Internet security service system for intelligent control

Abstract

The invention discloses an internet security service system for intelligent control, which applies an internet security service method for intelligent control, and the method comprises the following steps: step 1, carrying out information security risk assessment on an industrial host end and a structure terminal in an industrial control system; 2, establishing a safety risk springboard model, and analyzing safety risk influence targets of risk factors of an industrial host side on control equipment, production equipment and a process terminal; 3, the safety risk springboard model calculates safety risk influence coefficients of the control equipment, the production equipment and the structural terminals of the process layer according to the obtained vulnerability and importance weight; and step 4, based on the calculation results of the safety risk influence target and the safety risk influence coefficient, performing real-time safety risk abnormity monitoring on the industrial control system by using the safety risk springboard model, and the method has the characteristics of improving the safety risk prediction analysis capability in the system and actively preventing and controlling the generated risk trend.

Description

Technical Field

[0001] The present invention relates to the technical field of network security services, and in particular to an Internet security service system for intelligent control. Background Art

[0002] Industrial enterprises use targeted process monitoring components and automation components to monitor and control production processes in real time and conduct real-time data control. In actual commercial competition, some industrial enterprise opponents attack industrial hosts including operator stations, engineer stations, OPC interface machines, and historical servers for the purpose of stealing industrial production data, and then use the industrial hosts as springboards to attack control equipment, production equipment, processes, etc. Based on this technical indirect attack on industrial hosts, it is much easier than directly attacking control equipment, and is more often used in actual attacks. The existing security service system is more focused on the security control of equipment and process ends that generate security attacks in the system, but the actual security effect is low, and the existing attack security issues are still uncontrollable, resulting in poor security service effects and a significant increase in the cost of security services. Therefore, it is necessary to design an Internet security service system for intelligent control that improves the system's security risk prediction and analysis capabilities and proactively prevents and controls the risk trends generated. Summary of the invention

[0003] The purpose of the present invention is to provide an Internet security service system for intelligent control to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: an Internet security service method for intelligent control, comprising the following steps:

[0005] Step 1: Conduct information security risk assessment on the industrial host end of the industrial control system, including the operator station, engineer station, OPC interface machine, historical server, and the structural terminals including control equipment, production equipment, and process layer;

[0006] Step 2: Establish a security risk springboard model to analyze the impact of industrial host-side risk factors on the security risks of control equipment, production equipment, and process terminals;

[0007] Step 3: The security risk springboard model calculates the security risk impact coefficients of the control equipment, production equipment, and each structural terminal of the process layer based on the obtained vulnerability and importance weights;

[0008] Step 4: Based on the calculation results of the security risk impact target and the security risk impact coefficient, use the security risk springboard model to conduct real-time security risk anomaly monitoring of the industrial control system.

[0009] According to the above technical solution, the steps of conducting information security risk assessment include:

[0010] Obtain a list of equipment in the industrial host end, including operator stations, engineer stations, OPC interface machines, historical servers, and structural terminals including control equipment, production equipment, and process layers; determine the scope of security risk assessment based on security requirements; analyze the topological structure of each industrial host end and structural terminal; perform vulnerability Q detection on the security line of each device terminal; and then for each detected vulnerability, obtain the frequency value N of security risk on the industrial host end of the operator station, engineer station, OPC interface machine, historical server, and each service end in the structural terminals related to the control equipment, production equipment, and process layer according to the existing security protection measures for different equipment types.

[0011] According to the above technical solution, the step of further evaluating the frequency value and vulnerability of the security risk includes:

[0012] Construct a security risk frequency dataset N = {N1, N2, N3, ...T n}, where n represents the number of devices with identified device vulnerabilities in the industrial control system. Vulnerability Q exists in each server end of the industrial control system. Vulnerability Q includes technical vulnerability and management vulnerability. Vulnerability identification is carried out from two categories: technical and management. The vulnerability severity T is set according to historical data. A qualitative method is used to describe the severity of device vulnerabilities at the industrial host end, including operator stations, engineer stations, OPC interface machines, and historical servers. A vulnerability severity dataset T = {T1, T2, T3, …T n}, where n represents the number of devices with identified device vulnerabilities in the industrial control system, according to the frequency set of security risks existing on each server, N = {N1, N2, N3, ...T n} and the vulnerability severity dataset T = {T1, T2, T3, ...T n Establish a fuzzy mapping function f: N→f(T), where f(T) is the set of fuzzy sets on the vulnerability severity data set. The mapping f represents the support degree of risk factor N for vulnerability identification in the vulnerability severity data set. According to the frequency of occurrence and vulnerability of security risk factors in the industrial host, the possibility of security incidents caused by threats exploiting vulnerabilities is calculated, that is, the possibility of security incidents = (frequency of security risk occurrence, difficulty of vulnerability exploitation). The possibility of security risks is obtained based on the severity of vulnerabilities and the frequency of risk occurrence.

[0013] According to the above technical solution, the steps of establishing a security risk springboard model and analyzing the impact of industrial host-side risk factors on the security risk of control equipment, production equipment, and process terminals include:

[0014] According to the risk factors of the industrial master end of the industrial control system x i Corresponding influencing target elements y based on control equipment, production equipment, and process terminals i , determine the relationship between the various security risk influencing elements, establish a security risk springboard model for industrial control systems, and use empirical parameters to analyze the risk factors x1, x2, x3…, x n Perform fuzzy judgment and obtain the fuzzy judgment matrix of industrial main-end risk factors: Set the risk factors x1, x2, x3…, x n The numerical scale of the relationship between them is k1, k2, and k3, that is, when the two risk factors x1 and x2 at the industrial master end are compared, if the fuzzy ratio is k1, it means that the two risk factors x1 and x2 at the industrial master end will have the same risk impact on the target element at the other end of the safety risk springboard model. If the fuzzy ratio is k2, it means that the two risk factors x1 and x2 at the industrial master end have a greater risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. On the contrary, if the fuzzy ratio is k3, it means that the two risk factors x1 and x2 at the industrial master end have a smaller risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. The risk factor x1 at the industrial master end is measured by the numerical scale of the impact relationship. i Impact on target elements based on control equipment, production equipment, and process terminals i The importance of the risk factor x i The numerical scales of the relationship obtained after comparison are k1, k2, and k3, which correspond to the target elements y that affect the control equipment, production equipment, and process terminal, respectively. i The security risk impact importance weights are m1, m2, and m3.

[0015] According to the above technical solution, the step of calculating the safety risk impact coefficient of each structural terminal of the control equipment, production equipment and process layer includes:

[0016] In the safety risk springboard model, the risk factors of the industrial main end are x i It is known as a quantitative influencing factor, but its impact on control equipment, production equipment, and process terminal target element y i The specific impact targets and quantities are unknown. Based on the severity of vulnerability T and the risk factors x of the main industry end, i The numerical scales of the relationship obtained after comparison are k1, k2, and k3, which correspond to the target elements y that affect the control equipment, production equipment, and process terminal, respectively. iThe importance weights of the security risk impact are m1, m2, and m3. The security risk impact coefficient W of each structural layer in the industrial control system is calculated. Where T i The risk factors existing in the equipment layer of the industrial master end, including the operator station, engineer station, OPC interface machine, and historical server i Corresponding vulnerability severity level, m i It is the importance weight value of the security risk impact. The security risk impact coefficient of each risk factor of the industrial host end on each structural layer is calculated through the importance weight value and the vulnerability severity level. Then the security risk value of the entire industrial control system is calculated according to the risk impact coefficient of a single device. Based on the security risk springboard model, the risk springboard factor of the industrial control system from the industrial host end to the structural terminal, as well as the importance weight of the risk factor and the equipment vulnerability of the industrial host end and the structural terminal itself facing security risks are obtained to determine the security risk level of the entire industrial control system.

[0017] According to the above technical solution, the step of performing real-time security risk anomaly monitoring includes:

[0018] Through the operation mechanism of the industrial host terminal and the structural terminal in the security springboard model of the industrial control system, according to the process knowledge of the system, the system's security risk monitoring path is divided, and the security risk behavior generated by the equipment in the two terminals of the industrial control system is quantitatively described. For each security risk monitoring path, two security risk anomaly monitoring indicators, namely the security risk error and the trend consistency generated by the terminal equipment in the security springboard model, are established. According to the set monitoring indicators, the real-time security risks in the operation of the industrial control system equipment are predicted and the actual state is measured. The parameters and hardware status of the industrial host terminal in the security springboard model during operation are analyzed to see if there are risk anomalies. When it is judged that there are anomalies, the attack device of the industrial host terminal in the security springboard model on the structural terminal of the industrial control system is predicted according to the risk generation trend. According to the prediction results, targeted control strategies are used to track and suppress the risk trajectory in advance.

[0019] According to the above technical solution, the Internet security service system for intelligent control includes:

[0020] Security risk assessment module, used to conduct information security risk assessment on industrial host terminals and structural terminals in industrial control systems;

[0021] The security risk springboard model module is used to analyze the security risks of industrial control systems using the security risk springboard model;

[0022] The risk anomaly monitoring and control module is used to perform real-time security risk anomaly monitoring of the industrial control system using the security risk springboard model.

[0023] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention establishes a security risk springboard model, based on the risk factors x of the industrial master end of the industrial control system i Corresponding influencing target elements y based on control equipment, production equipment, and process terminals i , determine the relationship between each security risk influencing element, analyze the security risk impact targets of industrial host-side risk factors on control equipment, production equipment, and process terminals, and then calculate the security risk impact coefficients of control equipment, production equipment, and each structural terminal of the process layer based on the obtained vulnerability and importance weights, thereby improving the predictive analysis capabilities of security risks in existing industrial control systems and the ability to actively prevent and control security risk trends based on the generated security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0025] Figure 1 A flowchart of an Internet security service method for intelligent control provided in Embodiment 1 of the present invention;

[0026] Figure 2 A schematic diagram of the module composition of an Internet security service system for intelligent control provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Embodiment 1: Figure 1 This is a flow chart of an Internet security service method for intelligent control provided by Embodiment 1 of the present invention. This embodiment can be applied to the scenario of network security assessment control. This method can be executed by an Internet security service system for intelligent control provided by this embodiment. Figure 1 As shown, the method specifically comprises the following steps:

[0029] Step 1: Conduct information security risk assessment on the industrial host end of the industrial control system, including the operator station, engineer station, OPC interface machine, historical server, and the structural terminals including control equipment, production equipment, and process layer;

[0030] In an embodiment of the present invention, a device list including an operator station, an engineer station, an OPC interface machine, a history server, and a control device, a production device, and a structure terminal of a process layer is obtained from an industrial host terminal, the scope of a security risk assessment is determined based on security requirements, the topological structure of each industrial host terminal and the structure terminal is analyzed, and the vulnerability Q of the security line of each device terminal is detected. Then, for each detected vulnerability, according to existing security protection measures for different types of equipment, the frequency value N of the security risk occurrence existing in the industrial host terminal of the operator station, the engineer station, the OPC interface machine, the history server, and each service end in the structure terminal related to the control device, the production device, and the process layer is obtained;

[0031] For example, a security risk occurrence frequency dataset N={N1, N2, N3, ...T n}, where n represents the number of devices with identified device vulnerabilities in the industrial control system. Vulnerability Q exists in each server end of the industrial control system. Vulnerability Q includes technical vulnerability and management vulnerability. Vulnerability identification is carried out from two categories: technical and management. The vulnerability severity T is set according to historical data. A qualitative method is used to describe the severity of device vulnerabilities at the industrial host end, including operator stations, engineer stations, OPC interface machines, and historical servers. A vulnerability severity dataset T = {T1, T2, T3, …T n}, where n represents the number of devices with identified device vulnerabilities in the industrial control system, according to the frequency set of security risks existing on each server, N = {N1, N2, N3, ...T n} and the vulnerability severity dataset T = {T1, T2, T3, ...T n Establish a fuzzy mapping function f: N→f(T), where f(T) is the set of fuzzy sets on the vulnerability severity data set. The mapping f represents the support degree of risk factor N for vulnerability identification in the vulnerability severity data set. According to the frequency of occurrence and vulnerability of security risk factors in the industrial host, the possibility of security incidents caused by threats exploiting vulnerabilities is calculated, that is, the possibility of security incidents = (frequency of security risk occurrence, difficulty of vulnerability exploitation). According to the severity of the vulnerability and the frequency of risk occurrence, the possibility of security risk occurrence is obtained.

[0032] For example, determine whether the corresponding security risks can be discovered and defended through daily security monitoring. When they are unacceptable, determine the corresponding vulnerabilities. When they can be defended, establish a security baseline list. Through security risk assessment, discover security defects in the business processes of the industrial control system. Provide different security risk assessment services for different equipment layers and structural layers of the industrial control system, detect server security, application security, and evaluate the security status.

[0033] Step 2: Establish a security risk springboard model to analyze the impact of industrial host-side risk factors on the security risks of control equipment, production equipment, and process terminals;

[0034] In the embodiment of the present invention, according to the risk factor x of the industrial master end of the industrial control system i Corresponding influencing target elements y based on control equipment, production equipment, and process terminals i , determine the relationship between the various security risk influencing elements, establish a security risk springboard model for industrial control systems, and use empirical parameters to analyze the risk factors x1, x2, x3…, x n Perform fuzzy judgment and obtain the fuzzy judgment matrix of industrial main-end risk factors: Set the risk factors x1, x2, x3…, x n The numerical scale of the relationship between them is k1, k2, and k3, that is, when the two risk factors x1 and x2 at the industrial master end are compared, if the fuzzy ratio is k1, it means that the two risk factors x1 and x2 at the industrial master end will have the same risk impact on the target element at the other end of the safety risk springboard model. If the fuzzy ratio is k2, it means that the two risk factors x1 and x2 at the industrial master end have a greater risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. On the contrary, if the fuzzy ratio is k3, it means that the two risk factors x1 and x2 at the industrial master end have a smaller risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. The risk factor x1 at the industrial master end is measured by the numerical scale of the impact relationship. i Impact on target elements based on control equipment, production equipment, and process terminals i The importance of the risk factor x i The numerical scales of the relationship obtained after comparison are k1, k2, and k3, which correspond to the target elements y that affect the control equipment, production equipment, and process terminal, respectively. i The security risk impact importance weights are m1, m2, and m3.

[0035] Step 3: The security risk springboard model calculates the security risk impact coefficients of the control equipment, production equipment, and each structural terminal of the process layer based on the obtained vulnerability and importance weights;

[0036] In the embodiment of the present invention, in the security risk springboard model, the risk factor x of the industrial host end i It is known as a quantitative influencing factor, but its impact on control equipment, production equipment, and process terminal target element y i The specific impact targets and quantities are unknown. Based on the severity of vulnerability T and the risk factors x of the main industry end, iThe numerical scales of the relationship obtained after comparison are k1, k2, and k3, which correspond to the target elements y that affect the control equipment, production equipment, and process terminal, respectively. i The importance weights of the security risk impact are m1, m2, and m3. The security risk impact coefficient W of each structural layer in the industrial control system is calculated.

[0037] Where T i The risk factors existing in the equipment layer of the industrial master end, including the operator station, engineer station, OPC interface machine, and historical server i Corresponding vulnerability severity level, m i It is the importance weight value of the security risk impact. The security risk impact coefficient of each risk factor of the industrial host end on each structural layer is calculated through the importance weight value and the vulnerability severity level. Then the security risk value of the entire industrial control system is calculated according to the risk impact coefficient of a single device. Based on the security risk springboard model, the risk springboard factor of the industrial control system from the industrial host end to the structural terminal, as well as the importance weight of the risk factor and the equipment vulnerability of the industrial host end and the structural terminal itself facing security risks are obtained to determine the security risk level of the entire industrial control system.

[0038] Step 4: Based on the calculation results of the security risk impact target and the security risk impact coefficient, use the security risk springboard model to conduct real-time security risk anomaly monitoring of the industrial control system;

[0039] In an embodiment of the present invention, by analyzing the operating mechanisms of the industrial host terminal and the structural terminal in the security springboard model of the industrial control system, according to the process knowledge of the system, the security risk monitoring path of the system is divided, and the security risk behavior generated by the equipment in the two terminals of the industrial control system is quantitatively described. For each security risk monitoring path, two security risk abnormality monitoring indicators, namely the security risk error and the generation trend consistency generated by the terminal equipment in the security springboard model, are established. According to the set monitoring indicators, the state prediction and actual state measurement of the real-time security risks in the operation of the industrial control system equipment are performed, and the parameters and hardware status of the industrial host terminal in the security springboard model during operation are analyzed to see if there are risk abnormalities. When it is judged that there is an abnormality, the attack device of the industrial host terminal in the security springboard model on the structural terminal of the industrial control system is predicted according to the risk generation trend, and the risk trajectory is tracked and suppressed in advance according to the prediction results using targeted control strategies.

[0040] Embodiment 2: Embodiment 2 of the present invention provides an Internet security service system for intelligent control. Figure 2 A schematic diagram of the module composition of an Internet security service system for intelligent control provided in Embodiment 2 of the present invention is shown in FIG. Figure 2 As shown, the system includes:

[0041] Security risk assessment module, used to conduct information security risk assessment on industrial host terminals and structural terminals in industrial control systems;

[0042] The security risk springboard model module is used to analyze the security risks of industrial control systems using the security risk springboard model;

[0043] The risk anomaly monitoring and control module is used to perform real-time security risk anomaly monitoring of the industrial control system using the security risk springboard model.

[0044] In some embodiments of the present invention, the security risk assessment module includes:

[0045] Industrial host terminal, used to obtain security risk information related to the industrial host side including operator station, engineer station, OPC interface machine, and history server;

[0046] Structural terminals are used to obtain security risk information of structural terminals including control equipment, production equipment, and process layers;

[0047] A security risk frequency value calculation module is used to calculate the frequency value of security risks existing in each server end of the industrial host end and the structural terminal in the industrial control system;

[0048] Vulnerability severity module, used to construct vulnerability severity dataset.

[0049] In some embodiments of the present invention, the security risk springboard model module includes:

[0050] A security risk springboard model building module is used to build a security risk springboard model;

[0051] The safety risk impact target module is used to analyze the safety risk impact targets of industrial host-side risk factors on control equipment, production equipment, and process terminals;

[0052] A fuzzy judgment matrix module is used to perform fuzzy judgment to obtain a fuzzy judgment matrix of industrial main-end risk factors;

[0053] The safety risk impact importance weight module is used to calculate the safety risk impact importance weight of the target element affecting the control equipment, production equipment, and process terminal corresponding to the relationship numerical scale.

[0054] In some embodiments of the present invention, the risk anomaly monitoring control module includes:

[0055] The safety risk impact coefficient calculation module is used to calculate the safety risk impact coefficients of control equipment, production equipment, and various structural terminals of the process layer;

[0056] Security risk level determination module, used to determine the security risk level of the entire industrial control system;

[0057] The safety risk anomaly monitoring module is used to predict the status and monitor the actual status of real-time safety risks in the operation of industrial control system equipment according to the set monitoring indicators.

[0058] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0059] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An Internet security service method for intelligent control, characterized in that: The method comprises the following steps: Step 1: Conduct information security risk assessment on the industrial host end of the industrial control system, including the operator station, engineer station, OPC interface machine, historical server, and the structural terminals including control equipment, production equipment, and process layer; Step 2: Establish a security risk springboard model to analyze the impact of industrial host-side risk factors on the security risks of control equipment, production equipment, and process terminals; Step 3: The security risk springboard model calculates the security risk impact coefficients of the control equipment, production equipment, and each structural terminal of the process layer based on the obtained vulnerability and importance weights; Step 4: Based on the calculation results of the security risk impact target and the security risk impact coefficient, use the security risk springboard model to conduct real-time security risk anomaly monitoring of the industrial control system; The steps of conducting information security risk assessment include: Obtain a list of equipment in the industrial host end, including operator stations, engineer stations, OPC interface machines, history servers, and structural terminals including control equipment, production equipment, and process layers. Determine the scope of security risk assessment based on security requirements, analyze the topological structure of each industrial host end and structural terminal, and perform vulnerability Q detection on the security defense line of each device terminal. Then, for each detected vulnerability, obtain the frequency value N of security risk on the industrial host end of the operator station, engineer station, OPC interface machine, history server, and each service end in the structural terminals related to the control equipment, production equipment, and process layer according to the existing security protection measures of different equipment types. The step of further evaluating the frequency value and vulnerability of the security risk includes: Construct a security risk frequency dataset N = {N1, N2, N3, ...T n }, where n represents the number of devices with identified device vulnerabilities in the industrial control system. Vulnerability Q exists in each server end of the industrial control system. Vulnerability Q includes technical vulnerability and management vulnerability. Vulnerability identification is carried out from two categories: technical and management. The vulnerability severity T is set according to historical data. A qualitative method is used to describe the severity of device vulnerabilities at the industrial host end, including operator stations, engineer stations, OPC interface machines, and historical servers. A vulnerability severity dataset T = {T1, T2, T3, …T n }, where n represents the number of devices with identified device vulnerabilities in the industrial control system, according to the frequency set of security risks existing on each server, N = {N1, N2, N3, ...T n } and the vulnerability severity dataset T = {T1, T2, T3, ...T n Establish a fuzzy mapping function f:N→f(T), where f(T) is the set of fuzzy sets on the vulnerability severity dataset. The mapping f represents the support degree of risk factor N for vulnerability identification in the vulnerability severity dataset. According to the frequency of occurrence and vulnerability of security risk factors in the industrial host, the possibility of security incidents caused by threats exploiting vulnerabilities is calculated, that is, the possibility of security incidents = (frequency of security risk occurrence, difficulty of vulnerability exploitation). The possibility of security risk occurrence is obtained according to the severity of vulnerability and the frequency of risk occurrence. The steps of establishing a security risk springboard model and analyzing the impact of industrial host-side risk factors on the security risk of control equipment, production equipment, and process terminals include: According to the risk factors of the industrial master end of the industrial control system x i Corresponding influencing target elements y based on control equipment, production equipment, and process terminals i , determine the relationship between the various security risk influencing elements, establish a security risk springboard model for industrial control systems, and use empirical parameters to analyze the risk factors x1, x2, x3…, x n Perform fuzzy judgment and obtain the fuzzy judgment matrix of industrial main-end risk factors: Set the risk factors x1, x2, x3…, x n The numerical scale of the relationship between them is k1, k2, and k3, that is, when the two risk factors x1 and x2 at the industrial master end are compared, if the fuzzy ratio is k1, it means that the two risk factors x1 and x2 at the industrial master end will have the same risk impact on the target element at the other end of the safety risk springboard model. If the fuzzy ratio is k2, it means that the two risk factors x1 and x2 at the industrial master end have a greater risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. On the contrary, if the fuzzy ratio is k3, it means that the two risk factors x1 and x2 at the industrial master end have a smaller risk impact x1 than x2 on the target element at the other end of the safety risk springboard model. The risk factor x1 at the industrial master end is measured by the numerical scale of the impact relationship. i Impact on target elements based on control equipment, production equipment, and process terminals i The importance of the risk factor x i The numerical scales of the relationship obtained after comparison are k1, k2, and k3, which correspond to the target elements y that affect the control equipment, production equipment, and process terminal, respectively. i The safety risk impact importance weights are m1, m2, and m3; The step of performing real-time security risk anomaly monitoring includes: Through the operation mechanism of the industrial host terminal and the structural terminal in the security springboard model of the industrial control system, according to the process knowledge of the system, the system's security risk monitoring path is divided, and the security risk behavior generated by the equipment in the two terminals of the industrial control system is quantitatively described. For each security risk monitoring path, two security risk anomaly monitoring indicators, namely the security risk error and the trend consistency generated by the terminal equipment in the security springboard model, are established. According to the set monitoring indicators, the real-time security risks in the operation of the industrial control system equipment are predicted and the actual state is measured. The parameters and hardware status of the industrial host terminal in the security springboard model during operation are analyzed to see if there are risk anomalies. When it is judged that there are anomalies, the attack device of the industrial host terminal in the security springboard model on the structural terminal of the industrial control system is predicted according to the risk generation trend. According to the prediction results, targeted control strategies are used to track and suppress the risk trajectory in advance.

2. An Internet security service system for intelligent control that executes an Internet security service method for intelligent control as claimed in claim 1, characterized in that: The system comprises: Security risk assessment module, used to conduct information security risk assessment on industrial host terminals and structural terminals in industrial control systems; The security risk springboard model module is used to analyze the security risks of industrial control systems using the security risk springboard model; The risk anomaly monitoring and control module is used to perform real-time security risk anomaly monitoring of the industrial control system using the security risk springboard model.

3. The Internet security service system for intelligent control according to claim 2, characterized in that: The security risk assessment module includes: Industrial host terminal, used to obtain security risk information related to the industrial host side including operator station, engineer station, OPC interface machine, and history server; Structural terminals are used to obtain security risk information of structural terminals including control equipment, production equipment, and process layers; A security risk frequency value calculation module is used to calculate the frequency value of security risks existing in each server end of the industrial host end and the structural terminal in the industrial control system; Vulnerability severity module, used to construct vulnerability severity dataset.

4. The Internet security service system for intelligent control according to claim 3, characterized in that: The security risk springboard model module includes: A security risk springboard model building module is used to build a security risk springboard model; The safety risk impact target module is used to analyze the safety risk impact targets of industrial host-side risk factors on control equipment, production equipment, and process terminals; A fuzzy judgment matrix module is used to perform fuzzy judgment to obtain a fuzzy judgment matrix of industrial main-end risk factors; The safety risk impact importance weight module is used to calculate the safety risk impact importance weight of the target element affecting the control equipment, production equipment, and process terminal corresponding to the relationship numerical scale.

5. The Internet security service system for intelligent control according to claim 4, characterized in that: The risk abnormality monitoring control module includes: The safety risk impact coefficient calculation module is used to calculate the safety risk impact coefficients of control equipment, production equipment, and various structural terminals of the process layer; Security risk level determination module, used to determine the security risk level of the entire industrial control system; The safety risk anomaly monitoring module is used to predict the status and monitor the actual status of real-time safety risks in the operation of industrial control system equipment according to the set monitoring indicators.

Images