Construction method and system for network security assessment knowledge graph of industrial control system

Abstract

The invention discloses a method and a system for constructing a network security assessment knowledge graph of an industrial control system. The method comprises the following steps: acquiring a verified vulnerability and event information base as information source data; mapping the various information source data; constructing a data processing engine, and performing compatibility processing on the mapped various information source data to form an evaluation data set; extracting detection countermeasure classes related to the ICS from the evaluation data set; classifying and gathering the detection countermeasures according to similarity; mapping the classification to an NIST network security architecture; and based on the detection countermeasure class and the mapped NIST network security architecture, completing the construction of the network security assessment knowledge graph in combination with AND-OR gate logic. The system comprises a data acquisition module, a data mapping module, a data processing module, a data extraction module, a classification aggregation module, a classification mapping module and a knowledge graph construction module which are connected in sequence. According to the invention, a basis is provided for safety assessment automation, and the safety protection capability of the industrial control system is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically relates to a method and system for constructing a network security assessment knowledge graph for an industrial control system. Background Art

[0002] As Internet technology continues to develop, the corresponding network security risks are also increasing. In order to protect systems and networks from threats, a large number of attack detection and defense systems have been proposed. However, most of the attack and defense methods lack connection, resulting in the inability to resist security attacks when they occur. The root cause is the lack of active defense capabilities against security risks. Therefore, it is very necessary to propose effective security assessment methods based on actual system vulnerabilities and network attack paths to enhance the active prevention capabilities of systems and networks.

[0003] Constructing a knowledge graph for analyzing unstructured information such as logs can lay the foundation for security assessment. Existing work lacks a knowledge graph for network security assessment. Specifically, there are two key problems in the existing technology:

[0004] (1) Existing knowledge graphs have the problem of poor scalability and are limited to fixed information formats and data, making it difficult to cope with increasingly complex vulnerability exploitation scenarios.

[0005] (2) Existing knowledge graphs are often oriented towards attack behavior analysis and lack connection with actual security assessment work, thus failing to guide the execution of network security assessments. Summary of the invention

[0006] To solve the above problems, the present invention provides a method and system for constructing a knowledge graph for network security assessment of industrial control systems. First, a processing workflow is constructed to integrate widely used heterogeneous network security data sources and provide a variety of knowledge graph utilization methods. Secondly, considering the relationship between threat discovery and security assessment, a risk assessment dictionary is proposed to map the assessment methods corresponding to security risks. Through the data source processing workflow and the risk assessment dictionary, an extensible network security assessment knowledge graph is jointly realized.

[0007] The present invention is achieved by adopting the following technical solutions:

[0008] A method for constructing a knowledge graph for network security assessment of an industrial control system, comprising:

[0009] Obtain verified vulnerability and incident information repositories as information source data;

[0010] Define an object attribute model based on the resource description framework RDF, and map multiple information source data based on the object attribute model;

[0011] The data processing engine is constructed with the ETL concept to achieve the compatibility of the mapped multiple information source data and form an evaluation data set;

[0012] Process the formed evaluation data set to extract ICS-related detection countermeasures;

[0013] All detection countermeasures are classified and clustered according to similarities;

[0014] Map the aggregated categories to the NIST Cybersecurity Framework;

[0015] Based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND-OR gate logic, the network security assessment knowledge graph is constructed.

[0016] A further improvement of the present invention is to obtain a verified vulnerability and event information library as information source data, and the information source data includes a common vulnerability omission, a common vulnerability scoring system, a common platform enumeration, a common defect enumeration, and an attack type enumeration and classification data set.

[0017] A further improvement of the present invention is to define an object attribute model based on the resource description framework RDF, including defining multiple information source data as objects, and each object contains corresponding key information as its attribute.

[0018] A further improvement of the present invention is that the data processing engine includes data collection, resource extraction, link verification and data storage, and has an autonomous update mechanism.

[0019] A further improvement of the present invention is that the data collection is used to collect data provided by various information source websites, and the data formats include CSV, XML and JSON formats;

[0020] Resource extraction converts various data formats of information sources into RDF format according to RML specifications, and then converts RDF data into the final structure of the present invention;

[0021] Link verification links data from different information sources through common identifiers to form a complete vulnerability exploitation and analysis process;

[0022] Data storage is used to store the processed data in an open source database system for RDF data and generate statistical data.

[0023] A further improvement of the present invention is that the detection countermeasure class related to ICS is extracted, which is based on attack detection and response strategy. The attack detection is classified into log / data analysis, log collection, audit strategy and monitoring, and the response strategy is classified into permission control, account audit, authorization, firewall, intrusion monitoring, network isolation and whitelist, forming a detection-countermeasure tuple.

[0024] A system for constructing a knowledge graph for network security assessment of industrial control systems, comprising:

[0025] A data acquisition module is used to acquire verified vulnerability and event information bases as information source data;

[0026] The data mapping module is used to define an object attribute model based on the resource description framework RDF and map data from multiple information sources based on the object attribute model;

[0027] The data processing module is used to build a data processing engine using the ETL concept, to process the compatibility of multiple mapped information source data, and to form an evaluation data set;

[0028] A data extraction module is used to process the formed evaluation data set and extract detection countermeasures related to ICS;

[0029] The classification and clustering module is used to classify and cluster all detection countermeasure classes according to similarities;

[0030] A classification mapping module, used to map the aggregated classifications to the NIST Cybersecurity Framework;

[0031] The knowledge graph construction module is used to complete the construction of the network security assessment knowledge graph based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND or OR gate logic.

[0032] A further improvement of the present invention is that the data acquisition module acquires a verified vulnerability and event information library as information source data, and the information source data includes common vulnerability omissions, a common vulnerability scoring system, a common platform enumeration, a common defect enumeration, and an attack type enumeration and classification data set.

[0033] A further improvement of the present invention is that an object attribute model based on a resource description framework RDF is defined in the data mapping module, including defining multiple information source data as objects, and each object contains corresponding key information as its attribute.

[0034] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for constructing a knowledge graph for network security assessment of an industrial control system.

[0035] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0036] The present invention provides a method for constructing a knowledge graph for network security assessment of industrial control systems. This method aims to solve the problem that existing knowledge graphs have poor scalability, cannot effectively cope with complex and changeable network attack scenarios, and most of the work revolves around attack behavior detection and cannot guide the actual work. The present invention constructs an information processing engine to format and integrate multi-dimensional heterogeneous network security data, and maps a practical attack detection and response strategy graph based on the assessment task based on the NIST network security architecture, effectively guiding the execution of network security assessment work of industrial control systems. The security assessment knowledge graph proposed by the present invention provides a basis for security assessment automation, and helps to improve the inherent security prevention capabilities of industrial control systems.

[0037] Furthermore, the present invention is limited by the public data set format when constructing knowledge graphs for existing work, and it is difficult to be compatible with multiple information sources. The present invention defines an object attribute model, a data processing engine designed based on the ETL concept, integrates data from information sources such as CVE and CVSS into RDF format, and formulates strategies such as resource linking and validity verification to improve the scalability of the network security knowledge graph;

[0038] The present invention provides a system for constructing a knowledge graph for network security assessment of industrial control systems. Existing work is limited to attack analysis and cannot meet the needs of security assessment. The present invention combines industrial control systems and the NIST network security architecture to map attack detection and response strategies to the security assessment implementation architecture, filling the gap in the network security knowledge graph for the field of network security assessment of industrial control systems, and helping to promote the implementation and standardization of security assessment work. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Schematic diagram for information source object extraction and attribute definition.

[0040] Figure 2 The flowchart of the data processing engine is shown in Figure 2.

[0041] Figure 3 Mapping process flow chart for security assessment.

[0042] Figure 4 This is a structural block diagram of a system for constructing a knowledge graph for network security assessment of an industrial control system according to the present invention. DETAILED DESCRIPTION

[0043] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to be able to fully convey the scope of the present invention to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0044] Example 1

[0045] This embodiment provides a method for constructing a knowledge graph for network security assessment of an industrial control system, including:

[0046] Obtain verified vulnerability and incident information repositories as information source data;

[0047] Define an object attribute model based on the resource description framework RDF, and map multiple information source data based on the object attribute model;

[0048] The data processing engine is constructed with the ETL concept to achieve the compatibility of the mapped multiple information source data and form an evaluation data set;

[0049] Process the formed evaluation data set to extract ICS-related detection countermeasures;

[0050] All detection countermeasures are classified and clustered according to similarities;

[0051] Map the aggregated categories to the NIST Cybersecurity Framework;

[0052] Based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND-OR gate logic, the network security assessment knowledge graph is constructed.

[0053] Example 2

[0054] This embodiment provides a method for constructing a knowledge graph for network security assessment of an industrial control system, which includes two parts: security information processing and security assessment mapping.

[0055] The security information processing, describing the core definition of the knowledge graph, and designing the initial and iterative architecture of the graph, mainly consists of the following steps:

[0056] Step 1: Select an existing vulnerability and incident information database and extract key words and important concepts. Figure 1 The main goal is to completely include the original data of each information base and realize the self-containment of the knowledge graph of the present invention;

[0057] Step 2, in order to map to the existing conceptual model, the present invention constructs a Resource Description Framework (RDF) model, keeping it similar to the data model of the information source;

[0058] The RDF is a general network resource description method, and the information source refers to a public security information library such as Common Vulnerabilities and Exposures (CVE). The present invention constructs an information collection method to form an extensible network security knowledge graph.

[0059] Step 3, the information source includes CVE, which provides a list of identifications for public security vulnerabilities. Based on CVE, the present invention incorporates the National Information Security Vulnerability Database CNVD to supplement the security checklist reference materials, security-related software defects, misconfigurations, product names, impact indicators and other information. Figure 1 ,CVE can be associated with other information sources in addition to ,custom attributes;

[0060] Step 4, the information source includes the Common Vulnerability Scoring System (CVSS), which can evaluate the severity of the vulnerability and help determine the urgency and importance of the required response. The present invention integrates the CVSS scores provided by CNVD and defines attributes by benchmark, time and environment;

[0061] Step 5, the information source includes Common Platform Enumeration (CPE), which is used to identify and name entities such as hardware platforms, operating systems, and applications. The present invention defines the attributes of CPE, which mainly include product-related fields such as name, version, etc.

[0062] Step 6: The information source includes Common Weakness Enumeration (CWE), which includes the identification, response and prevention of common software defects. CNVD vulnerabilities are mapped to CWE, and the defined attributes include ID, name, description, status, etc., as well as description relevance and response methods;

[0063] Step 7, the information source includes the Common Attack Pattern Enumeration and Classification (CAPEC) dataset, which is an attack pattern dictionary used to exploit known vulnerabilities. The defined attributes include ID, name, attack possibility, description, etc., as well as premise, technology, etc.

[0064] The above steps are mainly used to construct the knowledge graph to collect objects and attributes defined by the information source, and use the defined data format for further analysis and integration until the knowledge graph is built.

[0065] Step 8, see Figure 2 ,The present invention adopts the ETL idea (Extraction, Transformation, Loading) to process the information source data to construct a data processing engine, which mainly includes data collection, resource extraction, link verification and data storage processes, and can continuously update the knowledge graph;

[0066] Step 9, the data collection process, the present invention collects data provided by various information source websites, the data format includes CSV, XML and JSON and other formats, and the data processing engine of the present invention pulls and updates the data according to the update time of each information source;

[0067] Step 10, the resource extraction process converts various data formats of the information source into RDF format according to the RML specification, and then converts the RDF data into the final structure of the present invention;

[0068] The RML specification (RDF Mapping Language) is a standardized method for describing RDF file conversion, which converts data in various formats into RDF format. The present invention defines objects and attributes of each information source mainly to improve RDF conversion efficiency.

[0069] Step 11, the link verification process, the present invention links the data of different information sources through a common identifier to form a complete vulnerability exploitation and analysis process. In order to ensure the reliability of the linked information, the data processing engine of the present invention constructs a data verification mechanism. First, it is necessary to verify that the newly generated object contains the key attributes of the linked object. Secondly, it is necessary to verify that the identifiers between different information sources are available.

[0070] In the linking process, for example, each CWE vulnerability corresponds to a variety of CAPEC attack modes, and new objects can be associated with different resources through the association of various object identifiers. In the verification process, the Shapes Constraint Language (SHACL) is used to verify that the newly generated RDF data contains key attributes. In addition, the data processing engine of the present invention verifies whether the identifier of the linked object is valid before establishing a resource link. For example, if a CVE object contains the identifier of a CPE object, before establishing a resource link to form a new object, it first verifies whether the identifier of the CPE object is valid.

[0071] Step 12, the data storage process, the data processed by the data processing engine is stored in an open source database system for RDF data, and statistical data such as parsing time, parsing status (success or failure), instance count, link and generation time are generated.

[0072] Security information processing completes the information collection and transformation of the network security assessment knowledge graph of the present invention and builds the basis of the graph. There is a lack of targeted guidance for the network security assessment of industrial control systems (ICS). The security assessment mapping of the present invention mainly conducts the architecture of the security assessment process and the corresponding strategy mapping.

[0073] The security assessment mapping described above maps attacks and response strategies to the cybersecurity assessment process based on the NIST framework. For an overview of the process, see Figure 3 , the main steps are as follows:

[0074] Step a: First, the basic knowledge graph formed by graph construction is processed to extract attack detection and response strategies related to ICS;

[0075] The attack detection and response strategy extraction is based on an attack detection and response strategy. The schematic process of security assessment mapping is shown in Figure 3 .

[0076] The categories of attack detection mainly include log / data analysis, log collection, audit strategy, monitoring, etc., and the categories of response strategies mainly include permission control, account audit, authorization, firewall, intrusion monitoring, network isolation, whitelist, etc.

[0077] Step b: All detection and response strategies are classified and clustered according to similarities.

[0078] For the classification and clustering based on similarity, see Figure 3 ,For example, after the basic knowledge graph is extracted and ICS response strategies and ,detection methods, the prohibition of automatic operation strategy under the ,removable media copying category, the strategy of closing unnecessary ports and ,services under the network detection category, and the strategy of minimizing available ,services under the remote service exposure category are clustered into new detection and ,policy categories according to similarity, i.e. closing unnecessary ports / services.

[0079] In step c, the aggregated classifications are mapped to the NIST Cybersecurity Framework.

[0080] The NIST Cybersecurity Framework provides a list of cybersecurity incidents and solutions to related problems. For example, FCF (Facility Cybersecurity Framework) is an open source example that describes how to apply these solutions to actual defense mechanisms.

[0081] It is difficult for a certain measure of the NIST Cybersecurity Framework to solve a certain category of security issues in step b, so multiple solutions are combined to solve a certain category of problems. Figure 3 For example, combining FCF controls PR.PT-3 (implementing the principle of least functionality by configuring the system to provide only basic functionality) and PR.DS-5 (implementing protections to prevent data leakage) can effectively prevent potential data exfiltration through unnecessary open ports or services.

[0082] Step d, in addition to mapping the attack detection and response strategy and the NIST network security architecture, the present invention uses AND-OR gate logic to achieve full control of network attacks.

[0083] For the full network attack control of the AND / OR gate, please see Figure 3 For example, when conducting account monitoring, the activities of authorized and unauthorized personnel are mainly targeted, which can effectively discover security issues. However, if there are no security incidents in personnel monitoring, network monitoring is required to increase the difficulty for attackers to invade the target network and achieve the goal of network security assessment.

[0084] In step e, the mapping of the NIST cybersecurity architecture and the acquisition of information sources for knowledge graph construction are kept synchronously updated to ensure the real-time and reliability of the final industrial control system cybersecurity assessment knowledge graph.

[0085] Example 3

[0086] This embodiment provides a method for constructing a knowledge graph for network security assessment of an industrial control system, which includes two parts: security information processing and security assessment mapping.

[0087] The security information processing of this embodiment mainly implements functions such as object definition and data processing, and the specific steps are as follows:

[0088] Step 1, see Figure 1 ,Select information sources containing vulnerability information and security events to provide a basis for the construction of the knowledge graph;

[0089] The information sources include mainstream network security information data sources such as CVE, CVSS, CPE, CWE, and CAPEC.

[0090] Step 2: Considering the different formats and attributes of different data sources, this embodiment defines objects and attributes for them to unify multi-source heterogeneous data into a standard RDF format for subsequent processing.

[0091] The RDF format is a standardized method for processing heterogeneous data.

[0092] Step 3, see Figure 1 ,The object attribute definition is centered on CVE, and there are associations between different objects, which are connected through association attributes.

[0093] The specific object definitions of this embodiment are as follows:

[0094] CVE object, basic attributes include ID (id), description (desc), release time (isTp), update time (upTp), and associated attributes include related products (CVE:CPE), impact factors (CVE:CVSS), related defects (CVE:CWE), vulnerability configuration (CVE:vulCfg) and related references (CVE:ref).

[0095] CVSS object, basic attributes include prerequisites (vec), difficulty (cpx), specific permissions (prv), user interaction (usrInt), etc., and associated attributes include time-related code maturity (CVSS:codMat), repair level (CVSS:remLev), report confidence (CVSS:repCnf) and related attributes related to the environment.

[0096] CPE object, basic attributes include product-related attributes such as name (pn), version (pv), update (pu), language (pl), etc., as well as vendor-related attributes (vend).

[0097] CWE object, basic attributes include ID (id), name (name), description (desc), status (status), and related attributes include applicable platform (CWE:aplPlt), attack mode (CWE:CAPEC), impact factor (CWE:cnsq), related weaknesses (CWE:rltWek), solution (CWE:potMtg), etc.

[0098] CAPEC object, basic attributes include ID (id), name (name), attack possibility (lkhAtk), description (desc), and related attributes include impact factor (CAPEC:cnsq), attack technology (CAPEC:sill), attack premise (CAPEC:preR), etc.

[0099] Step 4, see Figure 2,After completing the definition of the information source data structure, this embodiment adopts the ETL idea to build a data processing engine, which includes processes such as data collection, resource extraction, link verification, and data storage;

[0100] Step 5, the data collection process of the data processing engine, this embodiment uses an automated script to pull public data from various information sources, and the decompressed data contains files in various formats such as CSV, XML, and JSON. The automated script synchronously obtains the latest results based on the update time of each information source;

[0101] Step 6: The resource extraction process of the data processing engine formats the data of various information sources into RDF files according to the RML specification. This embodiment uses the caRML engine to convert multi-source heterogeneous source files into RDF files;

[0102] Step 7, resource extraction process of the data processing engine. In order to improve data conversion efficiency, this embodiment converts the RDF file into the structure object of each information source defined in this embodiment through RDFLib;

[0103] The RDFLib conversion in this implementation is mainly to standardize the RDF file format, rather than a new data format that violates the RML specification. In short, caRML and RDFlib are the intermediate processes for converting multi-heterogeneous information officer data into RDF format object data defined in this example.

[0104] Step 8, the link verification process of the data processing engine, in this embodiment, a universal identifier is used to link different data source objects to form a comprehensive vulnerability exploitation analysis process;

[0105] For example, the associated attributes of a CWE object may contain multiple attack modes (CWE:CAPEC), indicating that a vulnerability may implement multiple attack modes. The specific link field here can be the ID field of CAPEC, that is, the implementation of the CWE:CAPEC attribute can be CWE:CAPEC{capec_id}.

[0106] Step 9, the link verification process of the data processing engine. In this embodiment, in order to ensure the correctness of the information after the link, a data verification mechanism is established to ensure the reliability of the vulnerability exploitation analysis conclusion;

[0107] The data verification mechanism of this embodiment first verifies whether the newly generated joint object contains the key attributes of the linked object, such as capec_id, etc. Secondly, it verifies the availability of the identifiers of different information providers, such as whether the other relevant attributes of CAPEC can be obtained through the capec_id of the CWE:CAPEC attribute.

[0108] This embodiment uses SHACL to verify the RDF data of the newly generated joint object. The main implementation is to verify the identifier of the associated object before establishing the resource link (such as verifying that the CAPEC id attribute is available), and after establishing the connection, verify whether the new object contains the key attributes of the linked object (such as verifying whether CWE contains the capec_id attribute).

[0109] Step 10, the data storage process of the data processing engine, in this embodiment, the processed data is stored in a triple database, such as RDFLib. And statistical data such as parsing time, parsing status, number of instances, generation time, etc. are generated;

[0110] The processed RDF data of this embodiment is stored in the Python-based RDFLib, and the RDF data can be queried through the Python interface call.

[0111] It should be understood that RDFLib in this embodiment is a relatively direct way to realize the conversion of multivariate heterogeneous data into RDF data. Data can also be converted and stored through Apache Jena and queried using the SPARQL language.

[0112] The security assessment mapping in this embodiment mainly implements functions such as information extraction, resource aggregation, and NIST mapping. For the main process, see Figure 3 , the specific steps are as follows:

[0113] Step 1, the information extraction function, based on the NIST network security assessment framework, first extracts ICS-related attack detection methods and response strategies from the RDF data stored in the information processing, and constructs a "detection-countermeasure" tuple;

[0114] The extraction of the ICS-related attack detection methods and response strategies, based on the NIST evaluation steps, builds an extraction engine through an automated script, queries and integrates the RDF data obtained from security information processing, and constructs a "detection-countermeasure" tuple for a certain type of ICS vulnerability.

[0115] Step 2, the resource aggregation function, in this embodiment, the extracted "detection-countermeasure" tuples are aggregated according to similarity;

[0116] For similarity clustering, see Figure 3 For example, the vulnerability "copying via removable media" of the extracted ICS basic "detection-countermeasure" tuple includes the countermeasure "prohibit automatic operation". The vulnerability "network detection" includes the countermeasure "close unnecessary ports and services". The vulnerability "remote service exposure" includes the countermeasure "minimize available services". They are all clustered into a new detection and countermeasure category according to similarity, namely "close unnecessary ports / services".

[0117] Step 3, the NIST mapping function, in this embodiment, maps the aggregated attack detection methods and response strategies to the NIST network security architecture;

[0118] The NIST Cybersecurity Architecture provides a list of cybersecurity incidents and solutions to related issues. For example, the open source FCF architecture is an implementation of the NIST Cybersecurity Architecture, which describes how to apply attack response strategies to actual security defenses.

[0119] Step 4, the NIST mapping function, this embodiment uses multiple FCF solutions to address a vulnerability issue of ICS. For example, see Figure 3 , combined with FCF controls PR.PT-3 (implementing the principle of least functionality by configuring the system to provide only basic functionality) and PR.DS-5 (implementing protections to prevent data leakage), can effectively prevent potential data exfiltration through unnecessary open ports or services.

[0120] Step 5: For more complex network attacks, this embodiment uses AND-OR gate logic to perform phased full-process control. For example, see Figure 3 When conducting account monitoring, the activities of authorized and unauthorized personnel are mainly targeted, which can effectively discover security issues. However, if there are no security incidents in personnel monitoring, network monitoring is required to increase the difficulty for attackers to invade the target network and achieve the goal of network security assessment.

[0121] Step 6: The security assessment mapping of this embodiment is updated synchronously with the security information processing to ensure that the RDF data and security assessment mapping of this embodiment are in the latest state when the information source data changes, thereby ensuring the reliability of the industrial control system network security assessment knowledge graph of this embodiment.

[0122] Example 4

[0123] Please see Figure 4 , this embodiment provides a system for constructing a knowledge graph for network security assessment of an industrial control system, including:

[0124] A data acquisition module is used to acquire verified vulnerability and event information bases as information source data;

[0125] The data mapping module is used to define an object attribute model based on the resource description framework RDF and map data from multiple information sources based on the object attribute model;

[0126] The data processing module is used to build a data processing engine using the ETL concept, to process the compatibility of multiple mapped information source data, and to form an evaluation data set;

[0127] A data extraction module is used to process the formed evaluation data set and extract detection countermeasures related to ICS;

[0128] The classification and clustering module is used to classify and cluster all detection countermeasure classes according to similarities;

[0129] A classification mapping module, used to map the aggregated classifications to the NIST Cybersecurity Framework;

[0130] The knowledge graph construction module is used to complete the construction of the network security assessment knowledge graph based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND or OR gate logic.

[0131] Example 5

[0132] This embodiment provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the method for constructing a knowledge graph for network security assessment of an industrial control system.

[0133] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0134] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0135] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0136] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0137] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A method for constructing a knowledge graph for network security assessment of industrial control systems, characterized in that: include: Obtain verified vulnerability and incident information repositories as information source data; Define an object attribute model based on the resource description framework RDF, and map multiple information source data based on the object attribute model; The data processing engine is constructed with the ETL concept to achieve the compatibility of the mapped multiple information source data and form an evaluation data set; Process the formed evaluation data set to extract ICS-related detection countermeasures; All detection countermeasures are classified and clustered according to similarities; Map the aggregated categories to the NIST Cybersecurity Framework; Based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND-OR gate logic, the network security assessment knowledge graph is constructed.

2. According to claim 1, a method for constructing a knowledge graph for network security assessment of an industrial control system is characterized in that: Acquire verified vulnerability and incident information repositories as information source data, which include common vulnerability vulnerabilities, common vulnerability scoring systems, common platform enumerations, common defect enumerations, and attack type enumeration and classification datasets.

3. The method for constructing a knowledge graph for network security assessment of an industrial control system according to claim 1, characterized in that: An object property model based on the resource description framework RDF is defined, including defining multiple information source data as objects, and each object contains corresponding key information as its attribute.

4. According to claim 1, a method for constructing a knowledge graph for network security assessment of an industrial control system is characterized in that: The data processing engine includes data collection, resource extraction, link verification and data storage, and has an autonomous update mechanism.

5. The method for constructing a knowledge graph for network security assessment of an industrial control system according to claim 4 is characterized in that: Data collection is used to collect data provided by various information source websites. The data formats include CSV, XML and JSON formats; Resource extraction converts various data formats of information sources into RDF format according to RML specifications, and then converts RDF data into the final structure of the present invention; Link verification links data from different information sources through common identifiers to form a complete vulnerability exploitation and analysis process; Data storage is used to store the processed data in an open source database system for RDF data and generate statistical data.

6. The method for constructing a knowledge graph for network security assessment of an industrial control system according to claim 1, characterized in that: The detection and countermeasure categories related to ICS are extracted based on attack detection and response strategies. The attack detection categories include log / data analysis, log collection, audit strategy and monitoring. The response strategy categories include permission control, account audit, authorization, firewall, intrusion monitoring, network isolation and whitelist, forming a detection-countermeasure tuple.

7. A system for constructing a knowledge graph for network security assessment of industrial control systems, characterized in that: include: A data acquisition module is used to acquire verified vulnerability and event information bases as information source data; The data mapping module is used to define an object attribute model based on the resource description framework RDF and map data from multiple information sources based on the object attribute model; The data processing module is used to build a data processing engine using the ETL concept, to process the compatibility of multiple mapped information source data, and to form an evaluation data set; A data extraction module is used to process the formed evaluation data set and extract detection countermeasures related to ICS; The classification and clustering module is used to classify and cluster all detection countermeasure classes according to similarities; A classification mapping module, used to map the aggregated classifications to the NIST Cybersecurity Framework; The knowledge graph construction module is used to complete the construction of the network security assessment knowledge graph based on the detection countermeasure class and the mapped NIST network security architecture, combined with AND or OR gate logic.

8. A system for constructing a knowledge graph for network security assessment of industrial control systems according to claim 7, characterized in that: The data acquisition module obtains the verified vulnerability and event information library as the information source data, which includes common vulnerability loopholes, common vulnerability scoring system, common platform enumeration, common defect enumeration, and attack type enumeration and classification data set.

9. According to claim 7, a system for constructing a knowledge graph for network security assessment of industrial control systems is characterized in that: The data mapping module defines an object attribute model based on the resource description framework RDF, including defining multiple information source data as objects, and each object contains corresponding key information as its attribute.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for constructing a knowledge graph for network security assessment of an industrial control system according to any one of claims 1 to 6.

Images