Security vulnerability association analysis method, device, equipment and program product

Abstract

The invention provides a security vulnerability association analysis method and device, equipment and a program product, and belongs to the field of industrial internet. The method comprises the following steps: acquiring attribute information of each physical node in a plurality of physical nodes of the industrial internet; determining vulnerability combination information based on the attribute information of each physical node, a network topological graph of the industrial internet and a plurality of vulnerability prediction models; wherein each vulnerability prediction model corresponds to one vulnerability element, and the vulnerability elements comprise security vulnerabilities or defense mechanisms of the security vulnerabilities; each vulnerability prediction model is used for predicting whether the plurality of physical nodes have a corresponding vulnerability element according to the attribute information of the plurality of physical nodes; the vulnerability combination information is used for combining and representing vulnerability elements in a plurality of physical nodes; and performing association analysis based on the vulnerability combination information, and determining an attack path in the industrial internet. The method is suitable for an industrial internet security protection process, and is used for solving the problem of low vulnerability analysis prediction accuracy.

Description

Technical Field

[0001] The present application relates to the field of industrial Internet, and in particular to a security vulnerability correlation analysis method, device, equipment and program product. Background Art

[0002] An industrial control network is a network system that is used in industrial environments. An industrial control network can include multiple industrial devices.

[0003] There may be some vulnerabilities in industrial equipment, which may cause industrial equipment to be attacked, resulting in production line interruptions and affecting the normal production progress of the enterprise. In addition, industrial equipment may also store sensitive data, and vulnerabilities in industrial equipment may also cause the leakage of sensitive data. Therefore, related technologies provide some solutions for analyzing and predicting vulnerabilities in industrial control networks.

[0004] However, with the development of industrial control networks towards the Industrial Internet and the continued advancement of 5G fully connected factories, the solutions for analyzing and predicting vulnerabilities provided by related technologies have low accuracy when applied in the Industrial Internet. Summary of the invention

[0005] The present application provides a security vulnerability correlation analysis method, device, equipment and program product, which are used to solve the problem of low accuracy of vulnerability analysis and prediction solutions provided by related technologies when applied in the industrial Internet.

[0006] In a first aspect, the present application provides a security vulnerability association analysis method, the method comprising: obtaining attribute information of each physical node among multiple physical nodes of the industrial Internet; determining vulnerability combination information based on the attribute information of each physical node, the network topology diagram of the industrial Internet, and multiple vulnerability prediction models; wherein each vulnerability prediction model corresponds to a vulnerability element, and the vulnerability element includes a security vulnerability or a defense mechanism for a security vulnerability; each vulnerability prediction model is used to predict whether multiple physical nodes have a corresponding vulnerability element based on the attribute information of multiple physical nodes; the vulnerability combination information is used to combine and represent the vulnerability elements in multiple physical nodes; and performing association analysis based on the vulnerability combination information to determine the attack path in the industrial Internet.

[0007] It should be understood that the solutions provided by related technologies for analyzing and predicting vulnerabilities in industrial control networks basically take multiple vulnerabilities of the same device as the research object, and study the correlation, hazards and defense measures between multiple vulnerabilities. In the 5G fully connected scenario of the Industrial Internet, the number of paths for industrial equipment to connect to the outside world increases, and security vulnerabilities in different industrial equipment (or physical nodes) may be combined and exploited. Therefore, the vulnerability analysis and prediction solutions proposed for traditional relatively closed industrial control networks cannot cope with the situation of combined exploitation of security vulnerabilities in different physical nodes, resulting in a low accuracy rate of vulnerability analysis and prediction solutions when applied to the Industrial Internet.

[0008] The security vulnerability association analysis method provided in this application can determine the vulnerability combination information based on the attribute information of each physical node in multiple physical nodes of the industrial Internet, the network topology diagram of the industrial Internet, and multiple vulnerability prediction models, and then perform association analysis based on the vulnerability combination information to determine the attack path in the industrial Internet. Because the vulnerability combination information is used to combine and represent the vulnerability elements in multiple physical nodes, the attack path obtained after the association analysis based on the vulnerability combination information satisfies the vulnerability combination attack mode in the 5G full connection scenario of the industrial Internet, so that it can cope with the situation of combined use of security vulnerabilities in different physical nodes, and can improve the accuracy of the vulnerability analysis prediction scheme when applied in the industrial Internet.

[0009] Optionally, association analysis is performed based on vulnerability combination information to determine the attack path in the industrial Internet, including: performing association analysis based on vulnerability combination information to generate an association rule knowledge base; the association rule knowledge base includes multiple association rules, and each association rule is used to represent the association relationship between at least two vulnerability elements; based on the association rule knowledge base and the network topology diagram of the industrial Internet, a heterogeneous graph of the industrial Internet is generated; the heterogeneous graph includes physical nodes, vulnerability elements, connection relationships between different physical nodes, influence relationships between vulnerability elements and physical nodes, and association relationships between different vulnerability elements; the heterogeneous graph is analyzed to determine the attack path.

[0010] Optionally, association analysis is performed based on the vulnerability combination information to generate an association rule knowledge base, including: calculating the conditional probability between any two vulnerability elements based on the vulnerability combination information; if the conditional probability between the two vulnerability elements is higher than a probability threshold, the two vulnerability elements are associated, an association rule is established, and an association rule knowledge base is obtained.

[0011] Optionally, association analysis is performed based on vulnerability combination information to generate an association rule knowledge base, including: forming multiple candidate item sets based on the vulnerability combination information, and selecting item sets with support greater than a support threshold from the multiple candidate item sets to obtain multiple frequent item sets; a candidate item set is an item set including a vulnerability element; executing a candidate item set merging step: combining a frequent item set with N frequent item sets to obtain at least one N+1 candidate item set; N is an integer starting from 1 and adding 1 after each candidate item set selection step is executed; the N+1 candidate item set is an item set including N+1 vulnerability elements; executing a candidate item set selection step: selecting an item set with support greater than a support threshold from at least one N+1 candidate item set to obtain an N+1 frequent item set; repeatedly executing the candidate item set merging step and the candidate item set selection step until an iteration stop condition is met; establishing association rules based on the frequent item sets obtained when the iteration stop condition is met and before the iteration stop condition is met, to obtain an association rule knowledge base.

[0012] Optionally, based on the frequent item sets obtained when the iteration stop condition is met and before the iteration stop condition is met, association rules are established to obtain an association rule knowledge base, including: associating each frequent item set obtained when the iteration stop condition is met and before the iteration stop condition is met, to establish multiple candidate association rules; selecting candidate association rules with confidence greater than or equal to a confidence threshold from the multiple candidate association rules to obtain an association rule knowledge base; the confidence is determined based on the conditional probability between the vulnerability elements in the candidate association rules.

[0013] Optionally, the method further includes: selecting candidate association rules with a lift higher than or equal to the lift threshold from candidate association rules with a confidence lower than a confidence threshold, and adding the candidate association rules to the association rule knowledge base; wherein the lift is determined based on the quotient of the lift of the candidate association rule and a first numerical value; and the first numerical value is determined based on the product of the support of the vulnerability elements constituting the candidate association rule.

[0014] Optionally, analyzing the heterogeneous graph to determine the attack path includes: generating multiple meta-path patterns based on an association rule knowledge base; and sampling the heterogeneous graph using the multiple meta-path patterns to obtain the meta-path as the attack path.

[0015] Optionally, based on an association rule knowledge base, multiple meta-path patterns are generated, including: based on the association rules in the association rule knowledge base, completing potential vulnerability elements in the vulnerability combination information to obtain completed vulnerability combination information; the potential vulnerability elements are vulnerability elements that do not exist in the vulnerability combination information determined based on the association rules in the association rule knowledge base; based on the completed vulnerability combination information, the association rule knowledge base is updated to obtain an updated association rule knowledge base; the association rules in the updated association rule knowledge base are arranged, combined and spliced ​​to obtain multiple meta-path patterns.

[0016] Optionally, the attribute information includes: node name, node number, communication protocol, device type and software version.

[0017] Optionally, based on the attribute information of each physical node, the topological map of the industrial Internet, and multiple vulnerability prediction models, vulnerability combination information is determined, including: extracting the feature vector of all attribute information of each physical node, and splicing the feature vectors of different attribute information of each physical node to obtain the initial feature vector corresponding to each physical node; splicing the initial feature vectors corresponding to each physical node to obtain a feature matrix; based on the feature matrix, the topological map of the industrial Internet, and multiple vulnerability prediction models, determining multiple predicted vulnerability labels corresponding to each vulnerability prediction model; the vulnerability prediction label is used to indicate whether a corresponding vulnerability element exists in multiple physical nodes predicted by the corresponding vulnerability prediction model; and splicing multiple predicted vulnerability labels to obtain vulnerability combination information.

[0018] Optionally, any first vulnerability prediction model among multiple vulnerability prediction models is trained in the following manner: obtaining a training sample set; the training sample set includes multiple training samples and a first label corresponding to each training sample, each training sample includes a network topology diagram of a training industrial Internet, and attribute information of each training physical node in a plurality of training physical nodes in the training industrial Internet; the first label is used to combine and indicate whether the plurality of training physical nodes in the corresponding training sample include a first vulnerability element corresponding to the first vulnerability prediction model; training a preset graph neural network based on the training sample set to obtain a first vulnerability prediction model.

[0019] Optionally, a preset graph neural network is trained based on a training sample set to obtain a first vulnerability prediction model, including: extracting a training feature matrix based on the attribute information of the training sample; the training feature matrix includes a feature vector of each training physical node; using the graph neural network to weightedly aggregate the feature vectors of each training physical node in the training sample and all the training physical nodes connected to it in turn to obtain an aggregated feature vector corresponding to each training physical node; inputting the aggregated feature vector corresponding to each training physical node in turn into a classifier module of the graph neural network to obtain a first prediction label output by the classifier module; the first prediction label is used to combine and represent whether multiple training physical nodes in the corresponding training sample predicted by the graph neural network include a first vulnerability element; based on the first prediction label output by the classifier module and the first label corresponding to each training sample, the parameters of the graph neural network are optimized through a cross entropy loss function until the training stop condition is reached to obtain a first vulnerability prediction model.

[0020] Optionally, based on the first predicted label output by the classifier module and the first label corresponding to each training sample, the parameters of the graph neural network are optimized through a cross entropy loss function, including: using the cross entropy loss function to calculate the cross entropy loss value between the first label and the first predicted label; based on the cross entropy loss value, using a back propagation algorithm to calculate the gradient of the cross entropy loss value to the target parameter in the graph neural network; and using a preset optimization algorithm to update the target parameter according to the gradient.

[0021] In a second aspect, the present application provides a security vulnerability association analysis device, which includes various functional modules used in the method described in the first aspect above.

[0022] In a third aspect, the present application provides a computer program product, including: computer instructions; when the computer instructions are executed on an electronic device, the electronic device implements the method described in the first aspect above.

[0023] In a fourth aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method described in the first aspect above.

[0024] In a fifth aspect, the present application provides a readable storage medium, which includes: software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method described in the first aspect above.

[0025] The beneficial effects of the second to fifth aspects mentioned above can be referred to the first aspect and will not be elaborated on again. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 A schematic diagram of the composition of a security vulnerability correlation analysis system provided in an embodiment of the present application;

[0028] Figure 2 A schematic diagram of a process for analyzing security vulnerabilities provided in an embodiment of the present application;

[0029] Figure 3 A schematic diagram of attack path analysis provided in an embodiment of the present application;

[0030] Figure 4 A schematic diagram of feature matrix splicing provided in an embodiment of the present application;

[0031] Figure 5 A heterogeneous graph provided in an embodiment of the present application;

[0032] Figure 6 A schematic diagram of the composition of a security vulnerability correlation analysis device provided in an embodiment of the present application;

[0033] Figure 7 A schematic diagram of the composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0035] It should be noted that, in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0036] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0037] An industrial control network is a network system that is used in industrial environments. An industrial control network can include multiple industrial devices. Each industrial device can also be considered a physical node in the industrial control network.

[0038] There may be some vulnerabilities in industrial equipment, which may cause industrial equipment to be attacked, resulting in production line interruptions and affecting the normal production progress of the enterprise. In addition, industrial equipment may also store sensitive data, and vulnerabilities in industrial equipment may also cause the leakage of sensitive data. Therefore, related technologies provide some solutions for analyzing and predicting vulnerabilities.

[0039] However, with the development of industrial control networks towards the Industrial Internet and the continued advancement of 5G fully connected factories, the solutions for analyzing and predicting vulnerabilities provided by related technologies have low accuracy when applied in the Industrial Internet.

[0040] Based on this, the embodiments of the present application provide a security vulnerability correlation analysis method, device, equipment and program product, which can perform correlation analysis on security vulnerabilities between multiple physical nodes in the Industrial Internet, and obtain attack paths in the Industrial Internet, so as to better adapt to the situation where the number of external connection paths of industrial equipment in the Industrial Internet scenario increases, thereby improving the accuracy of vulnerability analysis and prediction solutions.

[0041] The following is an introduction with reference to the accompanying drawings.

[0042] Figure 1 This is a schematic diagram of the composition of the security vulnerability association analysis system provided in the embodiment of the present application. Figure 1 As shown, the security vulnerability association analysis system includes: an industrial Internet 100 and a security vulnerability association analysis device 200.

[0043] The industrial Internet 100 may include multiple physical nodes. The physical nodes may be various industrial devices in the industrial Internet 100. For example, sensors (temperature sensors, humidity sensors or other sensors, etc.), cameras, global positioning system (GPS) locators, gateways, programmable logic controllers (PLC) devices or distributed control systems (DCS) devices, etc. The embodiments of the present application do not limit the specific form of the physical nodes in the industrial Internet 100.

[0044] Multiple physical nodes in the industrial Internet 100 can be used to send their own attribute information to the security vulnerability association analysis device 200.

[0045] The security vulnerability correlation analysis device 200 may be an electronic device with computing and processing functions, such as a server or a computer.

[0046] Among them, the server can be a single server, or it can be a server cluster composed of multiple servers. In some implementations, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, for example, the cloud platform can include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, and a multi-cloud, etc., or any combination thereof. The embodiments of the present application are not limited to this.

[0047] The security vulnerability association analysis device 200 can be used to obtain the attribute information of each physical node in the multiple physical nodes of the industrial Internet 100, and determine the attack path in the industrial Internet 100 based on the attribute information. The specific process can be referred to the security vulnerability association analysis method provided in the following embodiment, and will not be repeated here.

[0048] It should be noted that the above Figure 1 The industrial Internet 100 and the security vulnerability association analysis device 200 are introduced as independent devices. Optionally, the security vulnerability association analysis device 200 can also be a physical node or gateway device with a security vulnerability association analysis device in the industrial Internet 100. This embodiment of the application is not limited to this.

[0049] The execution subject of the security vulnerability association analysis method provided in the embodiment of the present application is a security vulnerability association analysis device (such as the above-mentioned security vulnerability association analysis device 200). As described above, the security vulnerability association analysis device can be an electronic device with computing and processing functions such as a server or a computer. Optionally, the security vulnerability association analysis device can also be an application (application, APP) with a security vulnerability association analysis function installed in the aforementioned electronic device; or, the security vulnerability association analysis device can also be a processor in the aforementioned electronic device (such as a central processing unit (CPU)); or, the security vulnerability association analysis device can also be a software system or platform deployed in the aforementioned electronic device; or, the security vulnerability association analysis device can also be a functional module in the aforementioned electronic device for executing the security vulnerability association analysis method, etc. The embodiment of the present application does not limit this.

[0050] For the sake of simplicity, the following will take the execution subject of the security vulnerability association analysis method provided in the embodiment of the present application as a security vulnerability association analysis device as an example for introduction.

[0051] Figure 2 The following is a flow chart of the security vulnerability correlation analysis method provided in the embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0052] S101. Obtain attribute information of each physical node among multiple physical nodes of the industrial Internet.

[0053] The attribute information may include: node name, node number, communication protocol, device type, and software version.

[0054] For example, as described above, multiple physical nodes in the industrial Internet (industrial Internet 100) can send their own attribute information to the security vulnerability association analysis device (security vulnerability association analysis device 200). In this case, the security vulnerability association analysis device can directly obtain the attribute information of each physical node.

[0055] S102: Determine vulnerability combination information based on the attribute information of each physical node, the network topology map of the industrial Internet, and multiple vulnerability prediction models.

[0056] Among them, each vulnerability prediction model corresponds to a vulnerability element, and the vulnerability element includes a security vulnerability or a defense mechanism for a security vulnerability. Each vulnerability prediction model is used to predict whether a plurality of physical nodes have a corresponding vulnerability element based on the attribute information of the plurality of physical nodes. The specific training process of the vulnerability prediction model can refer to the following embodiment, which will not be repeated here. The vulnerability combination information is used to combine and represent the vulnerability elements in the plurality of physical nodes.

[0057] As an example, the vulnerability combination information can be specifically implemented as a vulnerability combination label. The vulnerability combination label may include M rows and N columns of elements, where M and N are both positive integers, M is the number of multiple physical nodes, and N is the vulnerability prediction model or the number of vulnerability elements to be predicted. The N elements in each row of the vulnerability combination label can be used to indicate the existence of N vulnerability elements of a physical node, and the M elements in each column of the vulnerability combination label can be used to indicate whether the M physical nodes have the vulnerability elements corresponding to the column.

[0058] S103. Perform correlation analysis based on vulnerability combination information to determine the attack path in the Industrial Internet.

[0059] Among them, the attack path may include multiple nodes, and the multiple nodes in the attack path may include physical nodes and security vulnerability nodes. The security vulnerability nodes may be the above-mentioned security vulnerabilities or defense mechanisms of security vulnerabilities.

[0060] As an example, the security vulnerability association analysis device can generate an association rule knowledge base based on the vulnerability combination information, and generate multiple meta-path patterns based on the association rule database, and then use the multiple meta-path patterns for sampling to obtain the meta-path as the attack path. The specific process can be referred to in the following embodiment, which will not be repeated here.

[0061] For example, Figure 3 This is a schematic diagram of the attack path analysis provided in the embodiment of the present application. Figure 3 As shown, Figure 3 FIG. 1 shows a specific example of the attack path determined by the above S103 analysis. In this attack path, the attacker can first use the vulnerability A in the physical node N1 that is accessible or contactable to the outsider to bypass the node's self-defense mechanism and unauthorizedly access the more core physical node N2. Then, the attacker can use the vulnerability B carried by the physical node N2 to continue to invade and unauthorizedly access other physical nodes. Figure 1 In the figure, physical nodes N3, physical nodes N4 and physical nodes N5 are used as examples to form a penetration attack chain, and finally the security vulnerabilities carried by the physical nodes at the end of the penetration attack chain are exploited to put the industrial equipment in the real scene corresponding to the physical node in a certain state of being attacked.

[0062] It should be understood that the solutions provided by related technologies for analyzing and predicting vulnerabilities in industrial control networks basically take multiple vulnerabilities of the same device as the research object, and study the correlation, hazards and defense measures between multiple vulnerabilities. In the 5G fully connected scenario of the Industrial Internet, the number of paths for industrial equipment to connect to the outside world increases, and security vulnerabilities in different industrial equipment (or physical nodes) may be combined and exploited. Therefore, the vulnerability analysis and prediction solutions proposed for traditional relatively closed industrial control networks cannot cope with the situation of combined exploitation of security vulnerabilities in different physical nodes, resulting in a low accuracy rate of vulnerability analysis and prediction solutions when applied to the Industrial Internet.

[0063] The security vulnerability association analysis method provided in the embodiment of the present application can determine the vulnerability combination information based on the attribute information of each physical node in multiple physical nodes of the industrial Internet, the network topology diagram of the industrial Internet, and multiple vulnerability prediction models, and then perform association analysis based on the vulnerability combination information to determine the attack path in the industrial Internet. Because the vulnerability combination information is used to combine and represent the vulnerability elements in multiple physical nodes, the attack path obtained after the association analysis based on the vulnerability combination information satisfies the vulnerability combination attack mode in the 5G full connection scenario of the industrial Internet, so that it can cope with the situation of combined use of security vulnerabilities in different physical nodes, and can improve the accuracy of the vulnerability analysis prediction scheme when applied in the industrial Internet.

[0064] The above-mentioned S102 is introduced below.

[0065] In some possible embodiments, as described above, the attribute information may include multiple types, so the security vulnerability association analysis device may extract features of multiple types of attribute information respectively, and then combine the multiple features and input them into the vulnerability prediction model. In this case, the above S102 may specifically include the following steps:

[0066] Step 1a: extract the feature vectors of all attribute information of each physical node, and concatenate the feature vectors of different attribute information of each physical node to obtain the initial feature vector corresponding to each physical node.

[0067] Optionally, the security vulnerability association analysis device can use a pre-trained model corresponding to each data type (such as a word embedding model or an encoder) to convert each attribute information into a vector representation to obtain a feature vector.

[0068] For example, taking the example that the attribute information specifically includes a string (Str) data type and an integer (Int) type, the security vulnerability association analysis device can input the attribute information of the string data type into the encoder of the string data type, and input the attribute information of the integer data type into the encoder of the integer data type.

[0069] For example, assuming that the feature vector of the kth attribute information of the physical node vi after embedding is Then the physical node v i The concatenation of feature vectors of different attribute information can be specifically expressed as the following formula:

[0070]

[0071] In formula (1), Represents the physical node v i The corresponding initial eigenvector. || represents the concatenation operation of vectors.

[0072] Step 2a: Concatenate the initial feature vectors corresponding to each physical node to obtain a feature matrix.

[0073] For example, Figure 4 This is a schematic diagram of the feature matrix splicing provided in the embodiment of the present application. Figure 4 As shown, taking the industrial Internet including seven physical nodes, each physical node including six types of attribute information, and the six types of attribute information of each physical node (on average) divided into two data types as an example, the security vulnerability association analysis device can use the encoders corresponding to the two data types ( Figure 4 The attribute information is encoded using encoder 1 and encoder 2 as examples.

[0074] Encoder 1 can encode the feature vectors corresponding to the three attribute information of the seven physical nodes ( Figure 4 In the figure, seven rows and three columns of feature vectors are used as an example, where each row represents a feature vector corresponding to three attribute information of a physical node, and each column represents a feature vector corresponding to one attribute information of seven physical nodes). Encoder 2 can encode feature vectors corresponding to the other three attribute information of each of the seven physical nodes (for specific instructions, please refer to the feature vectors encoded by encoder 1 above, which will not be repeated here).

[0075] The security vulnerability association analysis device can concatenate the feature vectors encoded by encoder 1 and encoder 2 to finally obtain a feature matrix X. Each row element of the feature matrix X can represent the initial feature vector of a physical node ( Figure 4 The first row of the feature matrix X represents the initial feature vector of node N1. as an example).

[0076] Step 3a: Based on the feature matrix, the topology map of the industrial Internet, and multiple vulnerability prediction models, determine multiple predicted vulnerability labels corresponding to each vulnerability prediction model.

[0077] Among them, the vulnerability prediction label is used to indicate whether a corresponding vulnerability element exists in multiple physical nodes predicted by the corresponding vulnerability prediction model.

[0078] Step 4a: Concatenate multiple predicted vulnerability labels to obtain vulnerability combination information.

[0079] The vulnerability combination information may also be understood as a vulnerability combination label. The vulnerability combination label may be specifically described in S102 above, which will not be described in detail here.

[0080] The above-mentioned S103 is introduced below.

[0081] In some possible embodiments, the security vulnerability association analysis device may generate an association rule knowledge base based on the vulnerability combination information, and then determine the attack path based on the association rule knowledge base. In this case, the above S103 may specifically include the following steps:

[0082] Step 1b: Perform association analysis based on vulnerability combination information and generate an association rule knowledge base.

[0083] The association rule knowledge base includes multiple association rules, and each association rule is used to represent the association relationship between at least two vulnerability elements.

[0084] In a possible implementation, the security vulnerability association analysis device can perform an association analysis on the vulnerability combination information based on conditional probability. In this case, the above step 1b can specifically include the following steps:

[0085] Step 1.1b: Based on the vulnerability combination information, calculate the conditional probability between any two vulnerability elements.

[0086] For example, taking any two vulnerability elements as vulnerability A and vulnerability D as an example, the conditional probability between vulnerability A and vulnerability D can be calculated according to the following formula:

[0087]

[0088] In formula (2), P(D|A) represents the probability of vulnerability D under the condition of vulnerability A. P(A∩D) represents the probability of vulnerability A and vulnerability D existing at the same time. P(A) represents the probability of vulnerability A existing.

[0089]

[0090] Step 1.2b: If the conditional probability between two vulnerability elements is higher than the probability threshold, the two vulnerability elements are associated, an association rule is established, and an association rule knowledge base is obtained.

[0091] The probability threshold may be preset in the security vulnerability association analysis device. For example, the probability threshold may be set to 70%, 75%, 80%, 85%, or 90%, etc. The embodiment of the present application does not limit the specific value of the probability threshold.

[0092] Optionally, if the conditional probability between two vulnerability elements is less than a probability threshold, the security vulnerability association analysis device may not associate the two vulnerability elements to establish an association rule.

[0093] It should be noted that if the conditional probability between two vulnerability elements is equal to the probability threshold, the security vulnerability association analysis device may associate the two vulnerability elements to establish an association rule, or may not associate the two vulnerability elements to establish an association rule. This embodiment of the application does not limit this.

[0094] Optionally, when a new physical node appears in the network topology diagram, or some vulnerabilities of the physical node are confirmed by mining, the security vulnerability association analysis device can predict and complete potential vulnerability elements through the association analysis task and the rules in the association rule knowledge base.

[0095] For example, if a new node N7 is found to have vulnerability A, the possible vulnerability D of N7 can be predicted through the association rule vulnerability A-vulnerability D in the association rule knowledge base.

[0096] Optionally, in the Industrial Internet, when some physical nodes have defense mechanisms against a certain type of vulnerability, preset rules can be set to determine the interception success rate of the defense mechanism.

[0097] For example, if defense mechanism α can successfully defend against vulnerability D, then when supplementing the vulnerability label of node N7, even if a strong correlation is inferred between vulnerability A and vulnerability D based on the association rule, due to the existence of defense mechanism α, node N7 only supplements the label of vulnerability A, and vulnerability D can be regarded as having been successfully intercepted by defense mechanism α.

[0098] In another possible implementation, the security vulnerability association analysis device may perform support-based association analysis on the vulnerability combination information. In this case, the above step 1b may specifically include the following steps:

[0099] Step 1.3b: Combine the vulnerability information into multiple candidate item sets, and select item sets with support greater than a support threshold from the multiple candidate item sets to obtain multiple frequent item sets.

[0100] Among them, a candidate item set is an item set including a vulnerability element. The support threshold can be preset in the security vulnerability association analysis device. For example, the support threshold can be set to 30%, 35%, 40%, 45%, or 50%. The embodiment of the present application does not limit the specific value of the support threshold.

[0101] Step 1.4b, perform the candidate item set merging step: combine a frequent item set with N frequent item sets to obtain at least one N+1 candidate item set.

[0102] Among them, N is an integer that is incremented by 1 each time the candidate item set selection step is executed starting from 1, and the N+1 candidate item set is an item set including N+1 vulnerability elements.

[0103] Step 1.5b, execute the candidate item set selection step: select the item set whose support is greater than the support threshold from at least one N+1 candidate item set to obtain N+1 frequent item sets;

[0104] For example, taking a binomial candidate item set [A, B], and the binomial candidate item set indicates that when a physical node has vulnerability A, there is also vulnerability B, the support of the binomial candidate item set can be calculated according to the following formula:

[0105]

[0106] In formula (5), P(A∩B) represents the support of the two-item candidate set [A, B]. For details, please refer to the introduction of formula (4) above.

[0107] Optionally, for a candidate item set whose support is less than a support threshold, the security vulnerability association analysis device may prune the candidate item set.

[0108] Step 1.6b: Repeat the candidate item set merging step and the candidate item set selecting step until the iteration stopping condition is met.

[0109] Optionally, the iteration stopping condition may include: the number of times the security vulnerability association analysis device executes the candidate item set merging step and / or executes the candidate item set selection step reaches a number threshold; or, the value iteration of N reaches a maximum threshold; or, when executing the candidate item set selection step, all candidate item sets are not frequent item sets.

[0110] Step 1.7b: Based on the frequent item sets obtained when and before the iteration stopping condition is met, association rules are established to obtain an association rule knowledge base.

[0111] For example, the security vulnerability association analysis device can combine each of the multiple one-item frequent itemsets with another one-item frequent itemset to obtain multiple two-item candidate itemsets (including itemsets of two vulnerability elements), and then select itemsets whose support is greater than a support threshold from the multiple two-item candidate itemsets to obtain multiple two-item frequent itemsets, and then combine each of the multiple one-item frequent itemsets with the two-item frequent itemsets to obtain multiple three-item candidate itemsets, and then select itemsets whose support is greater than a support threshold from the multiple three-item candidate itemsets to obtain multiple three-item frequent itemsets, and so on, until the iteration stop condition is met.

[0112] Optionally, the security vulnerability association analysis device may establish an association rule knowledge base based on the confidence of the association rule. In this case, the above step 1.7b may specifically include the following steps:

[0113] Step 1.71b: associate each frequent item set obtained when the iteration stopping condition is met and before the iteration stopping condition is met, and establish multiple candidate association rules.

[0114] For example, taking the above two frequent item sets [A, B] as an example, the two frequent item sets [A, B] are associated, and the candidate association rule obtained is: when vulnerability A exists in the physical node, vulnerability B also exists.

[0115] Step 1.72b: Select candidate association rules whose confidence is higher than or equal to the confidence threshold from multiple candidate association rules to obtain an association rule knowledge base.

[0116] Among them, the confidence is determined based on the conditional probability between the vulnerability elements in the candidate association rules.

[0117] For example, taking the candidate association rule: if a physical node has vulnerability A, vulnerability B also exists as an example, the confidence of the candidate association rule can be calculated according to the following formula:

[0118]

[0119] In formula (6), represents the candidate association rule: the confidence that vulnerability B also exists when vulnerability A exists in the physical node. P(B|A) can be specifically referred to in the above formula (2), which will not be repeated here.

[0120] Optionally, after the security vulnerability association analysis device selects a candidate association rule whose confidence is higher than or equal to a confidence threshold from multiple candidate association rules, it can also receive manually input evaluation results for each candidate association rule. When the evaluation result of the candidate association rule is satisfactory, the security vulnerability association analysis device can store the candidate association rule into the association rule knowledge base.

[0121] In some possible embodiments, in order to timely supplement association rules when there are relatively few association rules in the association rule knowledge base, the security vulnerability association analysis device may also select candidate association rules with lower confidence but higher lift to supplement into the association rule knowledge base. In this case, the method may also include: selecting candidate association rules with lift higher than or equal to the lift threshold from candidate association rules with confidence lower than the confidence threshold to supplement into the association rule knowledge base;

[0122] The lift is determined based on the quotient of the lift of the candidate association rule and the first value; the first value is determined based on the product of the support of the vulnerability elements constituting the candidate association rule. The lift threshold can be set to 1.

[0123] For example, taking the candidate association rule above: if vulnerability A exists in a physical node, vulnerability B also exists as an example, the improvement degree of the candidate association rule can be specifically calculated according to the following formula:

[0124]

[0125] In formula (7), Lift represents the lifting degree. Please refer to the above formula (5) and will not be described in detail. Support(A)·Support(B) represents the first value. The specific calculation method of Support(A) and Support(B) can refer to the above formula (3) and will not be described in detail. In formula (7), when the lift is greater than 1, it means that the support of the vulnerability elements after forming the candidate association rule is improved compared with the support of the original single vulnerability elements. When the lift is less than 1, it means that the support of the vulnerability elements after forming the candidate association rule is reduced compared with the support of the original single vulnerability elements. When the lift is equal to 1, it means that the support of the vulnerability elements after forming the candidate association rule is neither improved nor reduced compared with the support of the original single vulnerability elements.

[0126] Step 2b: Generate a heterogeneous graph of the Industrial Internet based on the association rule knowledge base and the network topology graph of the Industrial Internet.

[0127] For example, the security vulnerability association analysis device can use the network topology map as a basis, and then extract vulnerability elements from the association rule knowledge base as new nodes, and add edges between the new nodes and the existing physical nodes in the network topology map according to the association rules in the association rule knowledge base and the impact range of the security vulnerability itself, and finally obtain a heterogeneous graph of the industrial Internet.

[0128] For example, Figure 5 The heterogeneous graph provided in the embodiment of the present application. Figure 5 As shown, the heterogeneous graph may include physical nodes, vulnerability elements, connection relationships between different physical nodes, influence relationships between vulnerability elements and physical nodes, and association relationships between different vulnerability elements.

[0129] Step 3b: Analyze the heterogeneous graph and determine the attack path.

[0130] Optionally, step 3b may specifically include the following steps:

[0131] Step 3.1b: Generate multiple meta-path patterns based on the association rule knowledge base.

[0132] In a possible implementation, the security vulnerability association analysis device can directly arrange, combine and splice the association rules in the association rule knowledge base to obtain multiple meta-path patterns.

[0133] In another possible implementation, the security vulnerability association analysis device can complete the vulnerability combination information according to the association rules in the association rule knowledge base, and then update the association rule knowledge base, and generate multiple meta-path patterns based on the updated association rule knowledge base. In this case, the above step 3.1b can specifically include the following steps:

[0134] Step 3.1.1b: Based on the association rules in the association rule knowledge base, complete the potential vulnerability elements in the vulnerability combination information to obtain the completed vulnerability combination information.

[0135] Among them, the potential vulnerability elements are vulnerability elements that do not exist in the vulnerability combination information determined based on the association rules in the association rule knowledge base.

[0136] For example, taking the example where vulnerability combination information indicates that node N1 has vulnerability A but not vulnerability D, assuming that the association rule in the association rule knowledge base indicates that when a physical node has vulnerability A, vulnerability D also exists, the security vulnerability association analysis device can complete the vulnerability combination information to indicate that node N1 also has vulnerability D.

[0137] Step 3.1.2b: Based on the completed vulnerability combination information, the association rule knowledge base is updated to obtain an updated association rule knowledge base;

[0138] The details of step 3.1.2b can be referred to the above step 1b, which will not be repeated here.

[0139] Step 3.1.3b: Arrange, combine and concatenate the association rules in the updated association rule knowledge base to obtain multiple meta-path patterns.

[0140] Step 3.2b: Use multiple meta-path patterns to sample in the heterogeneous graph and obtain meta-paths as attack paths.

[0141] Exemplarily, the meta-path patterns may specifically include the following:

[0142] (1) Dependency Relationship: The exploitation of a security vulnerability may depend on the existence and previous exploitation of another security vulnerability. For example, an attacker may need to exploit a security vulnerability to gain permissions before exploiting another security vulnerability to perform a specific operation.

[0143] For example, the meta-path pattern corresponding to the dependency relationship may be: A-N1-B. The meta-path pattern means: for the physical node N1, first exploit vulnerability A to obtain higher permissions, and then exploit vulnerability B to maliciously attack the physical node N1.

[0144] (2) Chaining Vulnerabilities: An attacker can achieve a more complex attack by linking multiple security vulnerabilities. In this case, the exploitation of one security vulnerability can provide conditions or context for the exploitation of the next security vulnerability.

[0145] For example, the meta-path pattern corresponding to the chain exploit can be: ABC-N1. The meaning of this meta-path pattern is: the exploitation of vulnerability A provides conditions for the exploitation of vulnerability B, and the exploitation of vulnerability B provides new conditions for the exploitation of vulnerability C, and finally the vulnerability C is used to maliciously attack the physical node N1.

[0146] (3) Complementary vulnerabilities: Certain security vulnerabilities complement each other and can achieve a higher success rate or greater impact when used in combination. For example, one vulnerability can be used to evade detection, while another vulnerability can be used to execute malicious code.

[0147] For example, the meta-path pattern corresponding to the complementary relationship may be: D1-A-N1-B. The meta-path pattern means that an attacker can exploit vulnerability A to evade security defense mechanism D1, facilitate the exploitation of vulnerability B, and ultimately launch a malicious attack on physical node N1 through vulnerability B.

[0148] (4) Redirecting Use: An attacker may exploit a security vulnerability to redirect traffic or requests to other locations where security vulnerabilities exist, thereby achieving multi-point exploitation.

[0149] For example, the meta-path pattern corresponding to the redirection may be: N1-A-N2-B-N1. The meta-path pattern means that the attacker first uses vulnerability A of physical node N1 to access N2, and then uses vulnerability B carried by N2 to attack N1.

[0150] In some possible embodiments, after determining the attack path, the security vulnerability association analysis device can calculate the key nodes in the attack path (for example, the physical nodes with the highest probability of occurrence), and then manually design corresponding attack blocking methods at the key nodes.

[0151] In some possible embodiments, before the above S101, the security vulnerability association analysis device may also obtain a plurality of trained vulnerability prediction models.

[0152] In one possible implementation, the security vulnerability association analysis device can directly obtain multiple trained vulnerability prediction models from other devices.

[0153] For example, the security vulnerability association analysis device can obtain multiple trained vulnerability prediction models from other devices by transferring or downloading them through intermediate media.

[0154] In another possible implementation, the security vulnerability association analysis device can also train the graph neural network based on the training sample set to obtain multiple vulnerability prediction models.

[0155] Optionally, taking any first vulnerability prediction model among the multiple vulnerability prediction models as an example, the first vulnerability prediction model can be trained specifically through the following steps:

[0156] Step 1c: Obtain a training sample set.

[0157] The training sample set includes multiple training samples and a first label corresponding to each training sample, and each training sample includes a network topology diagram of the training industrial Internet and attribute information of each training physical node in the training industrial Internet. The first label is used to combine and indicate whether the multiple training physical nodes in the corresponding training sample include the first vulnerability element corresponding to the first vulnerability prediction model.

[0158] Step 2c: Train the preset graph neural network based on the training sample set to obtain a first vulnerability prediction model.

[0159] The preset graph neural network may specifically be CARE-GNN, GAT, or other types of graph neural networks. The embodiment of the present application does not limit the specific type of the preset graph neural network.

[0160] Optionally, the above step 2c may specifically include the following steps:

[0161] Step 2.1c: Extract the training feature matrix based on the attribute information of the training samples.

[0162] The training feature matrix includes the feature vector of each training physical node. The training feature matrix can be specifically described in the above steps 1a to 2a, which will not be described here.

[0163] Step 2.2c: Use the graph neural network to weightedly aggregate the feature vectors of each training physical node in the training sample and all the training physical nodes connected to it, and obtain the aggregated feature vector corresponding to each training physical node.

[0164] Exemplarily, the security vulnerability association analysis device may perform weighted aggregation on the feature vectors according to the following formula:

[0165]

[0166] In formula (8), Represents the aggregated feature vector corresponding to node i. W represents the attention weight of node j to node i in layer l. (l) represents the weight matrix of the lth layer. Represents the attention weight of node i on itself in the lth layer. Represents the feature vector of node i. represents the feature vector of node j. N(i) represents the set of training logistics nodes connected to node i. σ represents the nonlinear activation function ReLU.

[0167] Step 2.3c: input the aggregated feature vectors corresponding to each training physical node into the classifier module of the graph neural network in turn to obtain the first prediction label output by the classifier module.

[0168] The classifier module may be a fully connected layer or a support vector machine (SVM), etc. The embodiment of the present application does not specifically limit the classifier module. The first prediction label is used to combine and represent whether multiple training physical nodes in the corresponding training sample predicted by the graph neural network include the first vulnerability element.

[0169] Exemplarily, the output of the classifier module can be specifically expressed as the following formula:

[0170]

[0171] In formula (9), W represents the first predicted label output by the classifier module. c Represents the weight matrix of the classifier module. b c Represents the offset vector of the classifier module.

[0172] Step 2.4c: Based on the first predicted label output by the classifier module and the first label corresponding to each training sample, the parameters of the graph neural network are optimized through the cross entropy loss function until the training stop condition is reached to obtain the first vulnerability prediction model.

[0173] Among them, the training stop conditions may specifically include: the number of times the training sample is input into the graph neural network reaches a number threshold; and / or the cross entropy loss function converges (the change value in multiple consecutive iterations is less than the change value threshold); and / or the probability that the graph neural network predicts that the first predicted labels of multiple training samples are the same as the first labels of the multiple training samples is greater than a probability threshold.

[0174] Optionally, the security vulnerability association analysis device can update the target parameters in the graph neural network according to the gradient of the cross entropy loss value to the target parameters. In this case, the step of optimizing the parameters of the graph neural network through the cross entropy loss function based on the first predicted label output by the classifier module and the first label corresponding to each training sample in step 2.4c above can specifically include the following steps:

[0175] Step 2.4.1c, use the cross entropy loss function to calculate the cross entropy loss value between the first label and the first predicted label.

[0176] For example, the cross entropy loss function can be specifically expressed as the following formula:

[0177]

[0178] In formula (10), represents the cross entropy loss value. N represents the number of training samples in the training sample set. i represents the probability distribution of the first label, which can be specifically represented by a one-hot encoding vector. i Represents the probability distribution of the first predicted label (ideally, it tends to be consistent with the probability distribution of the first label).

[0179] Step 2.4.2c: Based on the cross entropy loss value, use the back propagation algorithm to calculate the gradient of the cross entropy loss value to the target parameter in the graph neural network.

[0180] For example, the target parameters in the graph neural network can be understood as some of the parameters of the graph neural network. The target parameters in the graph neural network can specifically include: the weight matrix W of each layer in the graph neural network (l) , the weight matrix W in the classifier module c and the offset vector b c .

[0181] Optionally, if the graph neural network uses a network including an attention mechanism, the target parameter may also include a weight parameter in the attention mechanism.

[0182] Step 2.4.3c: Use the preset optimization algorithm to update the target parameters according to the gradient.

[0183] In a possible implementation, the security vulnerability association analysis device can use a gradient descent algorithm to update the target parameter according to the gradient.

[0184] Exemplarily, the process in which the security vulnerability association analysis device can update the target parameter according to the gradient using the gradient descent algorithm can be specifically expressed as the following formula:

[0185]

[0186] In formula (11) to formula (13), η represents the learning rate.

[0187] In another possible implementation, the security vulnerability association analysis device can use the Adam optimizer algorithm to update the target parameters according to the gradient.

[0188] Exemplarily, the Adam optimizer algorithm may specifically include the following processes:

[0189] S1. Update the first-order momentum estimate based on the gradient (or the exponentially weighted moving average of the gradient):

[0190]

[0191] In formula (14) to formula (16), t represents the current iteration number or time step. W (l) The first-order momentum at iteration t. W (l) The first-order momentum at the t-1th iteration. β1 represents the decay rate of the first-order momentum, and is usually taken as β1 = 0.9. Represents the cross entropy loss value To W (l) gradient. W c The first-order momentum at iteration t. W cThe first-order momentum at the t-1th iteration. Represents the cross entropy loss value To W c gradient. Indicates b c The first-order momentum at iteration t. Indicates b c The first-order momentum at the t-1th iteration. Represents the cross entropy loss value For b c gradient.

[0192] S2. Update the second-order momentum estimate based on the gradient (or the exponentially weighted average of the gradient platform):

[0193]

[0194] In formula (17) to formula (19), W (l) The second-order momentum at the tth iteration. β2 represents the decay rate of the second-order momentum, and is usually taken as β2 = 0.999. W (l) The second-order momentum at iteration t-1. W c The second-order momentum at iteration t. represents the second-order momentum of Wc at the t-1th iteration. Indicates b c The second-order momentum at iteration t. Indicates b c The second-order momentum at iteration t-1.

[0195] S3. Calculate the bias-corrected first-order momentum estimate and second-order momentum estimate:

[0196]

[0197] In formula (20) to formula (25), W (l) Computes the bias-corrected first-order momentum at iteration t. represents β1 raised to the power of t. W c Computes the bias-corrected first-order momentum at iteration t. Indicates b c Computes the bias-corrected first-order momentum at iteration t. W (l) Computes the bias-corrected second-order momentum at iteration t. represents β2 raised to the power of t. Computes the bias-corrected second-order momentum at iteration t. Indicates b c Computes the bias-corrected second-order momentum at iteration t.

[0198] S4. Update target parameters:

[0199]

[0200] In formula (26) to formula (28), ∈ represents a constant, which is usually taken as ∈=10 -8 , to avoid zero denominator.

[0201] In the actual implementation process, the gradients of the above target parameters will be updated simultaneously. For example, the W of each layer of the above graph neural network (l) and W of the classifier module c and b c This allows all parameters of the model to be optimized synchronously, improving the overall performance of the model.

[0202] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. It should be easy to realize that the technical goals in this field are combined with the units and algorithm steps of each example described in the embodiments disclosed in this article, and the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical goals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0203] In an exemplary embodiment, the present application also provides a security vulnerability association analysis device. Figure 6 This is a schematic diagram of the composition of the security vulnerability association analysis device provided in the embodiment of the present application. Figure 6 As shown, the device includes: an acquisition module 601 and a processing module 602.

[0204] The acquisition module 601 is used to obtain the attribute information of each physical node among multiple physical nodes of the industrial Internet.

[0205] Processing module 602 is used to determine vulnerability combination information based on the attribute information of each physical node, the network topology diagram of the industrial Internet and multiple vulnerability prediction models; wherein each vulnerability prediction model corresponds to a vulnerability element, and the vulnerability element includes a security vulnerability or a defense mechanism for a security vulnerability; each vulnerability prediction model is used to predict whether a corresponding vulnerability element exists in multiple physical nodes based on the attribute information of multiple physical nodes; the vulnerability combination information is used to combine and represent the vulnerability elements in multiple physical nodes; and correlation analysis is performed based on the vulnerability combination information to determine the attack path in the industrial Internet.

[0206] In some possible embodiments, the processing module 602 is specifically used to perform association analysis based on vulnerability combination information to generate an association rule knowledge base; the association rule knowledge base includes multiple association rules, and each association rule is used to represent the association relationship between at least two vulnerability elements; based on the association rule knowledge base and the network topology diagram of the industrial Internet, a heterogeneous graph of the industrial Internet is generated; the heterogeneous graph includes physical nodes, vulnerability elements, connection relationships between different physical nodes, influence relationships between vulnerability elements and physical nodes, and association relationships between different vulnerability elements; the heterogeneous graph is analyzed to determine the attack path.

[0207] In some other possible embodiments, the processing module 602 is specifically used to calculate the conditional probability between any two vulnerability elements based on the vulnerability combination information; if the conditional probability between the two vulnerability elements is higher than the probability threshold, the two vulnerability elements are associated, an association rule is established, and an association rule knowledge base is obtained.

[0208] In some other possible embodiments, the processing module 602 is specifically used to form multiple candidate item sets based on vulnerability combination information, and select item sets with support greater than a support threshold from the multiple candidate item sets to obtain multiple frequent item sets; a candidate item set is an item set including a vulnerability element; execute the candidate item set merging step: combine a frequent item set with N frequent item sets to obtain at least one N+1 candidate item set; N is an integer starting from 1 and adding 1 after each execution of the candidate item set selection step; the N+1 candidate item set is an item set including N+1 vulnerability elements; execute the candidate item set selection step: select an item set with support greater than a support threshold from at least one N+1 candidate item set to obtain an N+1 frequent item set; repeat the candidate item set merging step and the candidate item set selection step until the iteration stop condition is met; based on the frequent item sets obtained when the iteration stop condition is met and before the iteration stop condition is met, establish association rules to obtain an association rule knowledge base.

[0209] In some other possible embodiments, the processing module 602 is specifically used to associate each frequent item set obtained when the iteration stopping condition is met and before the iteration stopping condition is met, and establish multiple candidate association rules; select candidate association rules with confidence greater than or equal to the confidence threshold from the multiple candidate association rules to obtain an association rule knowledge base; the confidence is determined based on the conditional probability between the vulnerability elements in the candidate association rules.

[0210] In some other possible embodiments, the processing module 602 is further used to select candidate association rules with a lift higher than or equal to the lift threshold from candidate association rules with a confidence lower than a confidence threshold, and add them to the association rule knowledge base; wherein the lift is determined based on the quotient of the lift of the candidate association rule and a first numerical value; and the first numerical value is determined based on the product of the support of the vulnerability elements constituting the candidate association rule.

[0211] In some other possible embodiments, the processing module 602 is specifically configured to generate a plurality of meta-path patterns based on an association rule knowledge base; and perform sampling in a heterogeneous graph using the plurality of meta-path patterns to obtain meta-paths as attack paths.

[0212] In some other possible embodiments, the processing module 602 is specifically used to complete the potential vulnerability elements in the vulnerability combination information based on the association rules in the association rule knowledge base to obtain the completed vulnerability combination information; the potential vulnerability elements are vulnerability elements that do not exist in the vulnerability combination information determined based on the association rules in the association rule knowledge base; based on the completed vulnerability combination information, the association rule knowledge base is updated to obtain an updated association rule knowledge base; the association rules in the updated association rule knowledge base are arranged, combined and spliced ​​to obtain multiple meta-path patterns.

[0213] In some other possible embodiments, the property information includes: node name, node number, communication protocol, device type, and software version.

[0214] In some other possible embodiments, the processing module 602 is specifically used to extract the feature vector of all attribute information of each physical node, and splice the feature vectors of different attribute information of each physical node to obtain the initial feature vector corresponding to each physical node; splice the initial feature vectors corresponding to each physical node to obtain a feature matrix; based on the feature matrix, the topology map of the industrial Internet and multiple vulnerability prediction models, determine multiple predicted vulnerability labels corresponding to each vulnerability prediction model; the vulnerability prediction label is used to indicate whether a corresponding vulnerability element exists in multiple physical nodes predicted by the corresponding vulnerability prediction model; and splice multiple predicted vulnerability labels to obtain vulnerability combination information.

[0215] In some other possible embodiments, the acquisition module 601 is also used to obtain a training sample set; the training sample set includes multiple training samples and a first label corresponding to each training sample, each training sample includes a network topology diagram of a training industrial Internet, and attribute information of each training physical node in a plurality of training physical nodes in the training industrial Internet; the first label is used to combine and indicate whether the plurality of training physical nodes in the corresponding training sample include a first vulnerability element corresponding to a first vulnerability prediction model; the processing module 602 is also used to train a preset graph neural network based on the training sample set to obtain a first vulnerability prediction model.

[0216] In some other possible embodiments, the processing module 602 is specifically used to extract a training feature matrix based on the attribute information of the training sample; the training feature matrix includes a feature vector of each training physical node; the graph neural network is used to weightedly aggregate the feature vectors of each training physical node in the training sample and all the training physical nodes connected to it in turn to obtain the aggregated feature vector corresponding to each training physical node; the aggregated feature vector corresponding to each training physical node is input into the classifier module of the graph neural network in turn to obtain the first prediction label output by the classifier module; the first prediction label is used to combine and represent whether multiple training physical nodes in the corresponding training sample predicted by the graph neural network include the first vulnerability element; based on the first prediction label output by the classifier module and the first label corresponding to each training sample, the parameters of the graph neural network are optimized by the cross entropy loss function until the training stop condition is reached to obtain the first vulnerability prediction model.

[0217] In some other possible embodiments, the processing module 602 is specifically used to use a cross entropy loss function to calculate the cross entropy loss value between the first label and the first predicted label; based on the cross entropy loss value, use a back propagation algorithm to calculate the gradient of the cross entropy loss value to the target parameter in the graph neural network; and use a preset optimization algorithm to update the target parameter according to the gradient.

[0218] It should be noted that Figure 6 The division of modules in the example is schematic and is only a logical function division. There may be other division methods in actual implementation. For example, two or more functions may be integrated into one processing module. The above integrated modules may be implemented in the form of hardware or software function modules.

[0219] In an exemplary embodiment, as described above, the security vulnerability association analysis device may be a computer or a service or other electronic device with a computing function. In this case, the present application also provides an electronic device, Figure 7 The following is a schematic diagram of the composition of the electronic device provided in the embodiment of the present application. Figure 7As shown, the electronic device includes: a processor 10 , a memory 20 , a communication line 30 , a communication interface 40 , and an input / output interface 50 .

[0220] The processor 10 , the memory 20 , the communication interface 40 and the input / output interface 50 may be connected via a communication line 30 .

[0221] The processor 10 is used to execute the instructions stored in the memory 20 to implement the security vulnerability association analysis method provided in the above embodiment of the present application. The processor 10 can be a CPU, a general-purpose processor network processor (network processor, NP), a digital signal processor (digital signal processing, DSP), a microprocessor, a microcontroller (microcontrol unit, MCU) / single-chip microcomputer / single-chip microcomputer, a programmable logic device (programmable logic device, PLD) or any combination thereof. The processor 10 can also be any other device with processing functions, such as a circuit, a device or a software module, which is not limited in the embodiments of the present application. In one example, the processor 10 may include one or more CPUs, such as Figure 7 As an optional implementation, the electronic device may include multiple processors, for example, in addition to the processor 10, it may also include a processor 60 ( Figure 7 The dashed line is used as an example.

[0222] The memory 20 is used to store instructions. For example, the instructions may be computer programs. Optionally, the memory 20 may be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage devices, etc., and the embodiments of the present application are not limited to this.

[0223] It should be noted that the memory 20 may exist independently of the processor 10, or may be integrated with the processor 10. The memory 20 may be located inside the electronic device, or may be located outside the electronic device, which is not limited in the embodiment of the present application.

[0224] The communication line 30 is used to transmit information between various components included in the electronic device.

[0225] The communication interface 40 is used to communicate with other devices or other communication networks. The other communication networks may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 40 may be a module, a circuit, a transceiver or any device capable of achieving communication.

[0226] The input / output interface 50 is used to implement human-computer interaction between a user and an electronic device, for example, to implement action interaction or information interaction between a user and an electronic device.

[0227] Exemplarily, the input / output interface 50 may be a mouse, a keyboard, a display screen, or a touch display screen, etc. Action interaction or information interaction between a user and an electronic device may be achieved through a mouse, a keyboard, a display screen, or a touch display screen, etc.

[0228] It should be noted that Figure 7 The structure shown in the figure does not constitute a limitation on the electronic device, except Figure 7 In addition to the components shown, the electronic device may include more or fewer components than shown, or a combination of certain components, or a different arrangement of components.

[0229] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, which includes computer instructions. When the computer instructions are executed in an electronic device, the electronic device implements the method in the aforementioned method embodiment.

[0230] In an exemplary embodiment, the present application also provides a readable storage medium, which includes software instructions. When the software instructions are executed in an electronic device, the electronic device implements the method in the aforementioned method embodiment. The computer-readable storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

[0231] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer-executable instructions. When loading and executing computer-executable instructions on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer-executable instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0232] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other changes to the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0233] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0234] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security vulnerability association analysis method, characterized in that: The method comprises: Obtain attribute information of each physical node among multiple physical nodes of the Industrial Internet; Determine vulnerability combination information based on attribute information of each physical node, a network topology diagram of the industrial Internet, and multiple vulnerability prediction models; Wherein, each vulnerability prediction model corresponds to a vulnerability element, and the vulnerability element includes a security vulnerability or a defense mechanism of a security vulnerability; each vulnerability prediction model is used to predict whether the multiple physical nodes have a corresponding vulnerability element according to the attribute information of the multiple physical nodes; the vulnerability combination information is used to combine and represent the vulnerability elements in the multiple physical nodes; Correlation analysis is performed based on the vulnerability combination information to determine the attack path in the industrial Internet.

2. The method according to claim 1, characterized in that The performing correlation analysis based on the vulnerability combination information to determine the attack path in the industrial Internet includes: Performing association analysis based on the vulnerability combination information to generate an association rule knowledge base; the association rule knowledge base includes multiple association rules, each association rule is used to represent the association relationship between at least two vulnerability elements; Based on the association rule knowledge base and the network topology diagram of the industrial Internet, a heterogeneous graph of the industrial Internet is generated; the heterogeneous graph includes physical nodes, vulnerability elements, connection relationships between different physical nodes, influence relationships between vulnerability elements and physical nodes, and association relationships between different vulnerability elements; The heterogeneous graph is analyzed to determine the attack path.

3. The method according to claim 2, characterized in that The performing association analysis based on the vulnerability combination information to generate an association rule knowledge base includes: Based on the vulnerability combination information, calculate the conditional probability between any two vulnerability elements; If the conditional probability between two vulnerability elements is higher than the probability threshold, the two vulnerability elements are associated, association rules are established, and an association rule knowledge base is obtained.

4. The method according to claim 2, characterized in that: Based on the vulnerability combination information, association analysis is performed to generate an association rule knowledge base, including: Combining the vulnerability information into multiple candidate item sets based on the vulnerability, and selecting item sets with support greater than a support threshold from the multiple candidate item sets to obtain multiple frequent item sets; the candidate item set is an item set including a vulnerability element; Execute the candidate item set merging step: combine a frequent item set with N frequent item sets to obtain at least one N+1 candidate item set; N is an integer starting from 1 and increasing by 1 after each candidate item set selection step is completed; the N+1 candidate item set is an item set including N+1 vulnerability elements; Executing the candidate item set selection step: selecting an item set whose support is greater than the support threshold from the at least one N+1 candidate item set to obtain an N+1 frequent item set; Repeating the candidate item set merging step and the candidate item set selecting step until an iteration stopping condition is met; Based on the frequent item sets obtained when the iteration stopping condition is met and before the iteration stopping condition is met, association rules are established to obtain the association rule knowledge base.

5. The method according to claim 4, characterized in that The establishing of association rules based on the frequent item sets obtained when the iteration stopping condition is satisfied and before the iteration stopping condition is satisfied to obtain the association rule knowledge base includes: Associating each frequent item set obtained when the iteration stop condition is satisfied and before the iteration stop condition is satisfied, and establishing a plurality of candidate association rules; A candidate association rule whose confidence is higher than or equal to a confidence threshold is selected from the multiple candidate association rules to obtain the association rule knowledge base; the confidence is determined based on the conditional probability between the vulnerability elements in the candidate association rule.

6. The method according to claim 5, characterized in that The method further comprises: From the candidate association rules whose confidences are lower than the confidence threshold, select the candidate association rules whose lifts are higher than or equal to the lift threshold and add them into the association rule knowledge base; The lift is determined based on the quotient of the lift of the candidate association rule and a first value; the first value is determined based on the product of the support of the vulnerability elements constituting the candidate association rule.

7. The method according to claim 2, characterized in that The analyzing the heterogeneous graph to determine the attack path includes: Based on the association rule knowledge base, generating a plurality of meta-path patterns; The plurality of meta-path patterns are used to perform sampling in the heterogeneous graph to obtain meta-paths as the attack paths.

8. The method according to claim 7, characterized in that The generating of a plurality of meta-path patterns based on the association rule knowledge base includes: Based on the association rules in the association rule knowledge base, the potential vulnerability elements are completed in the vulnerability combination information to obtain the completed vulnerability combination information; the potential vulnerability elements are vulnerability elements that do not exist in the vulnerability combination information determined based on the association rules in the association rule knowledge base; Based on the completed vulnerability combination information, the association rule knowledge base is updated to obtain an updated association rule knowledge base; The association rules in the updated association rule knowledge base are arranged, combined and concatenated to obtain the multiple meta-path patterns.

9. The method according to any one of claims 1 to 8, characterized in that: The attribute information includes: node name, node number, communication protocol, device type and software version.

10. The method according to claim 9, characterized in that The determining of vulnerability combination information based on the attribute information of each physical node, the topology map of the industrial Internet, and multiple vulnerability prediction models includes: Extract the feature vectors of all attribute information of each physical node, and concatenate the feature vectors of different attribute information of each physical node to obtain the initial feature vector corresponding to each physical node; Concatenate the initial feature vectors corresponding to each physical node to obtain a feature matrix; Based on the feature matrix, the topology map of the industrial Internet and the multiple vulnerability prediction models, determine multiple predicted vulnerability labels corresponding to each vulnerability prediction model; the vulnerability prediction label is used to indicate whether the multiple physical nodes predicted by the corresponding vulnerability prediction model have a corresponding vulnerability element; The multiple predicted vulnerability labels are concatenated to obtain the vulnerability combination information.

11. The method according to any one of claims 1 to 8, characterized in that: Any first vulnerability prediction model among the multiple vulnerability prediction models is trained in the following manner: Obtain a training sample set; the training sample set includes multiple training samples and a first label corresponding to each training sample, each training sample includes a network topology diagram of a training industrial Internet, and attribute information of each training physical node in a plurality of training physical nodes in the training industrial Internet; the first label is used to combine and indicate whether the plurality of training physical nodes in the corresponding training sample include a first vulnerability element corresponding to the first vulnerability prediction model; The preset graph neural network is trained based on the training sample set to obtain the first vulnerability prediction model.

12. The method according to claim 11, characterized in that The step of training a preset graph neural network based on the training sample set to obtain the first vulnerability prediction model includes: Based on the attribute information of the training samples, a training feature matrix is ​​extracted; the training feature matrix includes a feature vector of each training physical node; The graph neural network is used to sequentially weight and aggregate the feature vectors of each training physical node in the training sample and all the training physical nodes connected thereto, so as to obtain an aggregated feature vector corresponding to each training physical node; The aggregated feature vectors corresponding to each training physical node are sequentially input into the classifier module of the graph neural network to obtain a first prediction label output by the classifier module; the first prediction label is used to combine and indicate whether multiple training physical nodes in the corresponding training sample predicted by the graph neural network include the first vulnerability element; Based on the first predicted label output by the classifier module and the first label corresponding to each training sample, the parameters of the graph neural network are optimized by a cross entropy loss function until the training stop condition is reached, thereby obtaining the first vulnerability prediction model.

13. The method according to claim 12, characterized in that The step of optimizing the parameters of the graph neural network by a cross entropy loss function based on the first predicted label output by the classifier module and the first label corresponding to each training sample includes: Calculate the cross entropy loss value between the first label and the first predicted label using the cross entropy loss function; According to the cross entropy loss value, a back propagation algorithm is used to calculate the gradient of the cross entropy loss value to the target parameter in the graph neural network; The target parameter is updated according to the gradient using a preset optimization algorithm.

14. A security vulnerability correlation analysis device, characterized in that: include: Acquisition module and processing module; The acquisition module is used to obtain attribute information of each physical node among multiple physical nodes of the industrial Internet; The processing module is used to determine vulnerability combination information based on the attribute information of each physical node, the network topology diagram of the industrial Internet and multiple vulnerability prediction models; wherein each vulnerability prediction model corresponds to a vulnerability element, and the vulnerability element includes a security vulnerability or a defense mechanism for a security vulnerability; each vulnerability prediction model is used to predict whether the multiple physical nodes have a corresponding vulnerability element based on the attribute information of the multiple physical nodes; the vulnerability combination information is used to combine and represent the vulnerability elements in the multiple physical nodes; and correlation analysis is performed based on the vulnerability combination information to determine the attack path in the industrial Internet.

15. An electronic device, characterized in that: include: Processor and memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 13.

16. A computer program product, characterized in that include: Computer instructions; When the computer instructions are executed in an electronic device, the electronic device implements the method according to any one of claims 1 to 13.

Images