Power internet of things terminal attack path prediction method and system

Abstract

The invention discloses a power Internet of Things terminal attack path prediction method and system, and belongs to the technical field of power Internet of Things terminal security state evaluation. According to the power Internet of Things terminal attack path prediction method based on the state machine and the attack graph, the vulnerability recognition model, the attack graph generation model, the attack division model and the attack mapping model are constructed, and the attack path is predicted and simplified by using the finite state machine and the Bayesian attack graph; therefore, the complexity of predicting the attack path in a large-scale network environment can be effectively reduced, so that the requirement on the data processing capability of hardware can be effectively reduced, the processing time is greatly shortened, and the attack behavior can be quickly responded. According to the method, the identification and defense capabilities of potential network threats are improved, and the method is particularly suitable for processing a large-scale and high-complexity network environment, so that a security team can effectively quantify the security state of each attack surface when the attack surface is attacked, and adopts targeted defense measures.

Description

Technical Field

[0001] The present invention relates to a method and system for predicting an attack path of an electric power Internet of Things terminal, and belongs to the technical field of safety status assessment of electric power Internet of Things terminals. Background Art

[0002] With the rapid development of network technology, especially the widespread application of Internet of Things technology in power systems, power IoT terminals have become the main target of network attacks, and their security issues are becoming increasingly prominent. These terminals often process and transmit critical data, so it is crucial to conduct effective security assessments on them.

[0003] Traditional security assessment models, such as attack trees and attack graphs, can describe potential attack paths, but they lack quantitative analysis of attack probabilities, and the resulting attack paths are extremely complex. Therefore, when dealing with large-scale networks, they place extremely high demands on hardware data processing capabilities and take a long time to process, making it impossible to respond quickly to attack behaviors and hindering rapid assessment of network security status.

[0004] The information disclosed in this Background Art is only for understanding the background of the inventive concept and therefore it may include information that does not constitute the prior art. Summary of the invention

[0005] In response to the above problem or one of the above problems, an object of the present invention is to provide a method and system for predicting the attack path of an electric power Internet of Things terminal, which can effectively reduce the complexity of predicting the attack path in a large-scale network environment by constructing a vulnerability identification model, an attack graph generation model, an attack partitioning model, and an attack mapping model, and using a finite state machine and a Bayesian attack graph to predict and simplify the attack path, thereby effectively reducing the requirements for the data processing capabilities of the hardware, greatly shortening the processing time, and then being able to quickly respond to attack behaviors, facilitating a rapid assessment of the network security status.

[0006] In response to the above problem or one of the above problems, the second object of the present invention is to provide a method and system for predicting the attack path of an electric power Internet of Things terminal, which combines a finite state machine and a Bayesian attack graph, and introduces a graph attention network to accurately classify the attack behaviors in the Bayesian attack graph and map them to the specific attack stages defined in the finite state machine, thereby achieving data dimensionality reduction of the Bayesian attack graph, thereby simplifying the attack path, and then dynamically and accurately reflecting and analyzing the network security status.

[0007] In response to the above problem or one of the above problems, the third object of the present invention is to provide a method and system for predicting the attack path of an electric power Internet of Things terminal, which can effectively reduce the complexity of the attack path in a large-scale network environment, and describe the various stages of the attack process in a clear and structured manner, thereby realizing effective security assessment of the electric power Internet of Things terminal facing unknown attack threats.

[0008] To achieve one of the above purposes, the first technical solution of the present invention is:

[0009] The attack path prediction method of the power IoT terminal based on the state machine and attack graph includes the following contents:

[0010] Through the pre-built vulnerability identification model, the power terminal equipment is scanned for vulnerabilities and the vulnerability information related to the power system is collected;

[0011] Using the pre-built attack graph generation model, vulnerability information and its dependencies are analyzed to build a Bayesian attack graph;

[0012] Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases;

[0013] Using the pre-built attack mapping model and the graph attention network, the attack behaviors in the Bayesian attack graph are classified and mapped to the attack stages defined by the finite state machine, and the attack path of the power Internet of Things terminal is obtained to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

[0014] After continuous exploration and experiments, the present invention constructs a vulnerability identification model, an attack graph generation model, an attack partitioning model, and an attack mapping model, and uses a finite state machine and a Bayesian attack graph to predict and simplify the attack path, thereby effectively reducing the complexity of predicting the attack path in a large-scale network environment, thereby effectively reducing the requirements on the data processing capabilities of the hardware, greatly shortening the processing time, and then being able to quickly respond to attack behaviors, facilitating a rapid assessment of the network security status.

[0015] Furthermore, the present invention combines the finite state machine and the Bayesian attack graph, and by introducing the graph attention network, accurately classifies the attack behaviors in the Bayesian attack graph and maps them to the specific attack stages defined in the finite state machine, thereby achieving data dimensionality reduction of the Bayesian attack graph, thereby simplifying the attack path, and then dynamically and accurately reflecting and analyzing the network security status. The present invention not only improves the ability to identify and defend against potential network threats, but is also particularly suitable for handling large-scale and highly complex network environments, allowing security teams to effectively quantify the security status of each attack surface when attacked and take targeted defense measures.

[0016] Furthermore, the present invention can effectively reduce the complexity of attack paths in large-scale network environments, describe the various stages of the attack process in a clear and structured manner, and achieve effective security assessment of power IoT terminals facing unknown attack threats.

[0017] Furthermore, the model in the present application is an object that objectively describes the morphological structure with the help of physical or virtual representation. The object is not equal to the object and is not limited to physical and virtual. It can be a data processing function, software program, processing mode, usage method, operation method, workflow, application process, electronic hardware, circuit module, processing system, system imitation or simulation object.

[0018] As the preferred technical measures:

[0019] The method of scanning the power terminal equipment for vulnerabilities and collecting vulnerability information related to the power system through the pre-built vulnerability identification model is as follows:

[0020] Use scanning tools to scan the power IoT environment and identify all active power terminal devices and their open services and ports. Power terminal devices include at least smart meters, distribution automation equipment, and corresponding control systems.

[0021] Use vulnerability scanning tools to scan the identified power terminal equipment for vulnerabilities and obtain scanning data;

[0022] Match the scan data with the CVE database to collect vulnerability information related to the power system.

[0023] As the preferred technical measures:

[0024] Using the pre-built attack graph generation model, the vulnerability information and its dependencies are analyzed and the method of building a Bayesian attack graph is as follows:

[0025] Each power IoT terminal is set as a node; the attributes of the node include service type, security configuration, existing vulnerabilities, and specific attack techniques and attack stages corresponding to the vulnerabilities; service types include power data collection and equipment control;

[0026] Bernoulli random variables 0 and 1 are used to represent the current attribute status of the node, where 1 means that the attacker has broken into the node, and 0 means that the attacker has not broken into the node;

[0027] According to the Common Vulnerability Scoring System (CVSS), the probability of successful exploitation of a vulnerability is Pr(e ij ), as the weight of the directed edge, so according to Pr(e ij ) and the attribute status of the node to calculate the conditional probability table of reaching each node, which represents the possibility of reaching the node from the previous node;

[0028] For each node i, the conditional probability of reaching the compromised state is determined by the state of its direct predecessor node and the probability of vulnerability exploitation of the corresponding edge. The calculation formula of the conditional probability is as follows:

[0029]

[0030] Among them, parents(i) are all the predecessor nodes of node i, S parrnts(i) is the attribute state set of all predecessor nodes of node i, Pr(e ji ) is the probability of vulnerability exploitation from node j to i, S j is the attribute status of node j, the predecessor of node i, and takes the value of 1 or 0, representing breach or non-breach;

[0031] According to the conditional probability of each node, a Bayesian attack graph is constructed.

[0032] As the preferred technical measures:

[0033] Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined, and the method of obtaining several attack phases is as follows:

[0034] According to the attack techniques and strategies described in the public knowledge base in the field of network security, the network attack process is broken down into several attack stages; the several attack stages at least include external network information collection, external network penetration, maintaining authority, escalating authority, internal network reconnaissance, lateral movement and causing impact;

[0035] Based on the finite state machine, each attack stage is defined as an independent state in the finite state machine, and the transitions between these independent states represent the behavior pattern of the attacker transitioning from one attack stage to another.

[0036] As the preferred technical measures:

[0037] Using the pre-built attack mapping model and the graph attention network, the attack behaviors in the Bayesian attack graph are classified and mapped to the attack stages defined by the finite state machine. The method for obtaining the attack path of the power IoT terminal is as follows:

[0038] Construct a graph attention network to identify and classify each node in the Bayesian attack graph and obtain node v i The attack phase category to which it belongs;

[0039] According to the identified nodes and node v i The attack phase category belongs to, and a Bayesian attack graph G = (V, E) is constructed, where V is a set of nodes and E is a set of directed edges;

[0040] Based on the node set of the Bayesian attack graph, calculate the i To node v j The probability of vulnerability exploitation Pr(e ij );

[0041] Based on the directed edge set in the Bayesian attack graph and the vulnerability exploitation probability Pr(e ij ), calculate the average transition probability Pr(s i →s j ), which is calculated as follows:

[0042]

[0043] in, is the state i to j The set of all edges of ;

[0044] According to the average transition probability Pr(s i →s j ), simplify the Bayesian attack graph to obtain an attack state machine, in which each state represents an attack stage, and the transition between states represents the possibility of going from one attack stage to another;

[0045] According to the attack state machine, the attack path of the power Internet of Things terminal is determined.

[0046] As the preferred technical measures:

[0047] Construct a graph attention network to identify and classify each node in the Bayesian attack graph and obtain node v i The methods belonging to the attack phase category are as follows:

[0048] First, encode each node in the Bayesian attack graph and use one-hot encoding to encode the node service type, security configuration, and the stage to which the attack belongs into a feature vector;

[0049] Secondly, encode each edge in the Bayesian attack graph; since each directed edge represents the probability of successful exploitation of a vulnerability from one node to another, the probability value is directly used as the feature encoding of the edge. For each edge (i, j), the feature of the edge is the vulnerability exploitation probability Pr(e ij ), representing node v i To node v j The transition probability of

[0050] Thirdly, a multi-layer graph attention layer is used to process the input node features. The output dimension of each layer is uniformly set to m, and the output of each layer will be used as the input of the next layer. The graph attention layer updates the feature representation of the node by learning the mutual influence and importance between nodes. For each layer l, the node v is calculated i New feature representation The calculation formula is as follows:

[0051]

[0052] in, is the feature representation of node j at layer l, is node v i The set of neighbor nodes, ReLU is the activation function, W (l) is the weight matrix of the lth layer, is the attention coefficient between nodes i and j, indicating the influence of node j on node i, and is calculated by the following formula:

[0053]

[0054] Among them, a is the parameter of the learned attention mechanism, LeakyReLU is the activation function, which is a variant of ReLU. It can keep more neurons in the network active, and ∥ represents vector concatenation. is node v i The feature representation of the neighbor node k at the lth layer, where is node v i The output of the last layer is used for classification tasks, and a linear transformation layer is used, whose weight matrix is ​​m×7, that is, the m-dimensional output of the last graph attention layer is mapped to 7 different categories; the node v i Feature representation at the final layer of the graph attention layer Used to predict the attack phase it belongs to;

[0055] Node v i The expression of the classification output is as follows:

[0056]

[0057] Among them, y i is node v i The classification output of node v i The predicted probability of the seven attack stages; W (out) and b out are the weights of the output layer respectively;

[0058] For the seven attack stages, y i is a seven-dimensional vector, which is expressed as follows:

[0059] y i =[0.05,0.10,0.50,0.10,0.05,0.10,0.10],

[0060] When node v i When the probability of belonging to the first attack stage is 5%, the probability of belonging to the second attack stage is 10%, and the probability of belonging to the third attack stage is 50%, node vi Output the third attack stage, and so on. The value of each dimension corresponds to the probability of a specific stage. The value of each dimension is a number between 0 and 1, indicating the probability that the node belongs to the corresponding attack stage. The sum of the values ​​of all dimensions is equal to 1.

[0061] The graph attention network is trained using the local dataset, and each node in the Bayesian attack graph is identified and classified according to the obtained model to obtain the node v i The attack stage category Class (v i ).

[0062] As the preferred technical measures:

[0063] The method for encoding each node in the Bayesian attack graph is as follows:

[0064] For each node, the vector obtained by one-hot encoding the node service type is recorded as a1, the vector obtained by one-hot encoding the security configuration is recorded as a2, and the vector obtained by one-hot encoding the stage to which the attack belongs is recorded as a3;

[0065] When a node has three service types and two security configurations, and the vulnerability on the node belongs to one of the seven different attack stages, the service type is encoded as a vector a1 = [1,0,0], the security configuration is encoded as a vector a2 = [1,0], and the attack stage is encoded as a vector a3 = [0,1,0,0,0,0,0];

[0066] In order to effectively capture the potential semantic relationship between the vulnerabilities and attack techniques existing in the nodes, a neural network is used to dynamically learn to map each vulnerability number and attack technique to a representation in a vector space. Finally, each vulnerability number and attack technique is converted into an embedded vector, which is denoted as a4.

[0067] When a vulnerability number and the corresponding attack technique are learned and mapped into a 10-dimensional embedding vector, i.e., a4 = [0.21, -0.34, 0.87, ..., 0.45]; each node v i The eigenvector x i It is the concatenation of the one-hot encoding vector of the service type, security configuration, and attack stage with the embedding vector of the vulnerability number and attack technique, that is, x i =a1||a2||a3||a4, where || represents vector concatenation.

[0068] As the preferred technical measures:

[0069] The method of simplifying the Bayesian attack graph and obtaining the attack state machine is as follows:

[0070] First, according to the Bayesian attack graph, set the initial state graph G′=(V′,E′), Where V′ is the simplified state set, and W′ is the state transition set;

[0071] Secondly, traverse each node v in the Bayesian attack graph i ∈V, according to its attack stage category Class(v i ) Mark it as state s, if state s is not in V′, add s to V′;

[0072] For each edge (i, j)∈E in the Bayesian attack graph G, if Class(v i )≠Class(v j ), then add a state transition (Class(v i ),Class(v j )) to E′, if Class(v i )=Class(v j ), merge repeated transitions and calculate the average transition probability:

[0073]

[0074] in, is the state i to j The set of all edges of ;

[0075] Finally, the Bayesian attack graph is simplified to obtain the state graph G′=(V′,E′). The state graph G′ is a finite state machine, namely, the attack state machine.

[0076] To achieve one of the above purposes, the second technical solution of the present invention is:

[0077] The attack path prediction method of the power IoT terminal based on the state machine and attack graph, step 1, through the pre-built vulnerability identification model, the vulnerability scan of the power terminal equipment is carried out to collect the vulnerability information related to the power system;

[0078] Step 2: Using the pre-built attack graph generation model, a Bayesian attack graph is established by analyzing the vulnerability information and its dependencies;

[0079] Step 3: Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases;

[0080] Step 4: Use the pre-built attack mapping model and the graph attention network to analyze the Bayesian attack graph, classify the attack behaviors in the Bayesian attack graph and map them to the attack stages defined by the finite state machine to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

[0081] The present invention combines finite state machines and Bayesian attack graphs, and by introducing graph attention networks, accurately classifies and maps attack behaviors in the Bayesian attack graph to specific attack stages defined in the finite state machine, thereby achieving data dimensionality reduction of the Bayesian attack graph, thereby simplifying the attack path, and then dynamically and accurately reflecting and analyzing the network security status. The present invention not only improves the ability to identify and defend against potential network threats, but is also particularly suitable for handling large-scale and highly complex network environments, allowing security teams to effectively quantify the security status of each attack surface when attacked and take targeted defense measures.

[0082] Furthermore, the present invention can effectively reduce the complexity of attack paths in large-scale network environments, describe the various stages of the attack process in a clear and structured manner, and achieve effective security assessment of power IoT terminals facing unknown attack threats.

[0083] To achieve one of the above purposes, the third technical solution of the present invention is:

[0084] The power IoT terminal attack path prediction system based on state machine and attack graph includes:

[0085] one or more processors;

[0086] A storage device for storing one or more programs;

[0087] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned power Internet of Things terminal attack path prediction method based on the state machine and the attack graph.

[0088] To achieve one of the above purposes, the fourth technical solution of the present invention is:

[0089] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned power Internet of Things terminal attack path prediction method based on a state machine and an attack graph.

[0090] Compared with the prior art solutions, the present invention has the following beneficial effects:

[0091] After continuous exploration and experiments, the present invention constructs a vulnerability identification model, an attack graph generation model, an attack partitioning model, and an attack mapping model, and uses a finite state machine and a Bayesian attack graph to predict and simplify the attack path, thereby effectively reducing the complexity of predicting the attack path in a large-scale network environment, thereby effectively reducing the requirements on the data processing capabilities of the hardware, greatly shortening the processing time, and then being able to quickly respond to attack behaviors, facilitating a rapid assessment of the network security status.

[0092] Furthermore, the present invention combines the finite state machine and the Bayesian attack graph, and by introducing the graph attention network, accurately classifies the attack behaviors in the Bayesian attack graph and maps them to the specific attack stages defined in the finite state machine, thereby achieving data dimensionality reduction of the Bayesian attack graph, thereby simplifying the attack path, and then dynamically and accurately reflecting and analyzing the network security status. The present invention not only improves the ability to identify and defend against potential network threats, but is also particularly suitable for handling large-scale and highly complex network environments, allowing security teams to effectively quantify the security status of each attack surface when attacked and take targeted defense measures.

[0093] Furthermore, the present invention can effectively reduce the complexity of attack paths in large-scale network environments, describe the various stages of the attack process in a clear and structured manner, and achieve effective security assessment of power IoT terminals facing unknown attack threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 A schematic diagram of a method for predicting attack paths of power IoT terminals according to the present invention;

[0095] Figure 2 Another schematic diagram of the method for predicting attack paths of power IoT terminals of the present invention;

[0096] Figure 3 A Bayesian attack graph constructed for the present invention. DETAILED DESCRIPTION

[0097] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0098] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the following detailed description of the present invention. Those skilled in the art can fully understand the present invention without the description of these details.

[0099] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0100] like Figure 1 As shown, the first specific embodiment of the method for predicting the attack path of the power IoT terminal of the present invention is as follows:

[0101] The attack path prediction method of the power IoT terminal based on the state machine and attack graph includes the following contents:

[0102] Through the pre-built vulnerability identification model, the power terminal equipment is scanned for vulnerabilities and the vulnerability information related to the power system is collected;

[0103] Using the pre-built attack graph generation model, vulnerability information and its dependencies are analyzed to build a Bayesian attack graph;

[0104] Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases;

[0105] Using the pre-built attack mapping model and the graph attention network, the attack behaviors in the Bayesian attack graph are classified and mapped to the attack stages defined by the finite state machine, and the attack path of the power Internet of Things terminal is obtained to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

[0106] A second specific embodiment of the method for predicting attack paths of power IoT terminals of the present invention:

[0107] The method for predicting attack paths of power IoT terminals based on state machines and attack graphs includes the following steps:

[0108] Step 1: Use the pre-built vulnerability identification model to scan the power terminal equipment for vulnerabilities and collect vulnerability information related to the power system;

[0109] Step 2: Using the pre-built attack graph generation model, a Bayesian attack graph is established by analyzing the vulnerability information and its dependencies;

[0110] Step 3: Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases;

[0111] Step 4: Use the pre-built attack mapping model and the graph attention network to analyze the Bayesian attack graph, classify the attack behaviors in the Bayesian attack graph and map them to the attack stages defined by the finite state machine to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

[0112] A third specific embodiment of the method for predicting attack paths of power IoT terminals of the present invention:

[0113] A method for predicting attack paths of power IoT terminals is a method for evaluating the security status of power IoT terminals based on finite state machines and Bayesian attack graphs to solve the problem that existing security evaluation methods cannot effectively evaluate the security status of large-scale networks. It includes the following steps:

[0114] S1. Establish a Bayesian attack graph by deeply analyzing the resources, vulnerabilities and dependencies in the network system;

[0115] S2. Define a finite state machine according to different attack stages of the network attack, and map different attack stages to different states of the finite state machine;

[0116] S3. Based on the graph attention network, the Bayesian attack graph is deeply analyzed, the attack behaviors in the Bayesian attack graph are accurately classified and mapped to the specific attack stages defined by the finite state machine, and the data dimensionality reduction of the Bayesian attack graph is achieved, thereby simplifying the attack path.

[0117] Due to the large-scale and complex network environment, the attacks and attack paths faced by the power IoT terminal are more complex, making it difficult to quickly and effectively evaluate the security status of the terminal from a macro perspective. Therefore, this application uses a finite state machine and a Bayesian attack graph to predict and simplify the attack path, so that the network security status can be quickly evaluated based on the simplified attack path, thereby effectively reducing the complexity of predicting the attack path in a large-scale network environment.

[0118] In this embodiment, S1 specifically includes the steps of:

[0119] S11. Use automated scanning tools to scan the power IoT environment and identify all active power terminal devices and their open services and ports. These devices usually include smart meters, distribution automation equipment, and other control systems. Perform vulnerability scans on the identified power terminal devices, use automated vulnerability scanning tools to match them with the CVE database, and collect vulnerability information related to the power system.

[0120] S12. Define each power IoT terminal or service as a node. Compared with ordinary IT equipment, power terminals have higher security requirements and stricter real-time requirements. Node attributes include service type (such as power data collection, equipment control), security configuration, existing vulnerabilities and specific attack techniques and attack stages corresponding to the vulnerabilities. Each node uses Bernoulli random variables 0 and 1 to represent the current attribute state, where 1 indicates that the attacker has broken through to the node and 0 indicates that the attacker has not broken through. According to the Common Vulnerability Scoring System (CVSS), the probability of successful exploitation of a vulnerability Pr(e ij ), as the weight of the directed edge, so according to Pr(e ij ) and the attribute state of the node to calculate the conditional probability table of reaching each node, which represents the possibility of reaching the node from the previous node. For each node i, its conditional probability of reaching the compromised state is determined by the state of its direct predecessor node and the probability of vulnerability exploitation of the corresponding edge. The following conditional probability table (CPT) can be constructed:

[0121]

[0122] Among them, parents(i) are all the predecessor nodes of node i, S parents(i) is the attribute state set of all predecessor nodes of node i, Pr(e ji ) is the probability of vulnerability exploitation from node j to i, S j It is the attribute status of the predecessor node j of node i (the value is 1 or 0, representing breakthrough or non-breakthrough), so as to finally construct the Bayesian attack graph.

[0123] In this embodiment, S2 specifically includes the steps of:

[0124] S21. Based on the attack techniques and strategies described in the public knowledge base in the field of cybersecurity, the cyberattack process is decomposed into the following seven main stages: external network information collection, external network penetration, maintaining privileges, escalating privileges, internal network reconnaissance, lateral movement, and causing impact. Each stage is defined as an independent state in a finite state machine, and the transitions between these states represent the attacker's behavior pattern from one attack stage to another.

[0125] In this embodiment, S3 specifically includes the steps of:

[0126] S31. In order to construct the graph attention network, first, encode each node in the Bayesian attack graph, and use one-hot encoding to encode the node service type, security configuration, and the stage to which the attack belongs as a feature vector. For each node, the vector obtained by one-hot encoding the node service type is recorded as a1, the vector obtained by one-hot encoding the security configuration is recorded as a2, and the vector obtained by one-hot encoding the stage to which the attack belongs is recorded as a3. For example, if a node has three possible service types and two possible security configurations, and the vulnerability on the node belongs to one of the seven different attack stages, then the service type can be encoded to obtain the vector a1 = [1,0,0], the security configuration is encoded to obtain the vector a2 = [1,0], and the attack stage is encoded to obtain the vector a3 = [0,1,0,0,0,0,0]. In order to effectively capture the potential semantic relationship between the vulnerability and attack technology of the node, a custom neural network can be used to dynamically learn to map each vulnerability number and attack technology to a representation in a vector space, and finally each vulnerability number and attack technology will be converted into an embedded vector, which is recorded as a4. For example, a vulnerability number and its corresponding attack technique can be learned and mapped into a 10-dimensional embedding vector, i.e., a4 = [0.21, -0.34, 0.87, ..., 0.45]. i The eigenvector x i It is the concatenation of the one-hot encoding vector of the service type, security configuration, and attack stage with the embedding vector of the vulnerability number and attack technique, that is, x i =a1||a2||a3||a4, where || represents vector concatenation

[0127] Secondly, encode each edge in the Bayesian attack graph. Since each directed edge represents the probability of successful exploitation of a vulnerability from one node to another, the probability value is directly used as the feature encoding of the edge. For each edge (i, j), the feature of the edge is the vulnerability exploitation probability Pr(e ij ), representing node v i To node v j The transition probability.

[0128] Secondly, a multi-layer graph attention layer is used to process the input node features. The output dimension of each layer is uniformly set to m, and the output of each layer will be used as the input of the next layer. The graph attention layer updates the feature representation of the node by learning the mutual influence and importance between nodes. For each layer l, the node v is calculated i New feature representation

[0129]

[0130] in, is the feature representation of node j at layer l, is node v i The set of neighbor nodes, ReLU is the activation function, W (l) is the weight matrix of the lth layer, is the attention coefficient between nodes i and j, indicating the influence of node j on node i, and is calculated by the following formula:

[0131]

[0132] Among them, a is the parameter of the learned attention mechanism, LeakyReLU is the activation function, which is a variant of ReLU. It can keep more neurons in the network active, and ∥ represents vector concatenation. is node v i The feature representation of the neighbor node k at the lth layer, where is node v i The output of the last layer is used for classification tasks, using a linear transformation layer whose weight matrix is ​​m×7, that is, mapping the m-dimensional output of the last graph attention layer to 7 different categories. i Feature representation at the final layer of the graph attention layer Used to predict the attack phase it belongs to.

[0133]

[0134] y i is node v i The classification output of node v i The predicted probability of the seven attack stages, for example, for the seven attack stages, y i is a seven-dimensional vector, y i =[0.05,0.10,0.50,0.10,0.05,0.10,0.10], this vector represents the node v i The probability of belonging to the first attack stage is 5%, the probability of belonging to the second attack stage is 10%, and the probability of belonging to the third attack stage is 50%. Therefore, node v i The third attack stage is most likely to be output, and so on. The value of each dimension corresponds to the probability of a specific stage. The value of each dimension is a number between 0 and 1, indicating the probability that the node belongs to the corresponding attack stage. The sum of the values ​​of all dimensions is equal to 1. (out) and b out are the weights of the output layer respectively. The graph attention network is trained using the local dataset, and each node in the Bayesian attack graph is identified and classified according to the obtained model to obtain Class (v i ), which is the node v output by the graph attention networki The attack phase category to which it belongs.

[0135] S32. First, for the Bayesian attack graph G = (V, E), V is a set of nodes, E is a set of directed edges, Pr(e ij ) represents the slave node v i To node v j The probability of vulnerability exploitation.

[0136] Secondly, initialize the state diagram G′=(V′,E′), Where V′ is the simplified state set and E′ is the state transition set.

[0137] Secondly, traverse each node v in the Bayesian attack graph i ∈V, according to its Class(v i ) marks it as state s. If state s is not in V′, then add s to V′, where V′ is the state set of the initial state graph G′=(V′,E′).

[0138] For each edge (i, j)∈E in the Bayesian attack graph G, if Class(v i )≠Class(v j ), then add a state transition (Class(v i ),Class(v j )) to E′, that is, adding a directed edge to E′, E′ is a state transition set, which can be simply understood as a set of directed edges. It is called a state transition because G′ is the final finite state machine, and different states of the finite state machine are connected by directed edges, so it is called a state transition.

[0139] If Class(v i )=Class(v j ), merge repeated transitions and calculate the average transition probability:

[0140]

[0141] in, is the state i to j The set of all edges of .

[0142] State s is one of the seven attack stages, that is, G′ contains a total of seven states s, possibly multiple Class (v i) corresponds to the same state s, for example, Class(v1) = "external network penetration", Class(v2) = "external network penetration", Class(v3) = "maintain authority", obviously Class(v1) and Class(v2) belong to state s1, and Class(v3) belongs to state s2.

[0143] Finally, the simplified state graph G′=(V′,E′) is output, where each edge (s i ,s j )∈E′ with transition probability Pr(s i →s j ), the simplified state diagram G′ is a finite state machine, in which each state represents an attack stage, and the transition between states represents the possibility of going from one attack stage to another.

[0144] like Figure 2 As shown, the fourth specific embodiment of the method for predicting the attack path of the power IoT terminal of the present invention is as follows:

[0145] A method for predicting an attack path of a power IoT terminal comprises the following steps:

[0146] S1. Establish a Bayesian attack graph by deeply analyzing the resources, vulnerabilities and dependencies in the network system;

[0147] S2. Define a finite state machine according to different attack stages of the network attack, and map different attack stages to different states of the finite state machine;

[0148] S3. Based on the graph attention network, the Bayesian attack graph is deeply analyzed, the attack behaviors in the Bayesian attack graph are accurately classified and mapped to the specific attack stages defined by the finite state machine, and the data dimensionality reduction of the Bayesian attack graph is achieved, thereby simplifying the attack path.

[0149] The present invention combines a finite state machine with a Bayesian attack graph, processes the complex dependencies between nodes in the Bayesian attack graph through a graph attention network, classifies attack behaviors, and maps different attack behaviors to specific attack stages defined in the finite state machine, which can effectively reduce the complexity of attack paths in large-scale network environments.

[0150] The Bayesian attack graph is a probability-based graphical model used to represent and analyze potential attack paths in a given network environment. This graphical model can reflect the cause-and-effect relationships between different network components and describe these relationships through conditional probability tables. The Bayesian attack graph can provide the probability of attack success for each potential attack path in a quantitative way, thereby helping security analysts assess risk points and attack possibilities in the network. A finite state machine is an abstract computational model that simulates the behavior of a system through a series of states and transitions between these states. In the field of network security, finite state machines are used to represent different stages in the network attack process, where each state corresponds to a specific attack stage and the transitions between states represent the transition from one stage to another. This model can clearly describe the progress of the attack and assist security personnel in understanding the overall structure of the attack.

[0151] Each node in the Bayesian attack graph represents the properties of system components and the associated vulnerabilities. Each edge represents the probability that the vulnerability of the previous node is successfully exploited by the attacker. In a specific attack, a specific node often represents a vulnerability exploitation, corresponding to an attack technique, and several connected nodes constitute a specific attack stage. In a large-scale network environment, an attacker often completes a specific attack from start to finish, which often includes multiple stages, and each stage includes several attack techniques. Therefore, in order to simplify the representation of the Bayesian attack graph in a large-scale network environment, different attack stages are used to define specific states in the finite state machine, and a graph attention network is introduced to identify and classify each node in the Bayesian attack graph, mapping the node to a specific state in the finite state machine, thereby simplifying the attack path in a clear and structured way.

[0152] In this embodiment, S1 specifically includes the steps of:

[0153] S11. Use the automated scanning tool Nmap to scan the network and identify all active devices and their open services and ports. Perform vulnerability scans on the identified devices and services, and use the automated vulnerability scanning tool Nessus to match the CVE database and collect relevant vulnerability information.

[0154] S12. Define each device or service as a node, and define the node attributes as service type, security configuration, existing vulnerabilities, specific attack techniques corresponding to the vulnerabilities, and the attack stage to which the attack belongs. Each node uses Bernoulli random variables 0 and 1 to represent the current attribute state, where 1 indicates that the attacker has broken through to the node, and 0 indicates that the attacker has not broken through. According to the Common Vulnerability Scoring System (CVSS), the probability of a vulnerability being successfully exploited Pr(e ij ), as the weight of the directed edge, so according to Pr(e ij) and the attribute state of the node to calculate the conditional probability table of reaching each node, which represents the possibility of reaching the node from the previous node. For each node i, its conditional probability of reaching the compromised state is determined by the state of its direct predecessor node and the probability of vulnerability exploitation of the corresponding edge. The following conditional probability table (CPT) can be constructed:

[0155]

[0156] Among them, S parents(i) is the state set of all predecessor nodes of node i, Pr(e ji ) is the probability of vulnerability exploitation from node j to i, thus finally constructing the Bayesian attack graph.

[0157] In this embodiment, S2 specifically includes the steps of:

[0158] S21. Based on the attack techniques and strategies described in the public knowledge base in the field of cybersecurity, the cyberattack process is decomposed into the following seven main stages: external network information collection, external network penetration, maintaining privileges, escalating privileges, internal network reconnaissance, lateral movement, and causing impact. Each stage is defined as an independent state in a finite state machine, and the transitions between these states represent the attacker's behavior pattern from one attack stage to another.

[0159] In this embodiment, S3 specifically includes the steps of:

[0160] S31. In order to construct the graph attention network, first, encode each node in the Bayesian attack graph, and use one-hot encoding to encode the node service type, security configuration, and the stage to which the attack belongs into a feature vector. In order to effectively capture the potential semantic relationship between the vulnerabilities and attack techniques of the nodes, a custom neural network can be used to dynamically learn to map each vulnerability number and attack technique to a representation in a vector space, and finally each vulnerability number and attack technique will be converted into an embedded vector. Each node v i The eigenvector x i It is the concatenation of the one-hot encoding of the service type, security configuration, and attack stage with the embedding vector of the vulnerability number and attack technique.

[0161] Secondly, encode each edge in the Bayesian attack graph. Since each directed edge represents the probability of successful exploitation of a vulnerability from one node to another, the probability value is directly used as the feature encoding of the edge. For each edge (i, j), the feature of the edge is the vulnerability exploitation probability e ij , represents the node v i To node v j The transition probability.

[0162] Secondly, three layers of graph attention layers are used to process the input node features. The output dimension of each layer is uniformly set to 32, and the output of each layer will be used as the input of the next layer. The graph attention layer updates the feature representation of the node by learning the mutual influence and importance between nodes. For each layer l, the node v is calculated i New feature representation

[0163]

[0164] in, is the feature representation of node j at layer l, is node v i The set of neighbor nodes, ReLU is the activation function, W (l) is the weight matrix of the lth layer, is the attention coefficient between nodes i and j, indicating the influence of node j on node i, and is calculated by the following formula:

[0165]

[0166] Among them, a is the parameter of the learned attention mechanism, LeakyReLU is the activation function, and ∥ represents vector concatenation.

[0167] The output of the last layer is used for the classification task, using a linear transformation layer whose weight matrix is ​​32×7, that is, mapping the 32-dimensional output of the last graph attention layer to 7 categories. i Feature representation at the final layer of the graph attention layer Used to predict the attack phase it belongs to.

[0168]

[0169] y i is node v i The classification output, W (out) and b out are the weights of the output layer respectively.

[0170] The graph attention network is trained using the local dataset, and each node in the Bayesian attack graph is identified and classified according to the obtained model to obtain Class (v i ), which is the node v output by the graph attention network i The attack phase category to which it belongs.

[0171] S32. First, for the Bayesian attack graph G = (V, E), v is a set of nodes, E is a set of directed edges, Pr(e ij ) represents the slave node v i To node vj The probability of vulnerability exploitation.

[0172] Secondly, initialize the state diagram G′=(V′,E′), Where V′ is the simplified state set and E′ is the state transition set.

[0173] Secondly, traverse each node v in the Bayesian attack graph i ∈V, according to its Class(v i ) marks it as state s, and if state s is not in V′, add s to V′. For each edge (i,j)∈E, if Class(v i )≠Class(v j ), then add a conversion (Class(v i ),Class(v j )) to E′, if Class(v i )=Class(v j ), merge repeated transitions and calculate the average transition probability:

[0174]

[0175] in, is the state i to j The set of all edges of .

[0176] Finally, the simplified state graph G′=(V′,E′) is output, where each edge (s i ,s j )∈E′ with transition probability Pr(s1→s j ), the simplified state diagram G′ is a finite state machine, in which each state represents an attack stage, and the transition between states represents the possibility of going from one attack stage to another.

[0177] like Figure 3 As shown in the figure, node v0 to node v9 is an attack path in the Bayesian attack graph, and the directed edge Pr(e ij ) represents the slave node v i To node v j The probability of vulnerability exploitation. Traverse nodes v0 to v9, identify and classify each node according to the trained graph attention network model to obtain Class (v i ). Then, initialize the state diagram G′=(V′,E′), Where V' is the simplified state set, and E' is the state transition set. Traverse node v0 to node v p , according to its Class(vi ) marks it as state s, and if state s is not in V′, add s to V′. For example, for nodes v0, v1, and v2, according to the attack stage Class (v i ), mark it as state s0, that is, nodes v0, v1, and v2 belong to the s0 external network information collection stage. Similarly, traverse nodes v3 to v9 and process them to obtain the simplified state graph G′, which is a finite state machine.

[0178] The simplified attack graph finally output in this embodiment is a finite state machine, which reflects the attacker's transitions between different attack stages during a specific attack and the corresponding transition probabilities. In a large-scale network environment, it can effectively reduce the complexity of the attack path and depict each stage of the attack process in a clear and structured manner.

[0179] Furthermore, in some scenarios (such as power terminals), it is necessary to respond and evaluate attacks quickly. If the attack path and the probability of attack success are calculated very accurately, this process will inevitably consume time, and the final attack path is also very complex, which is not conducive to the rapid evaluation of the network security status. Although the prediction method of the present invention performs probability averaging, the average probability obtained is the average of the probabilities of all successful attacks, which can fully reflect the transition between different attack stages.

[0180] An embodiment of a device applying the method of the present invention:

[0181] An electronic device comprising:

[0182] one or more processors;

[0183] A storage device for storing one or more programs;

[0184] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned power Internet of Things terminal attack path prediction method based on the state machine and the attack graph.

[0185] A computer medium embodiment using the method of the present invention:

[0186] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned power Internet of Things terminal attack path prediction method based on a state machine and an attack graph.

[0187] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, and computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.

[0188] The present application is described by flowcharts or / and block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each process or / and block in the flowchart or / and block diagram and the combination of the processes or / and blocks in the flowchart or / and block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart or / and block diagram. Figure 1 Process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0189] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 Process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0190] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0191] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field can still modify or replace the specific implementation methods of the present invention with equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for predicting attack paths of power IoT terminals based on state machines and attack graphs, characterized in that: Includes the following: Through the pre-built vulnerability identification model, the power terminal equipment is scanned for vulnerabilities and the vulnerability information related to the power system is collected; Using the pre-built attack graph generation model, vulnerability information and its dependencies are analyzed to build a Bayesian attack graph; Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases; Using the pre-built attack mapping model and the graph attention network, the attack behaviors in the Bayesian attack graph are classified and mapped to the attack stages defined by the finite state machine, and the attack path of the power Internet of Things terminal is obtained to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

2. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 1, characterized in that: The method of scanning the power terminal equipment for vulnerabilities and collecting vulnerability information related to the power system through the pre-built vulnerability identification model is as follows: Use scanning tools to scan the power IoT environment and identify all active power terminal devices and their open services and ports. Power terminal devices include at least smart meters, distribution automation equipment, and corresponding control systems. Use vulnerability scanning tools to scan the identified power terminal equipment for vulnerabilities and obtain scanning data; Match the scan data with the CVE database to collect vulnerability information related to the power system.

3. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 1, characterized in that: Using the pre-built attack graph generation model, the vulnerability information and its dependencies are analyzed and the method of building a Bayesian attack graph is as follows: Each power IoT terminal is set as a node; the attributes of the node include service type, security configuration, existing vulnerabilities, and specific attack techniques and attack stages corresponding to the vulnerabilities; service types include power data collection and equipment control; Bernoulli random variables 0 and 1 are used to represent the current attribute status of the node, where 1 means that the attacker has broken into the node, and 0 means that the attacker has not broken into the node; According to the Common Vulnerability Scoring System (CVSS), the probability of successful exploitation of a vulnerability is Pr(e ij ), as the weight of the directed edge, so according to Pr(e ij ) and the attribute status of the node to calculate the conditional probability table of reaching each node, which represents the possibility of reaching the node from the previous node; For each node i, the conditional probability of reaching the compromised state is determined by the state of its direct predecessor node and the probability of vulnerability exploitation of the corresponding edge. The calculation formula of the conditional probability is as follows: Among them, parents(i) are all the predecessor nodes of node i, S parents(i) is the attribute state set of all predecessor nodes of node i, Pr(e ji ) is the probability of vulnerability exploitation from node j to i, S j is the attribute status of node j, the predecessor of node i, and takes the value of 1 or 0, representing breach or non-breach; According to the conditional probability of each node, a Bayesian attack graph is constructed.

4. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 1, characterized in that: Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined, and the method of obtaining several attack phases is as follows: According to the attack techniques and strategies described in the public knowledge base in the field of network security, the network attack process is broken down into several attack stages; the several attack stages at least include external network information collection, external network penetration, maintaining authority, escalating authority, internal network reconnaissance, lateral movement and causing impact; Based on the finite state machine, each attack stage is defined as an independent state in the finite state machine, and the transitions between these independent states represent the behavior pattern of the attacker transitioning from one attack stage to another.

5. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 1, characterized in that: Using the pre-built attack mapping model and the graph attention network, the attack behaviors in the Bayesian attack graph are classified and mapped to the attack stages defined by the finite state machine. The method for obtaining the attack path of the power IoT terminal is as follows: Construct a graph attention network to identify and classify each node in the Bayesian attack graph and obtain node v i The attack phase category to which it belongs; According to the identified nodes and node v i The attack phase category belongs to, and a Bayesian attack graph G = (V, E) is constructed, where V is a set of nodes and E is a set of directed edges; Based on the node set of the Bayesian attack graph, calculate the i To node v j The probability of vulnerability exploitation Pr(e ij ); Based on the directed edge set in the Bayesian attack graph and the vulnerability exploitation probability Pr(e ij ), calculate the average transition probability Pr(s i →s j ), which is calculated as follows: in, is the state i to j The set of all edges of ; According to the average transition probability Pr(s i →s j ), simplify the Bayesian attack graph to obtain an attack state machine, in which each state represents an attack stage, and the transition between states represents the possibility of going from one attack stage to another; According to the attack state machine, the attack path of the power Internet of Things terminal is determined.

6. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 5, characterized in that: Construct a graph attention network to identify and classify each node in the Bayesian attack graph and obtain node v i The methods belonging to the attack phase category are as follows: First, encode each node in the Bayesian attack graph and use one-hot encoding to encode the node service type, security configuration, and the stage to which the attack belongs into a feature vector; Secondly, encode each edge in the Bayesian attack graph; since each directed edge represents the probability of successful exploitation of a vulnerability from one node to another, the probability value is directly used as the feature encoding of the edge. For each edge (i, j), the feature of the edge is the vulnerability exploitation probability Pr(e ij ), representing node v i To node v j The transition probability of Thirdly, a multi-layer graph attention layer is used to process the input node features. The output dimension of each layer is uniformly set to m, and the output of each layer will be used as the input of the next layer. The graph attention layer updates the feature representation of the node by learning the mutual influence and importance between nodes. For each layer l, the node v is calculated i New feature representation The calculation formula is as follows: in, is the feature representation of node j at layer l, is node v i The set of neighbor nodes, ReLU is the activation function, W (l) is the weight matrix of the lth layer, is the attention coefficient between nodes i and j, indicating the influence of node j on node i, and is calculated by the following formula: Among them, a is the parameter of the learned attention mechanism, LeakyReLU is the activation function, which is a variant of ReLU. It can keep more neurons in the network active, and ∥ represents vector concatenation. is node v i The feature representation of the neighbor node k at the lth layer, where is node v i The output of the last layer is used for classification tasks, and a linear transformation layer is used, whose weight matrix is ​​m×7, that is, the m-dimensional output of the last graph attention layer is mapped to 7 different categories; the node v i Feature representation at the final layer of the graph attention layer Used to predict the attack phase it belongs to; Node v i The expression of the classification output is as follows: Among them, y i is node b i The classification output of node b i The predicted probability of the seven attack stages; W (out) and b out are the weights of the output layer respectively; For the seven attack stages, y i is a seven-dimensional vector, which is expressed as follows: y i ＝[0.05,0.10,0.50,0.10,0.05,0.10,0.10]， When node v i When the probability of belonging to the first attack stage is 5%, the probability of belonging to the second attack stage is 10%, and the probability of belonging to the third attack stage is 50%, node v i Output the third attack stage, and so on. The value of each dimension corresponds to the probability of a specific stage. The value of each dimension is a number between 0 and 1, indicating the probability that the node belongs to the corresponding attack stage. The sum of the values ​​of all dimensions is equal to 1. The graph attention network is trained using the local dataset, and each node in the Bayesian attack graph is identified and classified according to the obtained model to obtain the node v i The attack stage category Class (v i ).

7. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 6, characterized in that: The method for encoding each node in the Bayesian attack graph is as follows: For each node, the vector obtained by one-hot encoding the node service type is recorded as a1, the vector obtained by one-hot encoding the security configuration is recorded as a2, and the vector obtained by one-hot encoding the stage to which the attack belongs is recorded as a3; When a node has three service types and two security configurations, and the vulnerability on the node belongs to one of the seven different attack stages, the service type is encoded as a vector a1 = [1,0,0], the security configuration is encoded as a vector a2 = [1,0], and the attack stage is encoded as a vector a3 = [0,1,0,0,0,0,0]; In order to effectively capture the potential semantic relationship between the vulnerabilities and attack techniques existing in the nodes, a neural network is used to dynamically learn to map each vulnerability number and attack technique to a representation in a vector space. Finally, each vulnerability number and attack technique is converted into an embedded vector, which is denoted as a4. When a vulnerability number and the corresponding attack technique are learned and mapped into a 10-dimensional embedding vector, i.e., a4 = [0.21, -0.34, 0.87, ..., 0.45]; each node v i The eigenvector x i It is the concatenation of the one-hot encoding vector of the service type, security configuration, and attack stage with the embedding vector of the vulnerability number and attack technique, that is, x i =a1||a2||a3||a4, where || represents vector concatenation.

8. The method for predicting attack paths of power IoT terminals based on a state machine and an attack graph as claimed in claim 7, characterized in that: The method of simplifying the Bayesian attack graph and obtaining the attack state machine is as follows: First, according to the Bayesian attack graph, set the initial state graph G′=(V′,E′), Where V′ is the simplified state set, and E′ is the state transition set; Secondly, traverse each node v in the Bayesian attack graph i ∈V, according to its attack stage category Class(v i ) Mark it as state s, if state s is not in V′, add s to V′; For each edge (i, j)∈E in the Bayesian attack graph G, if Class(v i )≠Class(v j ), then add a state transition (Class(v i ),Class(v j )) to E′, if Class(v i )=Class(v j ), merge repeated transitions and calculate the average transition probability: in, is the state i to j The set of all edges of ; Finally, the Bayesian attack graph is simplified to obtain the state graph G′=(V′,E′). The state graph G′ is a finite state machine, namely, the attack state machine.

9. A method for predicting attack paths of power IoT terminals based on state machines and attack graphs, characterized in that: The following steps are involved: Step 1: Use the pre-built vulnerability identification model to scan the power terminal equipment for vulnerabilities and collect vulnerability information related to the power system; Step 2: Using the pre-built attack graph generation model, a Bayesian attack graph is established by analyzing the vulnerability information and its dependencies; Step 3: Using the pre-built attack partitioning model, based on the finite state machine, the attack phases of the network attack are decomposed and defined to obtain several attack phases; Step 4: Use the pre-built attack mapping model and the graph attention network to analyze the Bayesian attack graph, classify the attack behaviors in the Bayesian attack graph and map them to the attack stages defined by the finite state machine to achieve data dimensionality reduction of the Bayesian attack graph and simplification of the attack path.

10. The power IoT terminal attack path prediction system based on state machine and attack graph is characterized by: It includes: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the power Internet of Things terminal attack path prediction method based on the state machine and attack graph as described in any one of claims 1-9.

Images