A dynamic threat path and vulnerability discovery method for industrial control networks

Abstract

The present invention discloses a method for discovering dynamic threat paths and vulnerabilities in industrial control networks, which relates to the field of industrial control network technology. The method includes constructing an industrial control network training scenario; generating a network topology structure through topology discovery; performing full-flow monitoring and health status monitoring on all network nodes, and associating and storing flow audit results; performing vulnerability analysis and threat mining on nodes, and forming a network threat and vulnerability attack set model in combination with threat path technology; simulating attack sequences based on model combinations, detecting threat paths and vulnerabilities, and generating threat path and vulnerability reports. By dynamically simulating industrial control network training scenarios, combining full-flow monitoring, health scoring, vulnerability analysis, multi-level attack simulation, and threat intelligence fusion technologies, accurate detection and real-time evaluation of threat paths and vulnerabilities in industrial control networks are achieved, providing scientific and real-time decision support for security protection strategies, and significantly improving anti-attack capabilities and protection decision-making efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and in particular to a method for discovering dynamic threat paths and vulnerabilities of industrial control networks. Background Art

[0002] As industrial control systems (ICS) evolve toward networking and intelligent systems, security threats facing industrial control networks are becoming increasingly severe. Traditional ICS systems primarily consist of an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer, with each layer interconnected by network devices. However, the openness and complexity of ICS networks make them vulnerable to cyberattacks. Attackers can exploit complex threat vectors to bypass traditional defenses and directly attack ICS systems, severely impacting the secure operation of critical infrastructure.

[0003] Existing security measures for industrial control networks primarily focus on static defenses such as firewalls, intrusion detection systems, and vulnerability patching. While these measures offer some protection against known attacks, they are ineffective against complex and diverse attack paths and unidentified vulnerabilities. Furthermore, there is a lack of effective monitoring and assessment methods for the health status of nodes, real-time traffic characteristics, and their dynamic changes within industrial control networks, making it difficult to identify potential threat paths and system vulnerabilities in real time. This results in security measures lagging behind attackers' actual attack behavior. Summary of the Invention

[0004] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a dynamic threat path and vulnerability discovery method for industrial control networks to solve the above-mentioned technical problems.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for discovering dynamic threat paths and vulnerabilities in industrial control networks, comprising:

[0006] S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected via a router or switch, and the network assets of each layer are connected via a switch.

[0007] S2: Automatically discover and generate network topology through network asset topology discovery;

[0008] S3: Perform full traffic monitoring and auditing on all network nodes in the network topology of the industrial control network training scenario, and store the traffic audit results in a time-series manner.

[0009] S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results;

[0010] S5: Perform vulnerability analysis and threat mining on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario. Combined with information network threat path technology, a network threat and vulnerability attack set model is formed. Based on the network threat and vulnerability attack set model, the attack sequence in the industrial control network training scenario is simulated.

[0011] S6: Detect threat paths and path vulnerabilities in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate network threat paths and path vulnerability reports.

[0012] The present invention is further configured as follows: the information management layer includes monitoring equipment, a management server and a database server, which are used to obtain industrial control field data through monitoring equipment; the industrial monitoring layer includes an engineer station and an operator station, which are used to monitor the industrial control process; the industrial control layer includes programmable logic controller equipment and distributed control system equipment, which are used to directly control the operating status and data interaction of field equipment; the field equipment layer includes production equipment and sensors, which are used to execute control commands and collect data in the production process.

[0013] The present invention is further configured such that step S3 includes:

[0014] Deploy traffic collection devices and probe nodes in the network topology to capture communication data of network nodes in real time and record attribute parameters of communication data packets, wherein the attribute parameters include sequence number, length, timestamp, source address and destination address;

[0015] Reconstructing the communication data packets in the order of timestamps to form communication association links sorted in time sequence;

[0016] The communication data packets and the communication-related links are audited in real time to generate flow audit results, which are stored in association with the communication data packets in a time series.

[0017] The present invention is further configured such that step S4 includes:

[0018] Obtaining network asset status parameters of all network nodes and terminal devices, and setting the network asset status parameters as a feature matrix;

[0019] Map network nodes, terminal devices, and corresponding feature matrices into graph nodes, and map the communication relationships between network nodes and terminal devices into graph edges to construct a health status monitoring graph structure.

[0020] The feature matrix is ​​encoded and decoded through self-supervised reconstruction to obtain the reconstructed feature matrix and deviation measure;

[0021] The abnormality degree is calculated according to the reconstructed characteristic matrix and the deviation measure, and the health score of the node is calculated according to the abnormality degree of the node to generate a health status monitoring result.

[0022] The present invention is further configured such that step S5 includes:

[0023] Perform vulnerability scanning and risk labeling on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario;

[0024] Based on the identified vulnerabilities, a threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records. The threat intelligence fusion model is used to define vulnerability parameters of network nodes and terminal devices.

[0025] Based on the threat intelligence fusion model, a multi-level attack simulation environment is constructed to simulate the attacker's attack behavior in the industrial control network training scenario, and the attack sequence in the industrial control network training scenario is combined and simulated.

[0026] The present invention is further configured such that the quantification logic of the vulnerability parameters of the network nodes and terminal devices is:

[0027] Quantify the severity of the vulnerability based on the CVSS standard to obtain a vulnerability severity score;

[0028] Quantify and score external threat intelligence based on the attack frequency and vulnerability utilization rate of external threats to obtain an external threat score;

[0029] Calculate the vulnerability parameters of network nodes and terminal devices based on vulnerability severity scores, external threat scores, and internal historical attack success rates.

[0030] The present invention is further configured to combine attack sequences in a simulated industrial control network training scenario, and the generation logic includes:

[0031] Obtain attack action sets and vulnerability parameters of network nodes and terminal devices;

[0032] Calculate the attack effect on the node through the correlation function based on the attack action set and vulnerability parameters;

[0033] Calculate the transfer cost of attacking the slave node based on the state transfer function;

[0034] An attack sequence is generated based on the attack effect on the node and the transfer cost of the node transfer.

[0035] The present invention is further configured such that the attack action set is represented as: A = {a1, a2, ...a N}, where A is a set of attack actions, a Nis the quantitative representation of the Nth attack action, and the quantitative index is the intensity of the attack action;

[0036] The calculation logic of the attack effect is: in, is the correlation function, a i is the attack action of the i-th node, v i is the vulnerability parameter of the i-th node, ρ is the sensitivity coefficient, λ is the adjustment coefficient, which is used to control the influence of the node vulnerability parameter on the attack effect, and σ(·) is the Sigmoid function, which is used to smooth the influence of the vulnerability parameter on the attack effect;

[0037] The calculation logic of transfer cost is: Among them, Ω(c i-1 , c i ) is the state transfer function, d(c i-1 , c i ) is the transfer distance from the i-1th node to the i-th node, γ is the distance impact factor, which is used to adjust the degree of inhibition of distance on transfer success, R trans (c i-1 , c i ) is the difference in health scores from the i-1th node to the i-th node, ξ is the health sensitivity coefficient, which is used to control the impact of health status on the transfer process;

[0038] The attack sequence generation logic is: Among them, S attack For the attack sequence.

[0039] The present invention is further configured such that step S6 includes:

[0040] The threat path health status score is calculated based on the threat path in the generated attack sequence according to the preset threat path health propagation formula;

[0041] Calculating a threat path vulnerability score according to the threat path health status score and a preset path vulnerability calculation formula;

[0042] Arrange the threat paths in descending order according to the threat path vulnerability scores and generate a network threat path and path vulnerability report.

[0043] The present invention is further configured as follows: a preset threat path health propagation formula: Among them, H path Score the threat path health status, W(H i , v i ) is the health weight function, and the calculation logic is: H iis the health score of the node, α is the adjustment coefficient, which is used to control the impact of the health score on the health weight, Φ(H i , H i+1 ) is the health state propagation function, and the calculation logic is: Φ(H i , H i+1 )=tanh(β·(H i -H i+1 )), β is the difference amplification coefficient, which is used to control the amplification or suppression of the health status difference between nodes;

[0044] The preset path weakness calculation formula is: Among them, L path is the threat path vulnerability score, M is the number of nodes in the path, Γ(H path，j , V j ) is the interaction function between health status and node weakness, and the calculation logic is: H path，j is the health status score of the jth node in the path, δ is the adjustment coefficient, which is used to control the influence of vulnerability on health status, κ is the adjustment parameter, which is used to control the contribution of node health status to path vulnerability, η is the adjustment parameter, which controls the contribution of node vulnerability to path vulnerability, and θ is the adjustment factor, which is used to balance the combined effects of health status and vulnerability on path vulnerability.

[0045] The present invention provides a method for discovering dynamic threat paths and vulnerabilities in industrial control networks. The method constructs an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. The layers are connected via routers or switches, and the network assets of the layers are connected via switches. The method automatically discovers and generates a network topology structure through network asset topology discovery. The method performs full flow monitoring and auditing on all network nodes in the network topology structure of the industrial control network training scenario, and stores the flow audit results in a time series. The method automatically discovers and generates a network topology structure through network asset topology discovery. The method performs full flow monitoring and auditing on all network nodes in the network topology structure of the industrial control network training scenario, and stores the flow audit results in a time series. The network nodes and terminal devices are subjected to network asset identification health monitoring to generate health status monitoring results; all network nodes and terminal devices in the network topology structure under the industrial control network training scenario are subjected to self-vulnerability analysis and threat mining, and the information network threat path technology is combined to form a network threat and vulnerability attack set model. The attack sequence under the industrial control network training scenario is simulated based on the network threat and vulnerability attack set model; the threat path and path vulnerability under the industrial control network training scenario are detected by combining the attack sequence under the industrial control network training scenario, and a network threat path and path vulnerability report is generated. The beneficial effects include:

[0046] 1. Improved Threat Detection Accuracy: This invention achieves a high degree of simulation of the real-world operating environment of industrial control networks by constructing an industrial control network training scenario encompassing the information management layer, industrial monitoring layer, industrial control layer, and field device layer. Combined with full-flow monitoring and auditing, network asset identification, and health status monitoring, it can dynamically discover the real-time status of all network nodes and terminal devices in the industrial control network, thereby improving the accuracy of threat path detection.

[0047] 2. Comprehensively assess system security status: This method evaluates the health of network nodes and terminal devices through self-supervisory reconstruction, generating a health score. This score then quantifies the node's vulnerability parameters by combining the severity of the node's vulnerability, external threat intelligence, and historical attack records. This method comprehensively reflects the node's health status and potential vulnerabilities, providing a scientific basis for risk assessment and effectively addressing the shortcomings of traditional protection measures in dynamic threat assessment.

[0048] 3. Accurately identify threat paths and path vulnerabilities: This invention builds a threat intelligence fusion model and, based on it, a multi-level attack simulation environment, which can realistically simulate attackers' attack behaviors in industrial control networks. By calculating the correlation between attack actions and node vulnerabilities, as well as the state transition cost of the attack path, it generates highly realistic and complex attack sequences, thereby accurately identifying threat paths and path vulnerabilities, providing a reliable basis for industrial control network security protection strategies.

[0049] 4. Improved protection decision-making efficiency: This invention detects threat paths and vulnerabilities in industrial control networks by combining simulated attack sequences and generates threat path and vulnerability reports. These reports reflect the risk status and vulnerability distribution of each node in the industrial control network in real time, providing real-time, dynamic decision-making support for security managers and significantly improving the response speed and accuracy of network protection strategies.

[0050] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without inventive efforts. In the drawings:

[0052] Figure 1The flowchart of a method for discovering dynamic threat paths and vulnerabilities in an industrial control network is shown as an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following describes the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art will readily appreciate the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments, and the various details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are intended only to illustrate the present invention and are not intended to limit the scope of protection of the present invention.

[0054] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0055] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0056] A method for discovering dynamic threat paths and vulnerabilities in industrial control networks, such as Figure 1 Shown, including:

[0057] S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected via a router or switch, and the network assets of each layer are connected via a switch.

[0058] S2: Automatically discover and generate network topology through network asset topology discovery;

[0059] S3: Perform full traffic monitoring and auditing on all network nodes in the network topology of the industrial control network training scenario, and store the traffic audit results in a time-series manner.

[0060] S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results;

[0061] S5: Perform vulnerability analysis and threat mining on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario. Combined with information network threat path technology, a network threat and vulnerability attack set model is formed. Based on the network threat and vulnerability attack set model, the attack sequence in the industrial control network training scenario is simulated.

[0062] S6: Detect threat paths and path vulnerabilities in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate network threat paths and path vulnerability reports.

[0063] Specifically, the industrial control network training scenario is a virtual environment that simulates an industrial control system (ICS), which aims to replicate the hierarchical structure and communication mode of an actual industrial control network. The scenario consists of an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected through network devices (such as routers or switches), and the network assets of each layer are also internally connected through switches. The present invention is further configured such that the information management layer includes monitoring equipment, a management server, and a database server for obtaining industrial control field data through monitoring equipment; the industrial monitoring layer includes an engineer station and an operator station for monitoring the industrial control process; the industrial control layer includes a programmable logic controller device and a distributed control system device for directly controlling the operating status and data interaction of field equipment; the field device layer includes production equipment and sensors for executing control commands and collecting data in the production process.

[0064] Specifically, in step S2, when network assets support topology discovery, the topology is automatically generated through network asset topology discovery. If topology discovery is not supported, topology generation is also supported by manually entering asset relationships. The topology is generated using a knowledge graph of relationship triples.

[0065] The present invention is further configured such that step S3 includes:

[0066] Traffic collection equipment and probe nodes are deployed in the network topology structure to capture the communication data of the network nodes in real time and record the attribute parameters of the communication data packets, wherein the attribute parameters include sequence number, length, timestamp, source address and destination address; specifically, traffic collection equipment and probe nodes are deployed at key locations of the network topology structure to capture the communication data between nodes in the network in real time, and to obtain detailed data packet information without interrupting normal network operation; the captured data packet attribute parameters include key information such as sequence number, length, timestamp, source address and destination address, which can fully reflect the transmission path, time, source and destination of the data packet, and provide a complete perspective on the data flow; sequence number: identifies the order of the data packet in the communication sequence, and is used to analyze the transmission order and integrity of the data packet; length: the size of the data packet, which is used to determine the data flow and bandwidth usage; timestamp: records the time point when the data packet is captured, and is used to reconstruct the communication link and timing analysis; source address and destination address: identify the sending and receiving devices of the data packet, and help determine the source and end point of the data flow;

[0067] Reconstructing the communication data packets in the order of timestamps to form a communication association link sorted in time series; specifically, reconstructing the captured data packets in the order of timestamps to form a complete communication association link, which can rearrange scattered data packets and restore the original communication order, helping to identify possible abnormal connections or unauthorized data flows;

[0068] The communication data packets and associated communication links are audited in real time to generate traffic audit results, which are then stored in association with the communication data packets in chronological order. Specifically, the reconstructed data packets and associated communication links are audited in real time, with audit content including packet legitimacy checks, traffic analysis, and abnormal behavior detection. The generated traffic audit results are then stored in association with the original communication data packets in chronological order to form a comprehensive traffic audit database.

[0069] Specifically, in step S4, the present invention obtains network asset status parameters of network nodes and terminal devices, sets these parameters as feature matrices, and further maps these matrices into graph structures to monitor health status and detect anomalies. This process includes constructing a health status monitoring graph, self-supervised reconstruction, calculating anomaly levels and health scores, and aims to accurately identify the health status and potential anomalies of each node and device in the network. The present invention is further configured so that step S4 includes:

[0070] Obtain the network asset status parameters of all network nodes and terminal devices and set them as a feature matrix. Specifically, collect network asset status parameters for all network nodes and terminal devices, including key indicators such as CPU utilization, memory usage, network traffic characteristics, and error rates, reflecting the operational status of nodes and devices. Integrate the collected status parameters into a feature matrix, where each row or column represents a multi-dimensional combination of status parameters for a node or device. The feature matrix serves as the foundational data for subsequent graph structure construction and health assessment.

[0071] The network nodes, terminal devices, and their corresponding feature matrices are mapped as graph nodes, and the communication relationships between network nodes and terminal devices are mapped as graph edges to construct a health monitoring graph structure. Specifically, each network node, terminal device, and its feature matrix are mapped as a node in the graph, so that each graph node not only represents a device or node, but also contains its corresponding status information. The communication relationships between network nodes and terminal devices are mapped as graph edges, and the edge weights can represent network characteristics such as communication frequency, bandwidth, and latency. This graph structure construction makes health monitoring not limited to a single node, but also takes into account the interactive relationships between nodes.

[0072] Through self-supervised reconstruction, the feature matrix is ​​encoded and decoded to obtain a reconstructed feature matrix and a deviation measure. Self-supervised reconstruction of the constructed feature matrix involves encoding and decoding the feature matrix to reconstruct a reconstructed feature matrix similar to the original feature matrix. The self-supervised nature of the reconstruction process does not rely on external labels or supervisory signals; training is performed solely on the data itself. The difference between the reconstructed feature matrix and the original feature matrix is ​​used to calculate the deviation measure. The deviation measure reflects the gap between the actual operating state of a node or device and its ideal state, and is an important basis for anomaly detection.

[0073] The degree of abnormality is calculated based on the reconstructed feature matrix and the deviation measure, and the health score of the node is calculated based on the abnormality of the node to generate a health status monitoring result. Specifically, the self-supervised reconstruction measures the degree of deviation of the health feature by encoding and decoding the features. The greater the deviation, the higher the degree of abnormality. The abnormality measurement function calculates the relative deviation of the node, and calculates the abnormality of each node or device based on the deviation measure. The abnormality indicates the degree to which the behavior or state of the node deviates from normal operation. This is a prior art and will not be described in detail here. The abnormality is further converted into a health score. The health score reflects the overall operating status of the node or device. The higher the score, the healthier the node, and vice versa. The health score ultimately forms a health status monitoring result to help identify potential security issues. Furthermore, the calculation logic of the health score is: S i is the health score of the i-th node, w is the impact of the control abnormality on the score, Ab i is the abnormality degree of the i-th node, Indicates that the jth node is the neighbor node of the i-th node, β ij The impact factor of neighbor scores reflects the impact of neighbor nodes on the health of the current node.

[0074] In step S5, vulnerability scanning and risk labeling are performed on network nodes and terminal devices in the industrial control network training scenario. A threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records. The model is then used to simulate the attacker's multi-level attack behavior. This step aims to comprehensively assess potential risks in the industrial control network, identify vulnerabilities, and simulate real-world attack scenarios, providing data support for improving network security protection. The present invention further configures step S5 to include:

[0075] Conduct vulnerability scanning and risk labeling for all network nodes and terminal devices within the network topology of the industrial control network training scenario. Comprehensive vulnerability scanning is performed on all network nodes and terminal devices within the industrial control network topology to identify security vulnerabilities within the devices and nodes, such as unpatched vulnerabilities, configuration errors, and weak passwords. Identified vulnerabilities are then labeled for risk, including an assessment of vulnerability severity, scope of impact, and exploitability, to form a comprehensive risk picture.

[0076] Based on identified vulnerabilities, a threat intelligence fusion model is constructed by combining external threat intelligence and internal historical attack records. This model is used to define vulnerability parameters for network nodes and terminal devices. External threat intelligence includes popular attack methods, attack frequencies, and known vulnerability exploits, while internal historical attack records include past attack events and their patterns experienced by the industrial control network. This fusion model comprehensively analyzes external and internal intelligence to define vulnerability parameters for each network node and terminal device. These vulnerability parameters reflect the node's vulnerability to the current threat scenario.

[0077] A multi-layered attack simulation environment is constructed based on the threat intelligence fusion model to simulate attacker behavior in industrial control network training scenarios. The environment combines simulated attack sequences within these scenarios. Specifically, based on the threat intelligence fusion model, this multi-layered attack simulation environment simulates the multi-step attack process of an attacker penetrating the internal network from the external network, including initial access, lateral movement, privilege escalation, data theft, and other attack steps. The simulation environment dynamically generates multiple attack scenarios based on different attack paths and attack methods, generating corresponding attack strategies for nodes with different vulnerability parameters to ensure the authenticity and diversity of the attack simulation. Within the attack simulation environment, simulated attack sequences are combined based on the vulnerability parameters generated by the threat intelligence fusion model. Each attack sequence consists of multiple attack actions, simulating an attacker's potential behavior within the industrial control network. The simulated attack sequences reflect the attacker's possible intrusion paths, exploited vulnerabilities, attack methods, and their impact on nodes and devices.

[0078] Specifically, by quantifying the vulnerability parameters of network nodes and terminal devices, the scientific nature and accuracy of vulnerability assessments are improved. The specific quantification logic includes three main steps: comprehensive analysis and calculation of vulnerability severity scores, external threat scores, and internal historical attack success rates, ultimately obtaining the vulnerability parameters of nodes and devices; the present invention further configures the quantification logic of the vulnerability parameters of network nodes and terminal devices as follows:

[0079] Vulnerability severity scores are quantified based on the CVSS standard. Specifically, CVSS (Common Vulnerability Scoring System) is an internationally recognized vulnerability assessment standard used to quantify vulnerability severity. The CVSS score considers multiple dimensions, including exploitability, scope of impact, attack complexity, and user interaction requirements, to provide a comprehensive score reflecting the potential threat posed by a vulnerability to the system.

[0080] External threat intelligence is quantitatively scored based on the attack frequency and vulnerability exploitation rate of external threats to obtain an external threat score. External threat intelligence is analyzed and scored to specifically assess the attack frequency and vulnerability exploitation rate of external threats. The attack frequency indicates how often the threat occurs in the current network, while the vulnerability exploitation rate reflects the actual extent to which the attacker exploits the vulnerability.

[0081] Vulnerability parameters for network nodes and terminal devices are calculated based on the vulnerability severity score, external threat score, and historical internal attack success rate. The vulnerability parameters for network nodes and terminal devices are calculated by combining the vulnerability severity score, external threat score, and historical internal attack success rate. The historical internal attack success rate refers to the success rate of past attacks against similar nodes or devices in the network, reflecting the node's historical vulnerability. Combining these scores, the vulnerability parameter quantifies the node's vulnerability to the current threat environment. The vulnerability parameter is calculated by taking a weighted sum of the vulnerability severity score, external threat score, and historical internal attack success rate. A larger vulnerability parameter indicates a more vulnerable node.

[0082] The present invention is further configured to combine attack sequences in a simulated industrial control network training scenario, and the generation logic includes:

[0083] Obtain the attack action set and vulnerability parameters of the network node and terminal device; the present invention is further configured such that the attack action set is represented by: A = {a1, a2, ...a N}, where A is a set of attack actions, a N is the quantitative representation of the Nth attack action, and the quantitative index is the intensity of the attack action;

[0084] The attack effect on the node is calculated through the association function based on the attack action set and vulnerability parameters; the calculation logic of the attack effect is: in, is the correlation function, a i is the attack action of the i-th node, v i is the vulnerability parameter of the i-th node, ρ is the sensitivity coefficient, λ is the adjustment coefficient, which is used to control the influence of the node vulnerability parameter on the attack effect, and σ(·) is the Sigmoid function, which is used to smooth the influence of the vulnerability parameter on the attack effect. Specifically, the above calculation logic aims to quantify the attack effect on the node. By combining the attack action set and the node vulnerability parameter, the actual effect of the attack action on the specific node is calculated. The sensitivity coefficient ρ ranges from 0.1 to 10 and is used to adjust the influence of vulnerability on the attack effect. The higher the value, the greater the influence of vulnerability on the attack effect. λ is the adjustment coefficient ranges from 0.1 to 5 and is used to control the weight of vulnerability in the attack effect. The larger the λ, the higher the proportion of vulnerability.

[0085] The transfer cost of attacking the slave node is calculated based on the state transfer function. The calculation logic of the transfer cost is: Among them, Ω(c i-1 , c i ) is the state transfer function, d(c i-1 , c i) is the transfer distance from the i-1th node to the i-th node, γ is the distance impact factor, which is used to adjust the degree of inhibition of distance on transfer success, R trans (c i-1 , c i ) is the difference in health scores from the i-1th node to the i-th node, ξ is the health sensitivity coefficient, which is used to control the impact of health status on the transfer process; the above calculation logic calculates the transfer cost of the attack when it transfers between nodes through the state transfer function. The transfer cost reflects the actual difficulty and cost of the attacker's movement in the industrial control network, taking into account factors such as the physical distance between nodes and the difference in health status. The distance impact factor γ ranges from 0.1 to 10. The higher the value, the more significant the impact of distance on the transfer cost; the health sensitivity coefficient ξ ranges from 0.1 to 5; by comprehensively considering the distance and health status differences, the present invention can accurately quantify the difficulty of the attack transferring between nodes, so that the simulated attack path is more consistent with the real attack scenario.

[0086] The attack sequence is generated based on the attack effect on the node and the transfer cost of the node transfer; the generation logic of the attack sequence is: Among them, S attack Specifically, the computational logic used to generate the attack sequence constructs a complete attack path sequence by combining the attack effect on the node and the transfer cost between nodes. The formula represents the process by which an attacker executes a series of attack actions and moves between nodes in an industrial control network, comprehensively considering the impact of the attack on nodes and the feasibility of the attack path.

[0087] The present invention is further configured such that step S6 includes:

[0088] The threat path health status score is calculated based on the threat path in the generated attack sequence according to the preset threat path health propagation formula; the present invention is further configured as follows: Among them, H path Score the threat path health status, W(H i , v i ) is the health weight function, and the calculation logic is: H i is the health score of the node, α is the adjustment coefficient, which is used to control the impact of the health score on the health weight, Φ(H i , H i+1 ) is the health state propagation function, and the calculation logic is: Φ(H i , H i+1 )=tanh(β·(H i -H i+1)), β is the difference amplification coefficient, which is used to control the amplification or suppression of the health status differences between nodes; specifically, the above calculation logic is used to evaluate the health status of the threat path, and calculate the overall health status score of the threat path based on the health scores of each node in the generated attack sequence and their differences. By considering the health weight of each node and the health status transfer function between nodes, the overall health status of each node in the path can be comprehensively evaluated, thereby identifying the weak links in the threat path; the adjustment coefficient α is usually in the range of 0.1 to 10, which is used to adjust the impact of the health score on the weight, and a larger value increases the influence of the health score; the difference amplification coefficient β has a value range of 0.1 to 5, which is used to control the impact of the health status differences between nodes, and a larger value enhances the transfer effect of the difference on the health status. By combining the health weight and the status transfer function, the present invention can comprehensively evaluate the health status in the threat path and accurately identify the weak nodes in the path.

[0089] The threat path vulnerability score is calculated according to the threat path health status score according to the preset path vulnerability calculation formula; the preset path vulnerability calculation formula is: Among them, L path is the threat path vulnerability score, M is the number of nodes in the path, Γ(H path，j , V j ) is the interaction function between health status and node weakness, and the calculation logic is: H path，j is the health status score of the jth node in the path, δ is the adjustment coefficient, which is used to control the degree of influence of vulnerability on health status, κ is the adjustment parameter, which is used to control the amplitude of contribution of node health status to path vulnerability, η is the adjustment parameter, which controls the degree of contribution of node vulnerability to path vulnerability, and θ is the adjustment factor, which is used to balance the comprehensive influence of health status and vulnerability on path vulnerability. Specifically, the above calculation logic aims to evaluate the overall vulnerability of the threat path. By combining the health status score of each node in the path and the interaction of node vulnerability, the path vulnerability score is calculated, which comprehensively considers the health status and vulnerability parameters. The complex relationship between them is used to determine the contribution of each node in the threat path to the overall vulnerability; the adjustment coefficient δ ranges from 0.1 to 5 and is used to adjust the degree of influence of vulnerability on health status, and a higher value will enhance the influence of vulnerability on health status; the adjustment parameters κ and η range from 0.1 to 10 and control the influence of health status and vulnerability on path vulnerability score; the adjustment factor θ ranges from 0.1 to 3 and is used to balance the comprehensive influence of health status and vulnerability on path vulnerability. Through the comprehensive application of interaction function and adjustment coefficient, the present invention can accurately quantify path vulnerability and help identify key weak nodes in the path.

[0090] Threat paths are sorted in descending order according to their vulnerability scores to generate a network threat path and path vulnerability report. Specifically, by sorting by vulnerability score, administrators can quickly identify the most vulnerable paths in the network that require the most protection, optimize resource allocation, and improve overall protection efficiency.

[0091] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0092] It should be understood that the term "and / or" as used herein simply describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the associated objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0093] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0094] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0095] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0098] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0099] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0101] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for discovering dynamic threat paths and vulnerabilities in industrial control networks, characterized in that: include: S1: Construct an industrial control network training scenario, which includes an information management layer, an industrial monitoring layer, an industrial control layer, and a field device layer. Each layer is connected via a router or switch, and the network assets of each layer are connected via a switch. S2: Automatically discover and generate network topology through network asset topology discovery; S3: Perform full traffic monitoring and auditing on all network nodes in the network topology of the industrial control network training scenario, and store the traffic audit results in a time-series manner. S4: Perform network asset identification and health monitoring on all network nodes and terminal devices in the network topology structure of the industrial control network training scenario, and generate health status monitoring results; S5: Analyze the vulnerabilities and threats of all network nodes and terminal devices in the network topology structure under the industrial control network training scenario, combine the information network threat path technology to form a network threat and vulnerability attack set model, and simulate the attack sequence in the industrial control network training scenario based on the network threat and vulnerability attack set model, including: scanning the vulnerabilities and labeling the risks of all network nodes and terminal devices in the network topology structure under the industrial control network training scenario; based on the identified vulnerabilities, combine external threat intelligence and internal historical attack records to build a threat intelligence fusion model, wherein the threat intelligence fusion model is used to Define the vulnerability parameters of network nodes and terminal devices; build a multi-level attack simulation environment based on the threat intelligence fusion model, simulate the attacker's attack behavior in the industrial control network training scenario, and combine and simulate the attack sequence in the industrial control network training scenario; combine and simulate the attack sequence in the industrial control network training scenario, and the generation logic includes: obtaining the attack action set and vulnerability parameters of network nodes and terminal devices; calculating the attack effect on the node through the association function based on the attack action set and vulnerability parameters; calculating the transfer cost of the attack from the node based on the state transfer function; and generating the attack sequence based on the attack effect on the node and the transfer cost of the node transfer; S6: Detect threat paths and path vulnerabilities in industrial control network training scenarios by combining attack sequences in simulated industrial control network training scenarios, and generate a network threat path and path vulnerability report, including: calculating a threat path health status score according to a preset threat path health propagation formula based on the threat path in the generated attack sequence; calculating a threat path vulnerability score according to a preset path vulnerability calculation formula based on the threat path health status score; and arranging the threat paths in descending order according to the threat path vulnerability score to generate a network threat path and path vulnerability report.

2. A method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 1, characterized in that: The information management layer includes monitoring equipment, management servers and database servers, which are used to obtain industrial control field data through monitoring equipment; the industrial monitoring layer includes engineer stations and operator stations, which are used to monitor industrial control processes; the industrial control layer includes programmable logic controller devices and distributed control system devices, which are used to directly control the operating status and data interaction of field devices; the field equipment layer includes production equipment and sensors, which are used to execute control commands and collect data in the production process.

3. The method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 1, characterized in that: Step S3 includes: Deploy traffic collection devices and probe nodes in the network topology to capture communication data of network nodes in real time and record attribute parameters of communication data packets, wherein the attribute parameters include sequence number, length, timestamp, source address and destination address; Reconstructing the communication data packets in the order of timestamps to form communication association links sorted in time sequence; The communication data packets and the communication-related links are audited in real time to generate flow audit results, which are stored in association with the communication data packets in a time series.

4. The method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 1, characterized in that: Step S4 includes: Obtaining network asset status parameters of all network nodes and terminal devices, and setting the network asset status parameters as a feature matrix; Map network nodes, terminal devices, and corresponding feature matrices into graph nodes, and map the communication relationships between network nodes and terminal devices into graph edges to construct a health status monitoring graph structure. The feature matrix is ​​encoded and decoded through self-supervised reconstruction to obtain the reconstructed feature matrix and deviation measure; The abnormality degree is calculated according to the reconstructed characteristic matrix and the deviation measure, and the health score of the node is calculated according to the abnormality degree of the node to generate a health status monitoring result.

5. The method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 1, characterized in that: The quantitative logic of the vulnerability parameters of network nodes and terminal devices is: Quantify the severity of the vulnerability based on the CVSS standard to obtain a vulnerability severity score; Quantify and score external threat intelligence based on the attack frequency and vulnerability utilization rate of external threats to obtain an external threat score; Calculate the vulnerability parameters of network nodes and terminal devices based on vulnerability severity scores, external threat scores, and internal historical attack success rates.

6. The method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 1, characterized in that: The attack action set is expressed as: ,in, is the attack action set, For the The quantitative representation of an attack action, the quantitative index is the intensity of the attack action; The calculation logic of the attack effect is: ,in, is the correlation function, For the The attack strength of each node, For the The weakness parameter of each node, is the sensitivity coefficient, is the adjustment coefficient used to control the influence of the node weakness parameter on the attack effect. is the Sigmoid function, which is used to smooth the influence of the weakness parameter on the attack effect; The calculation logic of transfer cost is: ,in, is the state transition function, For the Node to The transfer distance of nodes, is the distance impact factor, which is used to adjust the degree of inhibition of distance on transfer success. For the Node to The difference in health scores of nodes, is the health sensitivity coefficient, which is used to control the impact of health status on the transfer process; The attack sequence generation logic is: ,in, For the attack sequence.

7. The method for discovering dynamic threat paths and vulnerabilities in industrial control networks according to claim 6, characterized in that: Preset threat path health communication formula: ,in, Score the threat path health status, is the health weight function, For the The weakness parameter of each node is calculated as follows: , is the health score of the i-th node, is the adjustment coefficient, which is used to control the impact of health score on health weight. is the health status propagation function, and the calculation logic is: , is the difference amplification coefficient, which is used to control the amplification or suppression of the health status differences between nodes; The preset path weakness calculation formula is: ,in, is the health score of the jth node, For the The weakness parameter of each node, Score the threat path vulnerability, is the number of nodes in the path, It is the interaction function between health status and node weakness, and the calculation logic is: , The first The health status score of each node, is the adjustment coefficient, which is used to control the impact of frailty on health status. is a tuning parameter used to control the contribution of node health status to path weakness. To adjust the parameters and control the contribution of node weakness to path weakness, It is an adjustment factor used to balance the combined effects of health status and vulnerability on path vulnerability.

Images