Endogenous safety protection system and method

Abstract

The invention relates to an endogenous security protection system and method, and the system comprises a vulnerability database which comprises vulnerability data obtained by the endogenous security protection system through the vulnerability evaluation of assets in an industrial control system, and a corresponding relation between the assets and the vulnerability data; the baseline adjustment module is used for acquiring target vulnerability data corresponding to the target assets from the vulnerability database and updating the security baselines of the target assets based on the target vulnerability data; the data acquisition module is used for acquiring a to-be-tested data set related to the target assets; and the anomaly detection module is used for comparing each data item in the to-be-detected data set with the updated security baseline, and taking the data item inconsistent with the updated security baseline as an abnormal data item. Through the method and the device, the problems of low instantaneity and accuracy of vulnerability detection of industrial assets in related technologies are solved.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to an intrinsic security protection system and method. Background Art

[0002] With the continuous development of network technology, the Industrial Internet, as a product of the deep integration of new-generation information technology and manufacturing, is entering a new stage of informatization and intelligent development. However, in this process, the cybersecurity threats faced by industrial assets in the Industrial Internet are becoming increasingly severe. Attackers will exploit the vulnerabilities of industrial assets to try to penetrate and destroy industrial assets, which will cause serious economic losses to related industries.

[0003] Vulnerability can also be called weakness or loophole, which is a weak link in industrial assets that may be exploited and can cause damage to industrial assets. Vulnerability is often caused by defects in system security strategies, such as defects in the logical design of application software or operating system software or errors in writing, which can be exploited to allow attackers to access or damage the system without authorization.

[0004] At present, some security organizations and operating system manufacturers regularly publish assessment results on the severity of industrial asset vulnerabilities to provide a basis for users to detect the vulnerabilities of industrial assets. However, this method cannot achieve timely discovery and effective prevention when new security vulnerabilities and vulnerability information appear in the industrial Internet, and the accuracy of vulnerability detection is also low.

[0005] Currently, no effective solution has been proposed to address the problems of low immediacy and accuracy in vulnerability detection of industrial assets in related technologies. Summary of the invention

[0006] The embodiments of the present application provide an intrinsic security protection system and method to at least solve the problem of low immediacy and accuracy of vulnerability detection of industrial assets in related technologies.

[0007] In the first aspect, an embodiment of the present application provides an intrinsic security protection system, which includes: a vulnerability database, the vulnerability database includes vulnerability data obtained by the intrinsic security protection system through vulnerability assessment of assets in the industrial control system, and the corresponding relationship between the assets and the vulnerability data; a baseline adjustment module, used to obtain target vulnerability data corresponding to the target asset from the vulnerability database, and update the security baseline of the target asset based on the target vulnerability data; a data acquisition module, used to obtain a test data set related to the target asset; an anomaly detection module, used to compare each data item in the test data set with the updated security baseline, and treat data items inconsistent with the updated security baseline as abnormal data items.

[0008] In some embodiments, the anomaly detection module is further used to classify the abnormal data items and add an identifier to the abnormal data items based on the classification result, wherein the identifier indicates the category of the security threat corresponding to the abnormal data item.

[0009] In some embodiments, the anomaly detection module includes a feature extraction unit for extracting features from the abnormal data items, and classifying the abnormal data items using a naive Bayesian classification algorithm based on the features of the extracted abnormal data items. The calculation formula of the naive Bayesian classification algorithm is as follows:

[0010]

[0011] Among them, x1,x2,…,x n Represents the characteristics of abnormal data items, y i Indicates the category of security threat, P(y i ) indicates the preset and category y i The corresponding prior probability, P(x j |y i ) represents the preset and feature x j and category y i The corresponding class conditional probability.

[0012] In some embodiments, the vulnerability database also includes: a correspondence between vulnerability data and risk levels; the anomaly detection module includes an anomaly analysis unit, which is used to compare the abnormal data item with the vulnerability data in the vulnerability database, and determine the risk level corresponding to the abnormal data item based on the comparison result, and the associated assets related to the abnormal data item.

[0013] In some embodiments, the endogenous security protection system further includes a policy output module for generating a security protection policy based on the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item.

[0014] In some embodiments, the baseline adjustment module is further used to update the security baseline of the target asset based on the target vulnerability data, the risk level corresponding to the abnormal data item, and the associated assets related to the abnormal data item.

[0015] In some embodiments, the anomaly detection module is further used to compare the anomaly data item with vulnerability data in the vulnerability database; if there is no vulnerability data matching the anomaly data item in the vulnerability database, the anomaly detection module adds the anomaly data item to the vulnerability database.

[0016] In some embodiments, the intrinsic security protection system also includes a vulnerability assessment module, which is used to perform a vulnerability assessment on each asset in the industrial control system to obtain the vulnerability data corresponding to each asset and the corresponding relationship between the asset and the vulnerability data; and integrate the vulnerability data corresponding to each asset and the corresponding relationship between the asset and the vulnerability data into a vulnerability database.

[0017] In some embodiments, the assets in the industrial control system include multiple asset areas; the data acquisition module is also used to determine the regional risk level of each asset area based on the number of abnormal data items in each asset area; and based on the regional risk level of each asset area, determine the collection density and frequency of data collection for each asset area.

[0018] On the second aspect, an embodiment of the present application provides an intrinsic security protection method, comprising: obtaining target vulnerability data corresponding to the target asset from a pre-established vulnerability database, and updating the security baseline of the target asset based on the target vulnerability data, wherein the vulnerability database comprises: vulnerability data obtained by an intrinsic security protection system through a vulnerability assessment of assets in an industrial control system, and the correspondence between the assets and the vulnerability data; obtaining a test data set related to the target asset; comparing each data item in the test data set with the updated security baseline, and treating data items inconsistent with the updated security baseline as abnormal data items.

[0019] Compared with the related art, the endogenous security protection system and method provided by the embodiment of the present application, through the endogenous security protection system, the vulnerability assessment of the assets in the industrial control system is carried out, the vulnerability data is obtained, and a vulnerability database is established; then the target vulnerability data corresponding to the target asset is obtained from the vulnerability database by using the baseline adjustment module, and the security baseline of the target asset is updated based on the target vulnerability data; then the data acquisition module is used to obtain the test data set related to the target asset; finally, the abnormal detection module is used to compare each data item in the test data set with the updated security baseline, and the data items inconsistent with the updated security baseline are screened out as abnormal data items, so as to realize active defense against network security threats, and when new security vulnerabilities and other vulnerability information appear in the industrial control system, the endogenous security protection system is used to dynamically detect such vulnerability data, and the security baseline of the assets in the industrial control system is updated in time, so as to improve the accuracy of the vulnerability detection of the assets and reduce the probability of false alarms and missed protection. Through this application, the problem of low immediacy and accuracy of the vulnerability detection of industrial assets in the related art is solved, and the technical effect of improving the immediacy and accuracy of the vulnerability detection of industrial assets is achieved.

[0020] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 is a structural diagram of an intrinsic safety protection system according to an embodiment of the present application;

[0023] Figure 2 is a flow chart of establishing a vulnerability database according to an embodiment of the present application;

[0024] Figure 3 is a flow chart of an intrinsic security protection method according to an embodiment of the present application;

[0025] Figure 4 It is a structural diagram of a terminal device according to an embodiment of the present application.

[0026] Among them, the figure marks in the figure are: 1. Intrinsic security protection system; 4. Terminal device; 10. Vulnerability database; 11. Baseline adjustment module; 12. Data acquisition module; 13. Anomaly detection module; 14. Policy output module; 15. Vulnerability assessment module; 40. Processor; 41. Memory; 42. Computer program; 130. Feature extraction unit; 131. Anomaly analysis unit. DETAILED DESCRIPTION

[0027] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0028] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0029] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0030] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0031] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0032] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0033] Assets refer to resources that are formed by past transactions or events of an enterprise (or organization, unit, group, etc.), owned or controlled by the enterprise, and expected to bring economic benefits to the enterprise. They include intangible service management and tangible network hardware facilities, software, documents, firewalls, etc. With the continuous development of network technology, the industrial Internet, as a product of the deep integration of new-generation information technology and manufacturing, is entering a new stage of informatization and intelligent development. However, in this process, the cybersecurity threats faced by industrial assets in the industrial Internet are becoming increasingly severe. Attackers may exploit the inherent security issues in industrial assets to launch cyber attacks on industrial assets, causing economic losses to related groups.

[0034] Endogenous security issues can be divided into two categories. One is a narrow endogenous security issue, which refers to the fact that in addition to the expected design functions, a software and hardware system always has explicit or implicit undesirable functions including side effects, vulnerabilities, and natural failures. The other is a broad endogenous security issue, which refers to the narrow endogenous security issues and also includes hidden functions of software and hardware that are invisible to the end user or have not been explicitly stated or disclosed to the user, covering a wide range of security issues such as undesirable functions, side effects, vulnerabilities, natural failures, and hidden functions within the system. These problems often have complex causes and manifestations, and the vulnerability of industrial assets caused by endogenous security issues is difficult to be discovered by traditional security detection methods.

[0035] At present, some security organizations and operating system manufacturers regularly publish assessment results on the severity of industrial asset vulnerabilities to provide a basis for users to detect the vulnerabilities of industrial assets. However, this method cannot achieve timely discovery and effective prevention when new security vulnerabilities and vulnerability information appear in the industrial Internet, and the accuracy of vulnerability detection is also low.

[0036] Currently, no effective solution has been proposed to address the problems of low immediacy and accuracy in vulnerability detection of industrial assets in related technologies.

[0037] In view of this, the vulnerability of the assets in the industrial control system is evaluated through the endogenous security protection system to obtain vulnerability data and establish a vulnerability database; then the target vulnerability data corresponding to the target asset is obtained from the vulnerability database using the baseline adjustment module, and the security baseline of the target asset is updated based on the target vulnerability data; then the data acquisition module is used to obtain the test data set related to the target asset; finally, the anomaly detection module is used to compare each data item in the test data set with the updated security baseline, and the data items inconsistent with the updated security baseline are screened out as abnormal data items, so as to realize active defense against network security threats. When new security vulnerabilities and other vulnerability information appear in the industrial control system, the endogenous security protection system is used to dynamically detect such vulnerability data, and the security baseline of the assets in the industrial control system is updated in time, so as to improve the accuracy of the vulnerability detection of the assets and reduce the probability of false alarms and missed protection. Through this application, the problem of low immediacy and accuracy of vulnerability detection of industrial assets in the related technology is solved, and the technical effect of improving the immediacy and accuracy of vulnerability detection of industrial assets is achieved.

[0038] The following will be combined Figure 1 For an explanation of the inherent safety protection system provided by an embodiment of the present application, see Figure 1 , Figure 1 is a structural diagram of an endogenous safety protection system according to an embodiment of the present application, such as Figure 1 As shown, the intrinsic security protection system 1 includes: a vulnerability database 10, the vulnerability database 10 includes vulnerability data obtained by the intrinsic security protection system 1 through vulnerability assessment of assets in the industrial control system, and the corresponding relationship between the assets and the vulnerability data; a baseline adjustment module 11, used to obtain target vulnerability data corresponding to the target asset from the vulnerability database 10, and update the security baseline of the target asset based on the target vulnerability data; a data acquisition module 12, used to obtain a test data set related to the target asset; an anomaly detection module 13, used to compare each data item in the test data set with the updated security baseline, and treat the data items inconsistent with the updated security baseline as abnormal data items.

[0039] In this embodiment, the intrinsic security protection system 1 can be a security protection system based on the generalized intrinsic security principle, which emphasizes building a security protection mechanism from within the system to resist external threats by improving the system's self-defense, self-repair and self-perception capabilities.

[0040] Exemplarily, the intrinsic security protection system 1 may include an anomaly detection tool, which may use vulnerability scanning, penetration testing, code review, network traffic analysis and other means to perform vulnerability assessments on assets in the industrial control system and obtain vulnerability data corresponding to the assets.

[0041] In one embodiment, the vulnerability data may include security vulnerability information, system security configuration, system important status and other information.

[0042] Specifically, security vulnerability information may include security risks caused by defects in the system itself, such as software or protocols, generally including login vulnerabilities, denial of service vulnerabilities, buffer overflows, information leaks, worm backdoors, unexpected situation handling errors, etc., which reflect the security issues of the system itself; system security configuration may include fragile security configurations caused by human negligence in the system, including accounts, passwords, authorizations, logs, IP communications and other aspects, which reflect the security vulnerabilities of the system itself; important system status may include monitoring of system port status, processes, accounts and important file changes, which reflects the security status of the system's current environment.

[0043] In one embodiment, the types of security vulnerability information in the vulnerability data may include any one or more of host vulnerabilities, web vulnerabilities, weak password vulnerabilities, and configuration verification vulnerabilities, wherein host vulnerabilities may include service asset-related host vulnerabilities, software asset-related host vulnerabilities, and device asset-related host vulnerabilities, web vulnerabilities may include website asset-related web vulnerabilities, weak password vulnerabilities may include device asset-related weak password vulnerabilities, service asset-related weak password vulnerabilities, and website asset-related weak password vulnerabilities, and configuration verification vulnerabilities may include device asset-related configuration verification vulnerabilities.

[0044] In this embodiment, the intrinsic security protection system 1 may include a baseline database, which may include a security baseline corresponding to each asset in the industrial control system; after obtaining the target vulnerability data corresponding to the target asset, the baseline adjustment module 11 may update the security baseline of the asset based on the target vulnerability data, with the minimum standard of not causing damage to the network security of the target asset; or, when there is no security baseline for the target asset in the intrinsic security protection system 1, the baseline adjustment module 11 may construct a security baseline for the target asset based on the target vulnerability data, with the minimum standard of not causing damage to the network security of the target asset.

[0045] For example, if the target vulnerability data includes security vulnerability information, the baseline adjustment module 11 updates the security baseline of the target asset so that the updated security baseline determines: all data related to the target asset should not exploit vulnerabilities existing in the target asset; if the target vulnerability data includes system security configuration, the baseline adjustment module 11 updates the security baseline of the target asset so that the updated security baseline determines: with the goal of not causing network security threats to the target asset, the minimum standard system configuration information is the system security configuration required for the target asset; if the target vulnerability data includes important system status, the baseline adjustment module 11 updates the security baseline of the target asset so that the updated security baseline determines: with the goal of not causing network security threats to the target asset, the minimum standard range of each status in the system is the system status baseline required for the target asset.

[0046] In this embodiment, an endogenous security protection system 1 can be used to perform vulnerability assessment on assets, and a vulnerability database 10 can be constructed based on the assessment results. The security baseline of the target asset can be updated based on the vulnerability data corresponding to the target asset in the vulnerability database 10 through the baseline adjustment module 11. By building a security mechanism from within the system, it is possible to more comprehensively identify and assess the safety hazards in industrial assets, providing strong protection for the safe production of enterprises.

[0047] In one embodiment, the data acquisition module 12 can be configured to acquire multi-source heterogeneous data related to the target asset from the industrial control system; pre-process the multi-source heterogeneous data to generate a data set to be tested, wherein the pre-processing includes data cleaning, deduplication processing, and standardized conversion.

[0048] In this embodiment, all data related to the target assets in the industrial control system may be complex multi-source heterogeneous data. Therefore, a preprocessing process is required to clean, deduplicate and standardize these multi-source heterogeneous data to provide an input data set with a clear structure and reliable quality for the anomaly detection module 13.

[0049] Exemplarily, the data acquisition module 12 can be deployed in the industrial control system in the form of an APP, and the data acquisition APP can continuously and in real time collect multi-dimensional data related to the target assets from network traffic, system logs, process files, etc.

[0050] In this embodiment, the anomaly detection module 13 can perform an in-depth comparative analysis on the pre-processed test data set based on the updated security baseline corresponding to the target asset, and accurately identify data items that deviate from the security baseline.

[0051] Exemplarily, if a data item in the data set to be tested has the possibility of exploiting a security vulnerability of the target asset, the anomaly detection module 13 can determine that the data item is inconsistent with the updated security baseline and determine the data item as an abnormal data item; if a data item in the data set to be tested indicates system configuration information, and the system configuration information is inconsistent with the minimum system security configuration in the updated security baseline, the anomaly detection module 13 can determine that the data item is inconsistent with the security baseline and determine the data item as an abnormal data item; if a data item in the data set to be tested indicates certain status information of the system, and the status information is inconsistent with the system status baseline in the security baseline, the anomaly detection module 13 can determine that the data item is inconsistent with the updated security baseline and determine the data item as an abnormal data item.

[0052] Through the endogenous security protection system, the vulnerability of the assets in the industrial control system is evaluated to obtain vulnerability data and establish a vulnerability database 10; then the target vulnerability data corresponding to the target asset is obtained from the vulnerability database 10 by using the baseline adjustment module 11, and the security baseline of the target asset is updated based on the target vulnerability data; then the data acquisition module 12 is used to obtain the test data set related to the target asset; finally, the anomaly detection module 13 is used to compare each data item in the test data set with the updated security baseline, and the data items inconsistent with the updated security baseline are screened out as abnormal data items, so as to realize active defense against network security threats. When new security vulnerabilities and other vulnerability information appear in the industrial control system, the endogenous security protection system 1 is used to dynamically detect such vulnerability data, and the security baseline of the assets in the industrial control system is updated in time, so as to improve the accuracy of the vulnerability detection of the assets and reduce the probability of false alarms and missed protection. Through this application, the problem of low immediacy and accuracy of vulnerability detection of industrial assets in the related technology is solved, and the technical effect of improving the immediacy and accuracy of vulnerability detection of industrial assets is achieved.

[0053] In one embodiment, the anomaly detection module 13 is further used to classify the abnormal data items and add an identifier to the abnormal data items based on the classification result, wherein the identifier indicates the category of the security threat corresponding to the abnormal data item.

[0054] In this embodiment, the anomaly detection module 13 may use a Naive Bayes classification algorithm to efficiently classify abnormal data items and assign a unique identifier to each category to ensure its uniqueness.

[0055] Exemplarily, the anomaly detection module 13 may include a feature extraction unit 130, which is configured to extract features from the abnormal data items, and classify the abnormal data items using a naive Bayesian classification algorithm based on the features of the extracted abnormal data items. The calculation formula of the naive Bayesian classification algorithm is as follows:

[0056]

[0057] Among them, x1,x2,…,x n Represents the characteristics of abnormal data items, y i Indicates the category of security threat, P(y i ) indicates the preset and category y i The corresponding prior probability, P(x j |y i ) represents the preset and feature x j and category y i The corresponding class conditional probability.

[0058] In this embodiment, the identifier may also indicate the asset associated with the abnormal data item, so that when a potential safety hazard is detected, the abnormal data item can be quickly located and the industrial asset associated with the abnormal data item that poses a network security threat can be directly locked.

[0059] In this embodiment, the categories of security threats may include: configuration errors, vulnerability exploits, illegal access, data leakage, malware, network attacks, abnormal behavior, compliance violations, etc. In actual applications, the categories of security threats can be set according to the characteristics of industrial control systems, industrial assets, and the expected functions of managers, and this application does not impose any restrictions on this.

[0060] In one embodiment, the feature extraction unit 130 can be deployed in the industrial control system in the form of an APP, for example, encapsulated into a feature extraction APP for management and maintenance; and a unified interface standard can be formulated to ensure smooth data exchange and communication between modules (APPs). Integrating the encapsulated module (APP) into the system can achieve seamless docking with the existing system. This includes the integration of data flows, synchronization of authority management, and coordination of security policies.

[0061] In one embodiment, the vulnerability database 10 also includes: a correspondence between vulnerability data and risk levels; the anomaly detection module 13 includes an anomaly analysis unit 131, which is used to compare the abnormal data item with the vulnerability data in the vulnerability database 10, and determine the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item based on the comparison result.

[0062] In this embodiment, after detecting vulnerability data related to assets, the intrinsic security protection system 1 can evaluate the risk level of the security threats represented by the vulnerability data by retrieving the security threats that may be caused by the vulnerability data, or obtaining the security threats that the vulnerability data has caused to the assets, determine the scope of assets affected by the vulnerability data, and evaluate the importance of these assets in business operations and potential security risks.

[0063] The anomaly analysis unit 131 can compare the abnormal data item with the vulnerability data in the vulnerability database 10, retrieve the vulnerability data that matches or is consistent with the abnormal data item from the vulnerability database 10, and determine the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item based on the vulnerability data that matches or is consistent with the abnormal data item, thereby determining the scope of assets affected by the abnormal data item and evaluating the importance of these assets in business operations and potential security risks.

[0064] Exemplarily, risk levels may include extremely high risk level, high risk level, medium risk level, low risk level and extremely low risk level; the range of assets affected by abnormal data items may also be classified into critical business assets, non-critical but widespread assets, non-critical and limited assets, and all asset types. In actual applications, the risk level of each type of vulnerability data can be set based on the characteristics of the industrial control system, industrial assets, and the expected functions of managers, and this application does not impose any restrictions on this.

[0065] In one embodiment, the abnormality analysis unit 131 can be deployed in the industrial control system in the form of an APP, for example, packaged into a feature extraction APP for easy management and maintenance.

[0066] In one embodiment, the baseline adjustment module 11 is further used to update the security baseline of the target asset based on the target vulnerability data, the risk level corresponding to the abnormal data item, and the associated assets related to the abnormal data item.

[0067] In this embodiment, in addition to updating the security baseline of the target asset based on the target vulnerability data, the baseline adjustment module 11 can also obtain the risk level corresponding to the abnormal data item output by the anomaly detection module 13, and the associated assets related to the abnormal data item, and update the security baseline of the target asset based on the above factors.

[0068] Exemplarily, when the risk level corresponding to the abnormal data item is an extremely high risk level and the range of assets affected by the abnormal data item is critical business assets, the baseline adjustment module 11 can further improve the security standard that does not cause damage to the network security of the target assets (for example, the security baseline is updated to all data related to the target assets and critical business assets should not exploit vulnerabilities in the target assets and critical business assets; or the security baseline is updated to a system security configuration required for the target assets with the goal of not causing network security threats to the target assets and critical business assets and the minimum standard system configuration information; or the security baseline is updated to a system state baseline required for the target assets with the goal of not causing network security threats to the target assets and critical business assets and the minimum standard range of various states in the system); and when the risk level corresponding to the abnormal data item is an extremely low risk level and the range of assets affected by the abnormal data item is all asset types, the baseline adjustment module 11 can further lower the security standard that does not cause damage to the network security of the target assets.

[0069] In this way, the security baseline of assets in the industrial control system can be dynamically updated, and the security standards of assets interacting with high-risk abnormal data items can be improved in real time, or the security standards of assets interacting with lower-risk abnormal data items can be lowered. This can optimize resource utilization and improve the accuracy of vulnerability detection of industrial assets.

[0070] In one embodiment, there may be a situation where there is no vulnerability data matching the abnormal data item in the vulnerability database 10. In this case, the baseline adjustment module 11 may compare the abnormal data item with the vulnerability data in the vulnerability database 10; if there is no vulnerability data matching the abnormal data item in the vulnerability database 10, the baseline adjustment module 11 adds the abnormal data item to the vulnerability database 10.

[0071] Exemplarily, the endogenous security protection system 1 can continuously update new security vulnerabilities and vulnerability data by continuously interacting and exchanging data with the external environment. And integrate the new security vulnerabilities and vulnerability data into the vulnerability database 10, and automatically trigger the update process to optimize the security strategy. The endogenous security protection system 1 can also automatically adjust the security strategy and protection measures according to the vulnerability characteristics of the newly discovered security vulnerabilities and the impact range of the vulnerability data. At the same time, the endogenous security protection system 1 can also review and verify the vulnerability data already existing in the vulnerability database 10 to ensure the accuracy and timeliness of the information.

[0072] In one embodiment, the endogenous security protection system 1 further includes a policy output module 14 for generating a security protection policy based on the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item.

[0073] In this embodiment, the policy output module 14 can determine the risk level of the security threat represented by the abnormal data items by matching the screened abnormal data items with the vulnerability database 10 built into the endogenous security protection system 1, and can accurately define the scope of assets affected by the abnormal data items. In addition, the scope of assets that may be indirectly affected by the abnormal data items can also be determined through logical association analysis.

[0074] Then, the policy output module 14 can generate a series of targeted security protection strategies (including security strategies and protection measures) based on the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item. The security protection strategy aims to effectively reduce or eliminate the identified security risks through technical and management means, which may include enhancing security protection mechanisms, implementing data encryption measures, timely applying security patches, optimizing monitoring and early warning systems, etc. At the same time, in order to ensure the timeliness and effectiveness of emergency response, an emergency response plan can also be formulated or updated to deal with potential security incidents.

[0075] Specifically, the policy output module 14 can construct a rule engine, which can make decisions based on the risk level corresponding to the abnormal data item output by the abnormality detection module 13, the associated assets related to the abnormal data item, and the preset business rules, and independently determine whether to take countermeasures, such as isolating suspicious systems, blocking abnormal traffic, etc. By setting preset response strategies for different risk levels and different asset impact ranges, when the rule engine determines that preset measures need to be taken, the rule engine can automatically trigger the response strategy.

[0076] For example, when the risk level corresponding to the abnormal data item output by the anomaly detection module 13 is an extremely high risk level, and the range of assets affected by the abnormal data item is critical business assets, the rule engine can take response strategies such as immediately isolating the affected assets, launching the emergency response plan, and notifying the security team; when the risk level corresponding to the abnormal data item output by the anomaly detection module 13 is a high risk level, and the range of assets affected by the abnormal data item is non-critical but extensive assets, the rule engine can take response strategies such as issuing a high-risk alarm, giving priority to investigation and processing, and monitoring attack trends; when the risk level corresponding to the abnormal data item output by the anomaly detection module 13 is a medium risk level, and the range of assets affected by the abnormal data item is non-critical but extensive assets, the rule engine can take response strategies such as issuing a high-risk alarm, giving priority to investigation and processing, and monitoring attack trends; When the scope of affected assets is critical business assets, the rule engine can adopt response strategies such as strengthening monitoring, preparing emergency resources, and notifying relevant responsible persons; when the risk level corresponding to the abnormal data item output by the anomaly detection module 13 is a low risk level, and the scope of assets affected by the abnormal data item is non-critical but limited assets, the rule engine can adopt response strategies such as recording events, regular evaluations, and selectively taking defensive measures; when the risk level corresponding to the abnormal data item output by the anomaly detection module 13 is an extremely low risk level, and the scope of assets affected by the abnormal data item is all asset types, the rule engine can adopt response strategies such as monitoring trends, recording logs, and using them for subsequent analysis.

[0077] In one embodiment, the assets in the industrial control system include multiple asset areas; the data acquisition module 12 is also used to determine the regional risk level of each asset area based on the number of abnormal data items in each asset area; and based on the regional risk level of each asset area, determine the collection density and collection frequency of data for each asset area.

[0078] In this embodiment, the regional risk level may include a high regional risk level and a low regional risk level. The data acquisition module 12 may integrate the adaptive features of the endogenous safety protection system and dynamically adjust the data acquisition strategy according to the perceived environmental changes in the industrial control system. For example, the data acquisition density and frequency of asset areas with high regional risk levels may be increased, and the data acquisition density and frequency of asset areas with low regional risk levels may be reduced, so as to optimize resource utilization and improve detection efficiency.

[0079] Specifically, the data acquisition module 12 can determine that the asset area is at a high regional risk level when the number of abnormal data items in the asset area is higher than a preset threshold; when the number of abnormal data items in the asset area is lower than the preset threshold, the asset area is determined to be at a low regional risk level. In actual applications, the preset threshold can be set based on the characteristics of the industrial control system, industrial assets, and the expectations of managers, and this application does not impose any restrictions on this.

[0080] In one embodiment, the policy output module 14 may be deployed in the industrial control system in the form of an APP, for example, packaged into a policy output APP for ease of management and maintenance.

[0081] In one embodiment, the endogenous security protection system 1 further includes a vulnerability assessment module 15 for establishing a vulnerability database 10. Figure 2 is a flow chart of establishing a vulnerability database 10 according to an embodiment of the present application, such as Figure 3 As shown, in one embodiment, the vulnerability assessment module 15 establishes the vulnerability database 10 including steps S201 and S202:

[0082] Step S201 , performing vulnerability assessment on each asset in the industrial control system, obtaining vulnerability data corresponding to each asset, and a corresponding relationship between the asset and the vulnerability data.

[0083] In this embodiment, the vulnerability assessment module 15 may include active detection tools and passive monitoring tools, and identify industrial assets to be assessed in the industrial control system through active detection tools and passive monitoring tools, and establish an asset list to clarify the scope of assets that need to be protected.

[0084] Step S202 , integrating the vulnerability data corresponding to each asset and the corresponding relationship between the asset and the vulnerability data into a vulnerability database 10 .

[0085] In one embodiment, the vulnerability assessment module 15 can be deployed in the industrial control system in the form of an APP, for example, encapsulated into an asset monitoring APP for management and maintenance; the asset monitoring APP can collect data of industrial assets in real time based on the data collection APP, and build a stable asset security monitoring mechanism based on this. The asset security monitoring mechanism can directly reflect the asset status, establish a comprehensive asset monitoring list based on the operating information, log information, and abnormal information of the monitored assets, and can quickly identify and respond to potential security threats, reduce the difficulty of operation and maintenance, and ensure the safe operation of industrial assets.

[0086] In this embodiment, the above-mentioned data collection APP, feature extraction APP, abnormal data analysis APP, policy output APP and asset monitoring APP can be built into the endogenous security protection system 1, or deployed on other terminal devices. Each module (APP) is responsible for a specific task or function to facilitate management and maintenance. By formulating a unified interface standard, it is ensured that each module (APP) can exchange data and communicate smoothly. Integrating the encapsulated module (APP) into the system can achieve seamless docking with the existing system. This includes the integration of data flows, synchronization of authority management, and coordination of security policies.

[0087] Specifically, according to the characteristics of the industrial control system, industrial assets and the expected functions of managers, you can choose a suitable technology stack (such as Java, Python, C++ and other programming languages) and corresponding frameworks, libraries and tools to build an operating environment, where the operating environment is the environment for deploying and running the integrated software product.

[0088] Then, you can clarify the specific functions of the new interface or the interface that needs to be adapted, design clear and easy-to-understand interface naming rules, adopt a reasonable version control strategy to facilitate future expansion and maintenance, and design the data structure of requests and responses to ensure the validity and scalability of the data.

[0089] Subsequently, deployment testing can be performed to unit test the written integration code to ensure that it can work properly when running independently; and the integration code can be deployed to the test environment and integrated with the existing system to verify its compatibility and stability in the actual operating environment.

[0090] The endogenous security protection system 1 provided in the embodiment of the present application integrates the three major elements of "adaptation", "autonomy" and "self-growth". Among them, regarding the adaptive technology, the endogenous security protection system 1 can have a built-in intelligent detection engine, which can use deep learning, intelligent analysis and decision-making, and automated response technologies to perform real-time analysis of network traffic, log data, etc. in the industrial control system, and automatically identify potential security threats. Once a threat is discovered, the endogenous security protection system 1 can immediately trigger an early warning mechanism and automatically adjust security policies, such as isolating infected devices, blocking malicious traffic, etc., to curb the further spread of security threats. And the endogenous security protection system 1 can have the ability to self-repair according to the nature and severity of the threat. When a security threat is detected and an emergency response is triggered, the endogenous security protection system 1 can automatically execute repair measures, such as automatic patching, restoring system configuration, etc., to ensure that industrial assets can quickly return to a stable operating state and ensure that business continuity is not affected.

[0091] Regarding autonomous security technology, the endogenous security protection system 1 has a built-in anomaly detection module 13 and a vulnerability database 10, which can actively perform security monitoring, analysis and evaluation. When a potential threat is found in the assets of the industrial control system, it can independently formulate security strategies and implement corresponding protection measures without external intervention, such as adjusting access control strategies and deploying security reinforcement measures.

[0092] Regarding self-growth technology, the endogenous security protection system 1 can continuously update new security vulnerabilities and vulnerability data through continuous interaction and exchange of data with the external environment. And integrate new security vulnerabilities and vulnerability data into the vulnerability database 10, and automatically trigger the update process to optimize the security strategy. The endogenous security protection system 1 can also automatically adjust the security strategy and protection measures according to the vulnerability characteristics of the newly discovered security vulnerabilities and the impact range of the vulnerability data. At the same time, the endogenous security protection system 1 can also review and verify the vulnerability data already existing in the vulnerability database 10 to ensure the accuracy and timeliness of the information.

[0093] The endogenous security protection system 1 provided in the embodiment of the present application can realize active defense against network security threats. When new security vulnerabilities and other vulnerability information appear in the industrial control system, the endogenous security protection system 1 is used to dynamically detect such vulnerability data and timely update the security baseline of the assets in the industrial control system, thereby improving the accuracy of vulnerability detection of assets and reducing the probability of false alarms and missed protection. Through this application, the problem of low immediacy and accuracy of vulnerability detection of industrial assets in related technologies is solved, and the technical effect of improving the immediacy and accuracy of vulnerability detection of industrial assets is achieved.

[0094] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated in one processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit, and the above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.

[0095] Corresponding to the endogenous safety protection system described in the above embodiment, Figure 3 A flow chart of an intrinsic security protection method according to an embodiment of the present application is shown. For ease of explanation, only the part related to the embodiment of the present application is shown.

[0096] See also Figure 3 , the intrinsic security protection method includes:

[0097] Step S301, obtaining target vulnerability data corresponding to the target asset from a pre-established vulnerability database, and updating the security baseline of the target asset based on the target vulnerability data, wherein the vulnerability database includes: vulnerability data obtained by an endogenous security protection system performing a vulnerability assessment on assets in the industrial control system, and the corresponding relationship between the assets and the vulnerability data.

[0098] Step S302: Acquire a data set to be tested related to the target asset.

[0099] Step S303: Compare each data item in the test data set with the updated security baseline, and regard the data items inconsistent with the updated security baseline as abnormal data items.

[0100] It should be understood that the order of execution of the steps in the above embodiments does not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The specific content of each of the above steps can refer to the corresponding modules in the above system embodiments, and will not be repeated here.

[0101] Figure 4 is a schematic diagram of the structure of a terminal device according to an embodiment of the present application. Figure 4 As shown, the terminal device 4 includes: at least one processor 40 ( Figure 4 Only one is shown in the figure (a processor), a memory 41, and a computer program 42 stored in the memory 41 and executable on at least one processor 40. When the processor 40 executes the computer program 42, the steps in any of the above-mentioned embodiments of the intrinsic security protection method are implemented.

[0102] The terminal device 4 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device 4 may include but is not limited to a processor 40 and a memory 41. It is understood by those skilled in the art that Figure 4 It is only an example of the terminal device 4 and does not constitute a limitation on the terminal device 4. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0103] The processor 40 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0104] In some embodiments, the memory 41 may be an internal storage unit of the terminal device 4, such as a hard disk or memory of the terminal device 4. In other embodiments, the memory 41 may also be an external storage device of the terminal device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 4. In other embodiments, the memory 41 may also include both an internal storage unit and an external storage device of the terminal device 4. The memory 41 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program 42. The memory 41 may also be used to temporarily store data that has been output or is to be output.

[0105] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it can implement the steps in the above-mentioned embodiment of the intrinsic security protection method.

[0106] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned embodiments of the intrinsic security protection method when executing the computer program product.

[0107] The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0108] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0109] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0110] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0112] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An endogenous safety protection system, characterized in that: The endogenous safety protection system comprises: A vulnerability database, the vulnerability database including vulnerability data obtained by the intrinsic security protection system performing vulnerability assessment on assets in the industrial control system, and a corresponding relationship between the assets and the vulnerability data; A baseline adjustment module, used to obtain target vulnerability data corresponding to the target asset from the vulnerability database, and update the security baseline of the target asset based on the target vulnerability data; A data acquisition module, used to obtain a data set to be tested related to the target asset; The anomaly detection module is used to compare each data item in the test data set with the updated security baseline, and to regard the data items inconsistent with the updated security baseline as abnormal data items.

2. The endogenous safety protection system according to claim 1, characterized in that: The anomaly detection module is further configured to classify the abnormal data item and add an identifier to the abnormal data item based on the classification result, wherein the identifier indicates a category of security threat corresponding to the abnormal data item.

3. The endogenous safety protection system according to claim 2, characterized in that: The anomaly detection module includes a feature extraction unit, which is used to extract features from the abnormal data items, and classify the abnormal data items using a naive Bayesian classification algorithm based on the extracted features of the abnormal data items. The calculation formula of the naive Bayesian classification algorithm is as follows: Among them, x1,x2,…,x n Represents the characteristics of the abnormal data item, y i Indicates the category of security threat, P(y i ) indicates the preset and category y i The corresponding prior probability, P(x j |y i ) represents the preset and feature x j and category y i The corresponding class conditional probability.

4. The endogenous safety protection system according to any one of claims 1 to 3, characterized in that: The vulnerability database also includes: a correspondence between vulnerability data and risk levels; the anomaly detection module includes an anomaly analysis unit, which is used to compare the abnormal data item with the vulnerability data in the vulnerability database, and determine the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item based on the comparison result.

5. The endogenous safety protection system according to claim 4, characterized in that: The endogenous security protection system also includes a policy output module for generating a security protection policy based on the risk level corresponding to the abnormal data item and the associated assets related to the abnormal data item.

6. The endogenous safety protection system according to claim 4, characterized in that: The baseline adjustment module is further used to update the security baseline of the target asset based on the target vulnerability data, the risk level corresponding to the abnormal data item, and the associated assets related to the abnormal data item.

7. The intrinsic safety protection system according to any one of claims 1 to 3, characterized in that: The anomaly detection module is further used to compare the anomaly data item with the vulnerability data in the vulnerability database; if there is no vulnerability data matching the anomaly data item in the vulnerability database, the anomaly detection module adds the anomaly data item to the vulnerability database.

8. The intrinsic safety protection system according to any one of claims 1 to 3, characterized in that: The endogenous security protection system further includes a vulnerability assessment module, which is used to perform a vulnerability assessment on each asset in the industrial control system to obtain vulnerability data corresponding to each asset and a corresponding relationship between the asset and the vulnerability data; And the vulnerability data corresponding to each asset and the corresponding relationship between the assets and the vulnerability data are integrated into the vulnerability database.

9. The intrinsic safety protection system according to any one of claims 1 to 3, characterized in that: The assets in the industrial control system include multiple asset areas; the data acquisition module is also used to determine the regional risk level of each asset area based on the number of abnormal data items in each asset area; And based on the regional risk level of each asset area, determine the collection density and frequency of data collection for each asset area.

10. An endogenous safety protection method, characterized in that: The method comprises: Obtaining target vulnerability data corresponding to the target asset from a pre-established vulnerability database, and updating the security baseline of the target asset based on the target vulnerability data, wherein the vulnerability database includes: vulnerability data obtained by the intrinsic security protection system performing vulnerability assessment on the assets in the industrial control system, and the corresponding relationship between the assets and the vulnerability data; Acquire a data set to be tested related to the target asset; Each data item in the test data set is compared with the updated security baseline, and data items inconsistent with the updated security baseline are regarded as abnormal data items.

Images