tool to scan the industrial Internet devices, and evaluate according to the customized SCAP content to generate an evaluation report; based on the evaluation report, verifying the security configuration and vulnerability of the device, and outputting the verification results; according to the verification results, linking and disposing the devices that do not meet the security baseline requirements. This method ensures the security of industrial Internet devices and provides a comprehensive and effective security verification solution through a systematic modeling and evaluation process.

Description

Technical Field

[0001] The invention belongs to the technical field of network security and relates to a security baseline verification method based on SCAP. Background Art

[0002] The Security Content Automation Protocol (SCAP) is a set of specifications for standardized expression, exchange, and evaluation of security configuration information. SCAP includes a variety of standards and tools, such as Common Configuration Enumeration (CPE), Common Vulnerability Enumeration (CVE), Extensible Configuration Check Description Format (XCCDF), and Open Vulnerability and Assessment Language (OVAL), for unified and automated management of security content. In the existing technology, SCAP is widely used in the security management of various computing environments and information systems, and improves the security and compliance of the system through standardized security inspection and assessment methods.

[0003] However, existing technologies have some shortcomings when applied to the security management of industrial Internet devices. Industrial Internet devices are diverse and complex, and existing SCAP standards and tools fail to fully consider the special needs of these devices. In addition, when modeling and evaluating industrial Internet devices, existing technologies often lack targeted SCAP content, resulting in insufficient coverage and accuracy of security checks, making it difficult to comprehensively evaluate and respond to device security risks.

[0004] Therefore, it is necessary to develop a new SCAP-based security baseline verification method. Summary of the invention

[0005] In response to the above problems, this application provides a SCAP-based security baseline verification method to ensure the security of industrial Internet equipment. Through a systematic modeling and evaluation process, it provides a comprehensive and effective security verification solution, thereby improving the accuracy and comprehensiveness of security assessments.

[0006] The SCAP-based security baseline verification method provided in this application includes:

[0007] Based on the SCAP common configuration enumeration and common vulnerability enumeration standards, industrial Internet devices are modeled and an industrial Internet device model is established. The industrial Internet device model includes device type, operating system, application software, and network configuration;

[0008] Customize SCAP content according to the industrial Internet device model, wherein the SCAP content includes an extensible configuration check description format check list, an open vulnerability and assessment language definition, and a common platform enumeration dictionary;

[0009] Use SCAP scanning tools to scan industrial Internet devices, obtain device configuration information and vulnerability information, and evaluate based on customized SCAP content to generate an evaluation report;

[0010] Based on the assessment report, verify the security configuration and vulnerability of industrial Internet devices and output the verification results;

[0011] Based on the verification results, joint disposal will be carried out on industrial Internet equipment that does not meet the security baseline requirements, and the joint disposal includes alarm, isolation, and repair.

[0012] Furthermore, the general configuration enumeration and general vulnerability enumeration standards based on SCAP are used to model the industrial Internet devices and establish the industrial Internet device model, including:

[0013] Collect initial data on Industrial Internet devices, including device type, operating system, application software, and network configuration;

[0014] Using SCAP's common configuration enumeration standard, the collected initial data is classified and standardized to generate the device configuration enumeration;

[0015] Use SCAP's common vulnerability enumeration standard to identify and record known vulnerabilities in device operating systems and application software, and generate device vulnerability enumeration;

[0016] Based on the results of configuration enumeration and vulnerability enumeration, a preliminary industrial Internet device model is established;

[0017] Verify and correct the preliminary industrial Internet device model to ensure the accuracy and completeness of the model and generate an industrial Internet device model.

[0018] Furthermore, the SCAP content is customized according to the industrial Internet device model, including:

[0019] Parse the industrial Internet device model to obtain detailed information about the device, including device type, operating system, application software, and network configuration;

[0020] Generate a check list in an extensible configuration check description format suitable for a specific device based on the information obtained from the device model;

[0021] Use the operating system and application software information in the device model to write corresponding open vulnerability and assessment language definitions to describe how to check the security configuration and vulnerabilities of the device;

[0022] Generate or update a generic platform enumeration dictionary based on device type and configuration to accurately identify the device's hardware, operating system, and application software environment;

[0023] Integrate the generated Extensible Configuration Check Description Format checklist, Open Vulnerability and Assessment Language definitions, and Common Platform Enumeration Dictionary into the SCAP profile to ensure that these contents can work together to conduct a comprehensive security assessment of Industrial Internet devices;

[0024] Verify and test customized SCAP content to ensure its accuracy and effectiveness, and adjust and optimize SCAP content to suit the actual device environment.

[0025] Furthermore, the SCAP scanning tool is used to scan the industrial Internet devices, obtain device configuration information and vulnerability information, and evaluate according to the customized SCAP content to generate an evaluation report, including:

[0026] Configure the SCAP scanning tool to import SCAP content customized according to the Industrial Internet device model, including the Extensible Configuration Check Description Format checklist, Open Vulnerability and Assessment Language Definition, and Common Platform Enumeration Dictionary;

[0027] Start the SCAP scanning tool to perform an initial scan of the target industrial Internet device to collect the real-time configuration information and vulnerability information of the device;

[0028] Pre-process the collected device configuration information and vulnerability information and standardize the data format to ensure compatibility with SCAP content;

[0029] Use the imported Scalable Configuration Check Description format checklist to check the security configuration of the device and record the results of each check item;

[0030] Evaluate device vulnerabilities based on open vulnerability and assessment language definitions, identify and record known vulnerabilities in devices and their severity;

[0031] Compare the inspection and assessment results with the generic platform enumeration dictionary to ensure that each result corresponds to the specific platform environment of the device;

[0032] The inspection and assessment results are integrated to generate a detailed assessment report, including the security configuration status of each device, information on discovered vulnerabilities, and the overall score of the inspection and assessment results.

[0033] Furthermore, based on the assessment report, the security configuration and vulnerability of the industrial Internet equipment are checked, including:

[0034] A multi-level fuzzy comprehensive evaluation algorithm based on fuzzy logic is used to quantify and score each security configuration and vulnerability item in the assessment report to obtain a comprehensive evaluation score;

[0035] Based on the comprehensive evaluation scores, the support vector machine algorithm is used to classify all industrial Internet devices into two categories: those that meet the security baseline requirements and those that do not.

[0036] Furthermore, the multi-level fuzzy comprehensive evaluation algorithm includes the following steps:

[0037] Determine the evaluation index system, including configuration item scoring , Vulnerability Item Scoring ;

[0038] Construct fuzzy matrix and define fuzzy sets and weight set , where the fuzzy set Represents the membership function of each evaluation index; weight set represents the weight of each indicator and satisfies the following formula (1):

[0039] ;

[0040] in, Indicates the weight of the configuration item score; Indicates the weight of the vulnerability item score; Indicates the number of evaluation indicators in the weighted set;

[0041] According to the following formula (2), the membership function is defined as :

[0042] ;

[0043] in, and are the parameters of the membership function respectively;

[0044] For each evaluation indicator , and calculate its fuzzy membership by formula (2) ; The fuzzy membership values ​​of all evaluation indicators form a fuzzy evaluation matrix ;

[0045] According to the following formula (3), based on the fuzzy evaluation matrix 𝑅 and the weight set 𝑊, the comprehensive evaluation score of each industrial Internet device is calculated: :

[0046] ;

[0047] in, Indicates The fuzzy membership value of each indicator; Indicates The weight of each indicator; is the number of indicators.

[0048] Furthermore, the support vector machine algorithm comprises the following steps:

[0049] Construct a training data set, including historical evaluation report data and its corresponding classification results, and the input feature vector of the support vector machine algorithm Including comprehensive evaluation score , Configuration Item Scoring , Vulnerability Item Scoring , historical evaluation records of the equipment, the equipment’s usage environment, and the equipment’s security incident history;

[0050] To train the SVM model, the objective function is as follows:

[0051] ;

[0052] The constraints of the model parameters are as follows:

[0053] ;

[0054] in, and are model parameters; is the slack variable; is the penalty parameter; is the classification label; is the feature vector; is the weight coefficient; is the weight vector of the previous round of training;

[0055] Use the trained SVM model to classify the current device and obtain the final classification result.

[0056] Furthermore, according to the verification results, the industrial Internet equipment that does not meet the security baseline requirements will be dealt with in a coordinated manner, including:

[0057] Generate and send alert notifications to relevant device administrators, describing the discovered security issues;

[0058] Trigger predefined security policies, including dynamically adjusting network access control lists or initiating emergency mode on devices;

[0059] Isolate devices that do not meet security baseline requirements into secure subnets to prevent potential security threats from spreading.

[0060] Furthermore, the SCAP-based security baseline verification method further includes:

[0061] Periodically reassess the security status of industrial Internet devices to ensure that they continue to meet security baseline requirements.

[0062] Furthermore, the SCAP-based security baseline verification method further includes:

[0063] Record the results of each reassessment and corrective measures to form a safety history file for the equipment for long-term safety management and trend analysis.

[0064] The beneficial effects of the technical solution provided by this application include:

[0065] The present invention models industrial Internet devices through the SCAP-based general configuration enumeration and general vulnerability enumeration standards, and establishes a detailed device model, including device type, operating system, application software and network configuration. This meticulous modeling method ensures that the security assessment of each device is targeted at its specific configuration and operating environment, thereby greatly improving the accuracy and comprehensiveness of the security assessment.

[0066] The present invention customizes SCAP content according to the industrial Internet device model, including XCCDF checklist, OVAL definition and CPE dictionary. This customized method enables security inspection and assessment to accurately reflect the actual security requirements and potential risks of the device, avoids possible omissions and misjudgments in general security inspections, and improves the pertinence and effectiveness of security management.

[0067] Use SCAP scanning tools to scan industrial Internet devices, obtain device configuration information and vulnerability information, and evaluate them according to customized SCAP content to generate evaluation reports. This automated process not only improves the efficiency and accuracy of security checks, but also monitors device status in real time, detects and responds to security threats in a timely manner, and reduces errors and delays in manual intervention.

[0068] According to the verification results, the present invention carries out linkage disposal of industrial Internet devices that do not meet the security baseline requirements, including alarm, isolation and repair. Through such a linkage disposal mechanism, it is possible to quickly respond to and handle security issues, prevent the spread of security threats, and ensure the overall security and stability of the industrial Internet environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a flowchart of the SCAP-based security baseline verification method provided in the first embodiment of the present application. DETAILED DESCRIPTION

[0070] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0071] The first embodiment of the present application provides a security baseline verification method based on SCAP, and its process is as follows: Figure 1 As shown, the following steps are included:

[0072] Step S101: Model the industrial Internet devices based on the SCAP general configuration enumeration and general vulnerability enumeration standards to establish an industrial Internet device model. The industrial Internet device model includes device type, operating system, application software, and network configuration. Specifically, this process can be divided into the following detailed steps:

[0073] First, the initial data of industrial Internet devices needs to be collected. This includes but is not limited to device type, operating system, application software, and network configuration. Device types can cover a variety of industrial control devices, such as PLC (Programmable Logic Controller), RTU (Remote Terminal Unit), HMI (Human Machine Interface), etc. Operating system information should include the name, version, and patch level of the operating system. Application software information should include all installed software and their versions, involving control and monitoring software running on the device. Network configuration information should include detailed data such as the device's network interface configuration, IP address, subnet mask, gateway, DNS configuration, etc.

[0074] Next, the collected initial data is classified and standardized using the Common Configuration Enumeration (CPE) standard of SCAP to generate the configuration enumeration of the device. The CPE standard provides a unified naming method and description format so that information from different devices can be consistently represented and processed. For example, the device type, operating system, application software, and network configuration are identified and recorded according to the CPE standard. This process generates the configuration enumeration of the device and ensures that all information is presented in a standardized format.

[0075] Then, using the Common Vulnerability Enumeration (CVE) standard of SCAP, the known vulnerabilities in the device's operating system and application software are identified and recorded to generate a vulnerability enumeration of the device. Specifically, it is necessary to query the CVE database, identify its known vulnerabilities based on the device's operating system and application software version, and record the information of these vulnerabilities in detail, including vulnerability description, scope of impact, severity level, and repair suggestions. This process generates a vulnerability enumeration of the device to ensure that all known vulnerabilities are systematically identified and recorded.

[0076] Based on the results of configuration enumeration and vulnerability enumeration, a preliminary industrial Internet device model is established. The model should describe in detail all aspects of the device, including its type, operating system, application software, network configuration, and its associated vulnerability information. This preliminary model provides a comprehensive view of the current status of the device and potential security issues. Specifically, the device model should contain the following information:

[0077] Equipment type: clarify the function and purpose of the equipment;

[0078] Operating system: including the name, version and patch information of the operating system;

[0079] Application software: lists all installed applications and their version information;

[0080] Network configuration: Detailed record of the device's network settings, including IP address, subnet mask, gateway, and DNS configuration;

[0081] Known vulnerabilities: Identify and record known vulnerabilities in the device through the CVE standard.

[0082] After the preliminary model is built, it is validated and corrected. The validation process involves checking that all the data in the model is accurate and complete, ensuring that no important information is missed. The accuracy and completeness of the model can be confirmed by scanning the device again or comparing it with other data sources. Any inaccurate or incomplete information found is corrected as necessary. This process ensures the accuracy and reliability of the model.

[0083] Finally, a verified and corrected industrial Internet device model is generated. This model not only provides detailed configuration and vulnerability information of the device, but also provides a solid foundation for subsequent security assessment and management. This method ensures that the device model can accurately reflect the security status of the actual device and support effective security baseline verification and risk management.

[0084] Through the above detailed steps, we can ensure that the industrial Internet device model can be established accurately and comprehensively, providing a reliable data basis for subsequent security baseline verification. This method not only standardizes the data collection and processing process, but also improves the understanding and management capabilities of the device security status.

[0085] Step S102: Customize SCAP content according to the industrial Internet device model. The SCAP content includes an extensible configuration check description format check list, open vulnerability and assessment language definition, and a general platform enumeration dictionary to ensure that the generated content can fully and accurately reflect the actual security requirements and potential risks of the device. This step specifically includes the following process:

[0086] First, the industrial Internet device model established in step S101 needs to be parsed to obtain detailed information about the device. The model contains information such as device type, operating system, application software, and network configuration. This information is the basis for customizing SCAP content to ensure that the customized content can accurately reflect the actual situation and needs of the device. By parsing the device model, the specific configuration and operating environment of each device are extracted, laying the foundation for customizing SCAP content.

[0087] After parsing the industrial Internet device model, an Extensible Configuration Check Description Format (XCCDF) checklist suitable for a specific device is generated based on the information obtained. Define the required security baseline check items based on the configuration information in the device model. The XCCDF checklist is an XML-formatted file that describes the security configuration items to be checked and their expected compliance status. Define inspection items based on the specific configuration of the device type, operating system, and application software. For example, for an industrial controller, you can define checks on its operating system patch status, user permission settings, network security configuration, etc. Each inspection item should describe its inspection objectives, methods, and expected compliance standards in detail to ensure the comprehensiveness and accuracy of the inspection.

[0088] Next, use the operating system and application software information in the device model to write the corresponding Open Vulnerability and Assessment Language (OVAL) definition. The OVAL definition is an XML-formatted file that describes how to check the security configuration and vulnerabilities of the device. Write the corresponding OVAL definition file based on the specific operating system version and application software version of the device. For example, for the operating system of an industrial control device, write an OVAL definition to check whether it has known security vulnerabilities and record the detected vulnerability information and its details. The OVAL definition should contain the vulnerability description, detection method, and referenced CVE (Common Vulnerabilities and Exposures) number to ensure the accuracy and reliability of the detection.

[0089] At the same time, the Common Platform Enumeration (CPE) dictionary is generated or updated based on the device type and configuration. The CPE dictionary is used to accurately identify the hardware, operating system, and application software environment of the device. Based on the configuration information described in the device model, the corresponding CPE entry is generated so that it can match the XCCDF checklist and OVAL definition. For example, for a specific model of industrial controller, a CPE entry is generated to clearly identify its hardware configuration and operating system version. This ensures that when performing a security assessment, each check item and vulnerability detection can accurately correspond to the actual environment of the device.

[0090] Integrate the generated XCCDF checklist, OVAL definition, and CPE dictionary into the SCAP configuration file to ensure that these contents can work together to conduct a comprehensive security assessment of industrial Internet devices. During the integration process, check the format and content of each file to ensure that it complies with the SCAP standard, and adjust and optimize it when necessary. This ensures the integrity and availability of the SCAP content, allowing all inspections and assessments to proceed smoothly.

[0091] Finally, verify and test the customized SCAP content. Use the customized SCAP content to simulate scanning and evaluating the device by running the SCAP scanning tool in the test environment. Verify the accuracy and effectiveness of the SCAP content to ensure that it can correctly detect the security configuration and vulnerabilities of the device. Based on the test results, make necessary adjustments and optimizations to improve the adaptability and coverage of the SCAP content and ensure that it can work effectively in the actual device environment.

[0092] Through the above detailed steps, we can ensure that high-quality SCAP content is customized according to the industrial Internet device model, provide a reliable foundation for subsequent security scanning and assessment, and ensure the security and compliance of industrial Internet devices.

[0093] Step S103: Use the SCAP scanning tool to scan the industrial Internet equipment, obtain equipment configuration information and vulnerability information, and evaluate according to the customized SCAP content to generate an evaluation report. This step specifically includes the following process:

[0094] First, configure the SCAP scanning tool. Import the SCAP content customized according to the Industrial Internet device model in step S102, including the Extensible Configuration Check Description Format (XCCDF) checklist, Open Vulnerability and Assessment Language (OVAL) definition, and Common Platform Enumeration (CPE) dictionary, into the SCAP scanning tool. These customized SCAP contents will serve as the basis for the scanning tool to perform security checks and vulnerability assessments. This step ensures that the scanning tool can use the latest customized security checks and vulnerability assessment rules to perform comprehensive security checks on Industrial Internet devices.

[0095] Next, start the SCAP scanning tool to perform an initial scan of the target industrial Internet device. After starting the scanning tool, it will perform a comprehensive inspection and assessment of the device according to the imported SCAP content. The scanning tool will connect to the target device and collect its real-time configuration information and vulnerability information. The collected information may include operating system version, installed application software, current network configuration, etc., as well as security vulnerabilities identified by scanning. During the scanning process, ensure that the device is operating normally and the scanning tool has the necessary permissions to access all relevant configuration and status information of the device so that the scanning tool can obtain real-time data.

[0096] During the scanning process, the SCAP scanning tool first performs each security configuration check in the XCCDF checklist. The tool checks the device's security configuration items one by one, such as the patch status of the operating system, the security settings of the user account, the security of the network configuration, etc. The results of each check item will be recorded, including whether the check passed, the specific configuration status, and the potential security issues found.

[0097] Once the device configuration information and vulnerability information are collected, the data needs to be preprocessed. The preprocessing step includes formatting and standardizing the data to ensure its compatibility with SCAP content. This preprocessing ensures that the data can be correctly mapped to the SCAP inspection and assessment standards to avoid inspection errors or assessment errors caused by inconsistent data formats.

[0098] Then, use the imported XCCDF checklist to perform a detailed check on the device's security configuration and record the results of each check item. The scanning tool will verify the device's security configuration item by item based on each check item in the XCCDF checklist. For example, check whether the operating system has the latest security patch, whether the user account permission settings comply with the security policy, and whether the network configuration meets the expected security requirements. The results of each check item will be recorded in detail, including whether the check passed, the specific configuration status, and the security issues found.

[0099] The scanning tool then evaluates the device's vulnerabilities based on the OVAL definition. The scanning tool uses the vulnerability detection rules in the OVAL definition to scan the device's operating system and application software for vulnerabilities. The tool matches the device's specific configuration with the vulnerability description in the OVAL definition, identifies and records known vulnerabilities in the device. For each identified vulnerability, detailed information is recorded, including the vulnerability description, CVE number, vulnerability severity level, and remediation recommendations. This information helps to further understand the security risks of the device and prioritize high-risk vulnerabilities.

[0100] Throughout the scanning process, the SCAP scanning tool also uses the CPE dictionary to ensure that all inspection and assessment results correspond to the specific platform environment of the device. After all inspections and vulnerability assessments are completed, the results are compared with the CPE dictionary to ensure that each result corresponds to the specific platform environment of the device. The CPE dictionary provides standardized device identification, so that all inspection and assessment results can accurately match the actual environment of the device, thereby improving the reliability and accuracy of the results.

[0101] Finally, after synthesizing all the inspection and assessment results, the SCAP scanning tool will generate a detailed assessment report based on the inspection results. The assessment report should include the security configuration status of each device, the detected security configuration issues, the identified vulnerabilities and their details, and the overall score of each inspection item and assessment result. The report not only lists the current security status of the device in detail, but also provides improvement suggestions and repair measures, provides a comprehensive evaluation of the device security status, helps device administrators identify and deal with security issues, and improves the overall security of the device.

[0102] Through the above detailed steps, we can ensure that the SCAP scanning tool is used to comprehensively and accurately scan and evaluate industrial Internet devices, generate detailed evaluation reports, and provide a solid foundation for the security management and risk control of equipment.

[0103] Step S104: Based on the assessment report, the security configuration and vulnerability of the industrial Internet equipment are verified, and the verification results are output. This step specifically includes the following processes:

[0104] First, obtain and review the assessment report generated in step S103. The assessment report lists in detail the configuration information of the device, the results of the security check, the identified vulnerabilities and their severity levels, and specific security recommendations. This information constitutes the basic data for the verification.

[0105] Next, based on the security check results in the assessment report, conduct a detailed check on the security configuration of the device. Compare the current configuration of the device with the security baseline requirements to determine whether the device meets the expected security configuration standards. The specific verification content includes checking whether the operating system has the latest security patches installed, whether the permission settings of the user account comply with the principle of least privilege, and whether the network configuration implements the necessary protection measures, such as firewall rules and port restrictions. If any configuration item is found to be inconsistent with the security baseline requirements, it is necessary to record the specific differences and evaluate the security risks it may bring.

[0106] Subsequently, based on the vulnerability assessment results in the assessment report, the vulnerability status of the device is checked. The specific situation of each vulnerability listed in the report is identified and confirmed, and the existence of these vulnerabilities in the device and the scope of their impact are determined. According to the severity level of the vulnerability, high-risk vulnerabilities are prioritized to ensure timely repair. For each vulnerability, its repair status is checked. If it has been repaired, the repair measures and time are recorded; if it has not been repaired, its potential threat to the security of the device and network is assessed, and a repair plan is formulated.

[0107] During the verification process, the overall security status of the equipment is comprehensively evaluated in combination with the equipment's operating environment and usage scenarios. This includes considering the equipment's key role in the Industrial Internet, the equipment's network topology location, and the interdependencies between the equipment. Through this comprehensive evaluation, the equipment's security risks can be more accurately judged and strong support can be provided for subsequent security management.

[0108] After all verification work is completed, the verification results are collated and output. The verification results should record the current security status of the device in detail, list all configuration items that do not meet the security baseline requirements and unfixed vulnerabilities, provide a detailed description and possible impact of each security issue, and attach relevant security recommendations. The verification results should also include a comprehensive assessment of the overall security status of the device to help device administrators understand the security risks of the device and the direction of improvement.

[0109] Through the above detailed steps, we can ensure a comprehensive and accurate security configuration and vulnerability verification based on the assessment report, output detailed verification results, and provide a solid basis for the security management and risk control of the equipment.

[0110] More specifically, based on the assessment report, the security configuration and vulnerability of the industrial Internet equipment are checked, including:

[0111] First, we obtain the assessment report generated in the previous step, which lists in detail the security configuration status and discovered vulnerability information of each industrial Internet device. In order to conduct a more accurate verification, we use a multi-level fuzzy comprehensive evaluation algorithm based on fuzzy logic to quantitatively score each security configuration and vulnerability item in the assessment report.

[0112] When performing quantitative scoring, first set fuzzy sets for each security configuration and vulnerability item and define its membership function. The membership function is used to describe the degree of impact of each security configuration item and vulnerability item on the overall security of the device. For example, the membership function of a security configuration item can be evaluated based on whether the configuration item meets the security baseline requirements, with values ​​ranging from 0 to 1, indicating the degree from complete non-compliance to complete compliance. For vulnerability items, the membership function can be evaluated based on the severity level of the vulnerability, and different membership values ​​can be assigned from low risk to high risk.

[0113] Next, a multi-level comprehensive evaluation is performed on the membership value of each configuration and vulnerability item. The multi-level fuzzy comprehensive evaluation algorithm includes the steps of constructing an evaluation index system, establishing a fuzzy evaluation matrix, and calculating a comprehensive evaluation score. Specifically, an evaluation index system including all security configuration items and vulnerability items is first established, and then a fuzzy evaluation matrix is ​​constructed based on the membership value of each indicator. Next, the evaluation matrix is ​​processed using the fuzzy comprehensive evaluation method, and the impact of each indicator on the security of the device is comprehensively considered to calculate the comprehensive evaluation score of each device. This score reflects the overall security status of the device. The higher the value, the higher the security of the device.

[0114] Once the comprehensive evaluation score for each device is obtained, the support vector machine (SVM) algorithm is used to classify these scores. Support vector machine is a supervised learning algorithm suitable for handling classification problems. We first train the SVM model using historical data. The training data includes the comprehensive evaluation scores of past devices and their corresponding classification labels, that is, meeting the security baseline requirements or not meeting the security baseline requirements. Through training, the SVM model learns how to classify devices based on the comprehensive evaluation scores.

[0115] After the training is completed, the comprehensive evaluation score of the current device is input into the trained SVM model for classification. The SVM model analyzes the scores and classifies all industrial Internet devices into two categories: those that meet the security baseline requirements and those that do not. For the classification results, devices that meet the security baseline requirements indicate that their security configuration and vulnerability conditions are within an acceptable range and no immediate action is required. Devices that do not meet the security baseline requirements require further processing to improve their security.

[0116] Furthermore, the multi-level fuzzy comprehensive evaluation algorithm includes the following steps:

[0117] First, determine the evaluation index system, including configuration item scoring , Vulnerability Item Scoring These scoring indicators represent the security status of the device in different aspects, measuring the device configuration and known vulnerabilities.

[0118] Next, construct the fuzzy matrix and define the fuzzy set and weight set , where the fuzzy set Represents the membership function of each evaluation index, that is, the degree of influence of each index on the safety of the equipment. Represents the weight of each evaluation index, and the sum of the weights satisfies the following formula:

[0119] ;

[0120] in, Indicates the weight of the configuration item score; Indicates the weight of the vulnerability item score; Represents the number of evaluation indicators in the weight set. This formula ensures that the contribution of each weight in the comprehensive score is properly considered and the overall weight is normalized.

[0121] Next, define the membership function :

[0122] ;

[0123] Among them, the parameters and The lower and upper limits of the membership function are defined respectively. These functions map the specific value of each evaluation index to a fuzzy value between 0 and 1, reflecting the membership of the value in the fuzzy set. Between and When The relative positions are squared to provide a smooth transition.

[0124] For each evaluation indicator , through the formula Calculate its fuzzy membership ; The fuzzy membership values ​​of all evaluation indicators form a fuzzy evaluation matrix In this way, each indicator is converted into a mohu value between 0 and 1, reflecting its position in the evaluation system. All evaluation indicators provide a comprehensive view to show the performance of the device in different evaluation dimensions.

[0125] Finally, based on the fuzzy evaluation matrix 𝑅 and the weight set 𝑊, the comprehensive evaluation score of each industrial Internet device is calculated :

[0126] ;

[0127] In this formula, Indicates The fuzzy membership value of each indicator; Indicates The weight of each indicator; is the number of indicators. The logarithmic term is introduced in the formula , the purpose of which is to increase the nonlinearity of the calculation, thereby improving the discrimination and accuracy of the evaluation results. Each weight and fuzzy membership value The product reflects the contribution of the indicator to the final comprehensive score.

[0128] Through these detailed steps, we can ensure that each security configuration and vulnerability item in the assessment report can be quantitatively scored using a multi-level fuzzy comprehensive evaluation algorithm, and finally obtain a comprehensive evaluation score, and use the support vector machine algorithm to classify all industrial Internet devices into two categories: those that meet the security baseline requirements and those that do not. This method not only improves the accuracy and comprehensiveness of security assessments, but also effectively classifies and manages the security risks of equipment.

[0129] Furthermore, the support vector machine algorithm comprises the following steps:

[0130] First, we need to build a training data set. This data set should include historical evaluation report data and its corresponding classification results. Each historical data record contains multiple features, which together constitute the input feature vector of the SVM algorithm. Specifically, the input feature vector Including comprehensive evaluation score , Configuration Item Scoring , Vulnerability Item Scoring , historical evaluation records of the device, the usage environment of the device, and the security event history of the device. These features can fully reflect the security status of the device and provide sufficient information for the SVM algorithm to perform classification.

[0131] Next, train the SVM model. During the training process, the goal is to find the best hyperplane to classify devices into two categories: those that meet the security baseline requirements and those that do not. The objective function of the SVM model is defined as follows:

[0132] ;

[0133] In this formula, and are model parameters, representing the direction and position of the hyperplane. It is a slack variable used to deal with inseparable samples, allowing some misclassification but with penalties. is the penalty parameter, which controls the degree of penalty for the slack variable. A value of indicates a greater penalty for misclassification. The last term introduces Weight coefficient and , this is to introduce previously trained weight vectors into the training to improve the stability and continuity of the model.

[0134] In addition, the constraints on the model parameters are defined as follows:

[0135] ;

[0136] In this constraint, is the classification label, which indicates the true classification result of each sample (conforms to or does not conform to the safety baseline requirements). The constraint ensures that for each training sample, the classification hyperplane is correct to a certain extent. Some error is allowed but must be non-negative.

[0137] After training is completed, the trained SVM model is used to classify the current device. The input is sent to the trained model, and the model calculates the classification result based on the feature vector, that is, whether the device meets the security baseline requirements. This process is achieved by calculating the feature vector and the model parameters. and This is achieved by taking the inner product of and adding a bias term, and then applying the classification decision function.

[0138] The support vector machine algorithm uses the following kernel function:

[0139] ;

[0140] in, and is a hyperparameter, and Represents the eigenvectors and No. Quantity; is the dimension of the eigenvector, is the total number of feature dimensions. is the eigenvector No. Quantity; is the eigenvector No. A quantity.

[0141] Through these detailed steps, the support vector machine algorithm can accurately classify devices based on their comprehensive evaluation scores, configuration item scores, vulnerability item scores, and other historical data, and obtain the final classification results. This classification result provides a scientific basis for further security management and decision-making.

[0142] Step S105: Based on the verification results, the industrial Internet devices that do not meet the security baseline requirements are dealt with in a coordinated manner to ensure that the security of the devices is restored and improved. The coordinated handling includes alarming, isolation, and repair.

[0143] First, analyze the verification results output in step S104 to identify industrial Internet devices that do not meet the security baseline requirements. These devices have improper configurations, unpatched security vulnerabilities, or other security issues that need to be addressed immediately to prevent potential risks. For each device that does not meet the requirements, record its specific problems in detail, including non-compliant configuration items and unpatched vulnerabilities.

[0144] Next, implement warning measures. Generate warning notifications for security issues in the verification results and send them to relevant equipment administrators or security teams in a timely manner. The warning notifications should include a detailed description of each security issue, possible impacts, and emergency handling suggestions. Ensure the accuracy and timeliness of the warning information so that relevant personnel can respond and handle it quickly.

[0145] For serious security issues, implement isolation measures. For devices with high-risk vulnerabilities or serious misconfigurations, use network management tools to isolate them to a secure subnet or VLAN, limit their communication with other devices, and prevent the spread of potential security threats. Isolation measures should minimize the impact on normal business and ensure the continuous operation of key businesses. At the same time, record the specific implementation process and isolation effects of isolation measures for subsequent audits and analysis.

[0146] After the alarm and isolation measures are implemented, perform repair operations. According to the repair suggestions provided in the verification results, solve the security issues of the equipment one by one. For improper configuration issues, adjust the security configuration items of the equipment to meet the security baseline requirements. For example, update the operating system patch, modify the user account permissions, adjust the network protection settings, etc. For unfixed vulnerabilities, apply the patches provided by the vendor as soon as possible or take other mitigation measures to eliminate security risks. Repair operations should be carried out strictly in accordance with the security management process to ensure the accuracy and effectiveness of each step.

[0147] After the repair is complete, rescan and evaluate the device. Use the SCAP scanning tool to scan the repaired device again to confirm that all security issues have been resolved. Generate a new assessment report and compare it with the previous verification results to verify the repair effect. Record the results of the rescan and any issues that still need attention to ensure that the security of the device meets the expected baseline requirements.

[0148] Finally, update the safety management records. Record the entire process of this joint disposal, including the specific measures of alarm, isolation and repair, implementation effects and re-evaluation results in detail. Update the safety files of the equipment to ensure that all safety management operations are well documented, providing a basis for subsequent safety management and auditing.

[0149] Through the above detailed steps, it is ensured that industrial Internet equipment that does not meet the security baseline requirements is effectively dealt with in a coordinated manner according to the verification results, the security of the equipment is restored and improved, and the overall security of the industrial Internet environment is protected.

[0150] More specifically, the coordinated disposal of industrial Internet devices that do not meet the security baseline requirements based on the verification results includes:

[0151] First, when the verification results show that some industrial Internet devices do not meet the security baseline requirements, the system will generate an alarm notification. These alarm notifications include detailed descriptions of the security issues found, such as specific improper configurations, unfixed vulnerabilities, or other security risks. These alarm notifications are automatically generated and sent to relevant device administrators via email, SMS or other communication methods. The purpose of the alarm notification is to quickly attract the attention of the device administrator so that he can take necessary measures in a timely manner.

[0152] At the same time as generating an alarm notification, the system also triggers predefined security policies. These policies include dynamically adjusting the network access control list (ACL) or starting the emergency mode of the device. The process of dynamically adjusting the ACL involves modifying the configuration of network devices (such as firewalls, routers, or switches) to limit the network access rights of devices that do not meet the security baseline requirements. For example, some ports of the device can be closed, its access to specific network resources can be restricted, or its network communications can be completely isolated. Starting the emergency mode of the device involves enabling the minimum set of functions of the device to ensure the security of basic operations while reducing its risk of exposure to security threats.

[0153] In addition, for devices that are identified as presenting significant security risks, the system will take further isolation measures. Specifically, these devices that do not meet the security baseline requirements are isolated in a secure subnet. This process includes configuring a virtual local area network (VLAN) or other isolation technologies in the network infrastructure to isolate problematic devices from other critical devices and systems. The purpose of isolation is to prevent potential security threats from spreading from infected devices to other devices, thereby protecting the security of the entire industrial Internet environment.

[0154] The entire linkage handling process is automated, ensuring a rapid response to security threats and minimizing potential security risks. The generation and sending of alarm notifications, the triggering of predefined security policies, and the implementation of device isolation are all carried out through the system's pre-set rules and processes. This automated processing not only improves response speed, but also reduces errors and delays caused by human operations.

[0155] In order to maintain the security and compliance of industrial Internet devices, it is crucial to regularly reassess the security status of the device to ensure that it continues to meet the security baseline requirements. This process first involves setting a reassessment cycle, which usually determines the frequency of the assessment based on the importance and risk level of the device. For example, for critical equipment, an assessment can be set monthly or quarterly, while for general equipment, it may be set to be assessed once every six months or annually.

[0156] At the beginning of each assessment cycle, use the SCAP scanning tool to perform a comprehensive scan of the device to obtain the latest configuration information and vulnerability information. This is similar to the process during the initial assessment. First, the customized SCAP content, including the XCCDF checklist, OVAL definition, and CPE dictionary, is imported into the scanning tool. Then the scanning tool is launched to perform a comprehensive security scan of the target device to collect its current configuration information and vulnerability data.

[0157] After the scan is complete, the collected data is processed and analyzed to generate the latest assessment report. The assessment report details the current security configuration status of the device, the vulnerabilities detected, and the overall security score. By comparing the current assessment results with the previous assessment results, changes in the security status of the device can be identified, such as new vulnerabilities, configuration changes, or security improvements.

[0158] Based on the latest assessment results, devices that do not meet the security baseline requirements are handled accordingly to ensure that they meet the security baseline standards again. This may include applying new security patches, adjusting configurations, strengthening access control measures, etc. All these remediation measures should be strictly carried out in accordance with the security management process to ensure their effectiveness and compliance.

[0159] Record the results and remediation measures of each reassessment to form a security history file for the device. This recording process is very detailed, including the date of each assessment, the problems found, the remediation measures taken, the results of the remediation, and the security status after the reassessment. These records can be stored in the form of electronic files in a centrally managed security information and event management (SIEM) system.

[0160] The purpose of forming a security history archive is to enable long-term security management and trend analysis. By analyzing these historical data, it is possible to identify long-term trends in the security of the equipment, evaluate the effectiveness of security measures, identify potential security risks, and develop more effective security strategies. For example, historical data can show frequently occurring security issues with certain equipment, thereby guiding more targeted security improvement measures. In addition, security history archives can also serve as an important basis for audits and compliance checks, proving the security status of the equipment at different points in time and the security measures taken.

[0161] A second embodiment of the present application provides an electronic device, the electronic device comprising:

[0162] processor;

[0163] The memory is used to store a program, and when the program is read and executed by the processor, the SCAP-based security baseline verification method provided in the first embodiment of the present application is executed.

[0164] The third embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the SCAP-based security baseline verification method provided in the first embodiment of the present application is executed.

[0165] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. The SCAP-based security baseline verification method is characterized by: include: Based on the SCAP common configuration enumeration and common vulnerability enumeration standards, industrial Internet devices are modeled and an industrial Internet device model is established. The industrial Internet device model includes device type, operating system, application software, and network configuration; The process of building an Industrial Internet device model includes: Collect initial data on Industrial Internet devices, including device type, operating system, application software, and network configuration; Using SCAP's common configuration enumeration standard, the collected initial data is classified and standardized to generate the device configuration enumeration; Use SCAP's common vulnerability enumeration standard to identify and record known vulnerabilities in device operating systems and application software, and generate device vulnerability enumeration; Based on the results of configuration enumeration and vulnerability enumeration, a preliminary industrial Internet device model is established; Verify and calibrate the preliminary industrial Internet device model to ensure the accuracy and completeness of the model and generate the industrial Internet device model; According to the industrial Internet device model, the SCAP content is customized, and the SCAP content includes an extensible configuration check description format check list, open vulnerability and assessment language definition, and a general platform enumeration dictionary; the process of customizing the SCAP content includes: Parse the industrial Internet device model to obtain detailed information about the device, including device type, operating system, application software, and network configuration; Generate a check list in an extensible configuration check description format suitable for a specific device based on the information obtained from the device model; Use the operating system and application software information in the device model to write corresponding open vulnerability and assessment language definitions to describe how to check the security configuration and vulnerabilities of the device; Generate or update the general platform enumeration dictionary based on the device type and network configuration to accurately identify the device's hardware, operating system, and application software environment; Integrate the generated Extensible Configuration Check Description Format checklist, Open Vulnerability and Assessment Language definitions, and Common Platform Enumeration Dictionary into the SCAP profile to ensure that these contents can work together to conduct a comprehensive security assessment of Industrial Internet devices; Verify and test customized SCAP content to ensure its accuracy and effectiveness, and adjust and optimize SCAP content to suit the actual device environment; Use the SCAP scanning tool to scan industrial Internet devices, obtain device configuration information and vulnerability information, and evaluate based on customized SCAP content to generate an evaluation report; including: Configure the SCAP scanning tool to import SCAP content customized according to the Industrial Internet device model, including the Extensible Configuration Check Description Format checklist, Open Vulnerability and Assessment Language Definition, and Common Platform Enumeration Dictionary; Start the SCAP scanning tool to perform an initial scan of the target industrial Internet device to collect the real-time configuration information and vulnerability information of the device; Pre-process the collected device configuration information and vulnerability information and standardize the data format to ensure compatibility with SCAP content; Use the imported Scalable Configuration Check Description format checklist to check the security configuration of the device and record the results of each check item; Evaluate device vulnerabilities based on open vulnerability and assessment language definitions, identify and record known vulnerabilities in devices and their severity; Compare the inspection and assessment results with the generic platform enumeration dictionary to ensure that each result corresponds to the specific platform environment of the device; Comprehensive inspection and assessment results to generate a detailed assessment report, including the security configuration status of each device, information on discovered vulnerabilities, and the overall score of the inspection and assessment results; Based on the assessment report, the security configuration and vulnerability of the industrial Internet equipment are verified and the verification results are output; the verification process includes: A multi-level fuzzy comprehensive evaluation algorithm based on fuzzy logic is used to quantify and score each security configuration and vulnerability item in the assessment report to obtain a comprehensive evaluation score; Based on the comprehensive evaluation scores, the support vector machine algorithm is used to classify all industrial Internet devices into two categories: those that meet the security baseline requirements and those that do not. According to the verification results, the industrial Internet equipment that does not meet the security baseline requirements will be dealt with in a coordinated manner, including alarm, isolation, and repair; the coordinated handling process includes: Generate and send alert notifications to relevant device administrators, describing the discovered security issues; Trigger predefined security policies, including dynamically adjusting network access control lists or initiating emergency mode on devices; Isolate devices that do not meet security baseline requirements into secure subnets to prevent potential security threats from spreading.

2. The SCAP-based security baseline verification method according to claim 1, characterized in that: The multi-level fuzzy comprehensive evaluation algorithm comprises the following steps: Determine the evaluation index system, including configuration item scoring , Vulnerability Item Scoring ; Construct fuzzy matrix and define fuzzy sets and weight set , where the fuzzy set Represents the membership function of each evaluation index; weight set represents the weight of each indicator and satisfies the following formula (1): ； in, Indicates the weight of the configuration item score; Indicates the weight of the vulnerability item score; Indicates the number of evaluation indicators in the weighted set; According to the following formula (2), the membership function is defined as : ； in, and are the parameters of the membership function respectively; For each evaluation indicator , and calculate its fuzzy membership by formula (2) ; The fuzzy membership values ​​of all evaluation indicators form a fuzzy evaluation matrix ; According to the following formula (3), based on the fuzzy evaluation matrix 𝑅 and the weight set 𝑊, the comprehensive evaluation score of each industrial Internet device is calculated: : ； in, Indicates The fuzzy membership value of each indicator; Indicates The weight of each indicator; is the number of indicators.

3. The SCAP-based security baseline verification method according to claim 1, characterized in that: The support vector machine algorithm comprises the following steps: Construct a training data set, including historical evaluation report data and its corresponding classification results, and the input feature vector of the support vector machine algorithm Including comprehensive evaluation score , Configuration Item Scoring , Vulnerability Item Scoring , historical evaluation records of the equipment, the equipment’s usage environment, and the equipment’s security incident history; To train the SVM model, the objective function is as follows: ； The constraints of the model parameters are as follows: ； in, and are model parameters; is the slack variable; is the penalty parameter; is the classification label; is the feature vector; is the weight coefficient; is the weight vector of the previous round of training; Use the trained SVM model to classify the current device and obtain the final classification result.

4. The SCAP-based security baseline verification method according to claim 1, characterized in that: Also includes: Periodically reassess the security status of industrial Internet devices to ensure that they continue to meet security baseline requirements.

5. The SCAP-based security baseline verification method according to claim 4 is characterized in that: Also includes: Record the results of each reassessment and corrective measures to form a safety history file for the equipment for long-term safety management and trend analysis.

Images