Vulnerability risk assessment method and device for oil and gas production industrial control system
By constructing industrial control vulnerability assessment indicators and attack graph models, the problem of insufficient accuracy of vulnerability risk assessment in the penetration of industrial control systems from the information domain to the physical domain is solved, and more accurate industrial control vulnerability risk assessment and timely refresh of risk status is achieved.
Patent Information
- Application Number
- CN202411697346.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-02-28
AI Technical Summary
Existing vulnerability assessment methods are difficult to accurately evaluate the vulnerability risks of industrial control systems penetrating from the information domain to the physical domain, resulting in insufficient accuracy in industrial control vulnerability risk assessment.
By determining the target to be evaluated and building industrial control vulnerability evaluation indicators, the total score of industrial control vulnerability is calculated, and the industrial control vulnerability risk probability value and dynamic risk probability value are determined based on the attack graph model.
It improves the accuracy of industrial control vulnerability risk assessment, helps security teams quickly identify and prioritize the most critical vulnerabilities, and formulates corresponding repair strategies to ensure the information security of industrial control systems.
Smart Images
Figure CN119538267A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of industrial control network security, and in particular to a method and device for vulnerability risk assessment of an oil and gas production industrial control system. Background Art
[0002] Industrial control systems play a key role in ensuring industrial production automation. With the continued advancement of digitalization and intelligentization, and amidst increasingly severe and complex cybersecurity challenges, control system cybersecurity risks are rising. Attacks against industrial control systems are often highly covert and unknown. Attackers exploit vulnerabilities in industrial control equipment, TCP / IP (Transmission Control Protocol / Internet Protocol) flaws, and industrial software vulnerabilities to construct increasingly subtle and unpredictable attack methods. Control system cyberattacks and physical device risks are evolving in tandem, with attacks that penetrate the cyber domain into the physical domain becoming a significant source of risk to production safety. Control strategies centered around functional safety face severe challenges, posing significant threats to equipment, property, and personnel safety. The challenge of integrated functional and cybersecurity industrial control vulnerability risk assessment is urgent.
[0003] Existing vulnerability assessment methods can be categorized as qualitative or quantitative based on their approach. Qualitative assessment methods use a tiered approach, typically categorized into four levels: critical, high, medium, and low. Quantitative assessment methods, such as the Weighted Impact Vulnerability Scoring System (WIVSS) and the Common Vulnerability Scoring System (CVSS), assign vulnerability scores within a specific range. These methods provide a numerical score for software vulnerabilities, measuring both the vulnerability's characteristics and its impact within a specific user environment, enabling a more accurate quantitative assessment of the vulnerability. However, existing vulnerability scoring methods focus specifically on confidentiality, integrity, and availability, and are applicable to information technology networks. They do not consider the evolution of vulnerability risks from the cyber domain to the physical domain. Therefore, they lack applicability in industrial control systems, where availability and integrity are prioritized, significantly impacting the accuracy of industrial control vulnerability risk assessments.
[0004] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the Invention
[0005] In view of this, the purpose of this invention is to provide a method and device for assessing vulnerability risks in oil and gas production industrial control systems. This method can improve the accuracy of industrial control vulnerability risk assessments by targeting highly covert attacks that penetrate from the information domain to the physical domain. The specific solution is as follows:
[0006] In a first aspect, the present application discloses a vulnerability risk assessment method for an oil and gas production industrial control system, comprising:
[0007] Determine a target to be evaluated, and construct an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine a total industrial control vulnerability score of the target to be evaluated based on the industrial control vulnerability evaluation index;
[0008] Constructing a corresponding attack graph model based on the system structure of the target to be evaluated and preset vulnerability risk information, and determining the industrial control vulnerability risk probability value of the target to be evaluated using the total industrial control vulnerability score based on the attack graph model;
[0009] Based on the attack graph model, according to the actual exploitation of the vulnerabilities of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined.
[0010] Optionally, constructing an industrial control vulnerability assessment index for the target to be assessed, so as to determine a total industrial control vulnerability score of the target to be assessed based on the industrial control vulnerability assessment index, includes:
[0011] Constructing an industrial control vulnerability assessment index for the target to be assessed, and determining an industrial control vulnerability basic score and an industrial control vulnerability environmental impact score of the target to be assessed based on a first index and a second index in the industrial control vulnerability assessment index;
[0012] The industrial control vulnerability basic score and the industrial control vulnerability environmental impact score are used to determine the total industrial control vulnerability score of the target to be evaluated.
[0013] Optionally, determining the industrial control vulnerability basic score of the target to be evaluated based on the first indicator among the industrial control vulnerability assessment indicators includes:
[0014] The basic severity score of the target to be evaluated is determined using a first preset calculation formula; the first preset calculation formula is: ; Wherein, BS is the basic severity score, EC is the event complexity index value, RC is the source credibility index value, BC is the consequence type index value of the vulnerability, and RL is the repair solution index value;
[0015] The basic availability score of the target to be evaluated is determined using a second preset calculation formula; the second preset calculation formula is: ; Wherein, BEX is the basic exploitability score, EC is the event complexity index value, EX is the vulnerability maturity index value, AU is the required authority level index value, and UI is the user interaction requirement index value;
[0016] Based on the basic severity score and the basic exploitability score, a third preset calculation formula is used to determine the basic industrial control vulnerability score of the target to be evaluated; the third preset calculation formula is: ; Among them, CN is the basic score of the industrial control vulnerability, and AV is the threat vector requirement index value.
[0017] Optionally, determining the industrial control vulnerability environmental impact score of the target to be evaluated based on a second indicator in the industrial control vulnerability assessment indicators includes:
[0018] The fourth preset calculation formula is used to determine the initial environmental impact score of the industrial control vulnerability of the target to be evaluated; the initial environmental impact score of the industrial control vulnerability includes: a local accessibility score, a process consequence score, and a system impact score; the fourth preset calculation formula includes: 、 ; Wherein, CON is the process consequence score, VI is the process visibility consequence index value, MI is the process monitoring consequence index value, CI is the process control consequence index value; IMP is the system impact score, CD is the financial loss impact index value, PI is the system generation impact index value, RI is the system reliability impact index value, and SI is the system safety impact index value;
[0019] Based on the initial industrial control vulnerability environmental impact score, a fifth preset calculation formula is used to determine the industrial control vulnerability environmental impact score of the target to be evaluated; the industrial control vulnerability environmental impact score includes an adjusted accessibility score and an adjusted system impact score; the fifth preset calculation formula includes: 、 ; Among them, ADJACC is the adjusted accessibility score, LA is the asset access index value, and ADJIMP is the adjusted system impact score.
[0020] Optionally, determining the total industrial control vulnerability score of the target to be evaluated by using the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score includes:
[0021] Based on the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score, a sixth preset calculation formula is used to determine the total industrial control vulnerability score of the target to be evaluated; the sixth preset calculation formula is: ; Among them, FS is the total industrial control vulnerability score of the target to be evaluated, CN is the basic score of the industrial control vulnerability, ADJIMP is the adjusted system impact score in the industrial control vulnerability environmental impact score, and ADJACC is the adjusted accessibility score in the industrial control vulnerability environmental impact score.
[0022] Optionally, constructing a corresponding attack graph model according to the system structure of the target to be evaluated and preset vulnerability risk information, and determining the industrial control vulnerability risk probability value of the target to be evaluated using the total industrial control vulnerability score based on the attack graph model includes:
[0023] Determining attack nodes according to the preset vulnerability risk information, and determining node relationships between the attack nodes according to the system structure of the target to be assessed and the preset vulnerability risk information;
[0024] Constructing an attack graph model of the target to be evaluated according to the attack nodes and the node relationships;
[0025] The total industrial control vulnerability score is used to determine a basic probability value for each attack node in the attack graph model, and based on the basic probability value and the node relationship in the attack graph model, the industrial control vulnerability risk probability value of the target to be evaluated is determined.
[0026] Optionally, based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, determining the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated includes:
[0027] Determining, in the attack graph model, a target attack node corresponding to when a vulnerability of the target to be evaluated is successfully exploited by an attacker in an industrial process;
[0028] Updating basic probability values of other attack nodes in the attack graph model according to the target attack node to determine updated probability values of the other attack nodes in the attack graph model;
[0029] Based on the updated probability value and according to the node relationship in the attack graph model, the industrial control vulnerability risk probability value of the target to be evaluated is determined using the industrial control vulnerability risk probability value.
[0030] In a second aspect, the present application discloses a vulnerability risk assessment device for an oil and gas production industrial control system, comprising:
[0031] A scoring determination module is used to determine a target to be evaluated and construct an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine the total industrial control vulnerability score of the target to be evaluated based on the industrial control vulnerability evaluation index;
[0032] a risk probability value determination module, configured to construct a corresponding attack graph model based on the system structure of the target to be evaluated and preset vulnerability risk information, and determine the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score;
[0033] A dynamic risk probability value determination module is used to determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value.
[0034] In a third aspect, the present application discloses an electronic device comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the oil and gas production industrial control system vulnerability risk assessment method as described above.
[0035] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned oil and gas production industrial control system vulnerability risk assessment method.
[0036] The present application provides a vulnerability risk assessment method for an oil and gas production industrial control system, comprising: determining a target to be assessed, and constructing an industrial control vulnerability assessment index for the target to be assessed, so as to determine the total industrial control vulnerability score of the target to be assessed based on the industrial control vulnerability assessment index; constructing a corresponding attack graph model based on the system structure and preset vulnerability risk information of the target to be assessed, and based on the attack graph model, determining the industrial control vulnerability risk probability value of the target to be assessed using the total industrial control vulnerability score; based on the attack graph model, determining the dynamic risk probability value of the industrial control vulnerability of the target to be assessed according to the actual exploitation of the vulnerabilities of the target to be assessed in the industrial process and using the industrial control vulnerability risk probability value.
[0037] The beneficial technical effect of the present application is as follows: combining the idea of the permissions required for exploiting vulnerabilities in industrial control systems, an industrial control vulnerability assessment index is constructed for the target to be assessed to evaluate the severity of vulnerabilities in the industrial control system. The total industrial control vulnerability score of the target to be assessed is calculated based on the industrial control vulnerability assessment index, so as to quantify the vulnerabilities in the industrial control system. In this way, it can help the security team quickly identify vulnerabilities and prioritize the most critical vulnerabilities, formulate corresponding repair strategies, and thus ensure the information security of the industrial control system. Furthermore, based on the system structure of the target to be assessed and the preset vulnerability risk information of the target to be assessed, an attack graph model from the attacker's perspective is constructed. Based on the attack graph model, the total industrial control vulnerability score is used for probability calculation to determine the industrial control vulnerability risk probability value of the target to be assessed; due to the different actual situations of different targets to be assessed, their risk levels will change dynamically. If a vulnerability in the industrial process of the target to be assessed is successfully exploited by an attacker, the reachability probability of each node in the attack graph model will change, and will affect the overall risk assessment. Therefore, based on the actual exploitation of vulnerabilities in the industrial process of the target to be evaluated, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined using the industrial control vulnerability risk probability value. This can ensure that once the results of the attack behavior are monitored, the system risk status of the target to be evaluated is immediately refreshed, thereby ensuring the timeliness of the risk assessment and improving the accuracy of the risk assessment.
[0038] In addition, the oil and gas production industrial control system vulnerability risk assessment device, equipment and storage medium provided in this application correspond to the above-mentioned oil and gas production industrial control system vulnerability risk assessment method, and the effect is the same as above. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0040] Figure 1 This is a flow chart of a vulnerability risk assessment method for oil and gas production industrial control systems disclosed in this application;
[0041] Figure 2 This is a schematic diagram of an industrial vulnerability scoring process disclosed in this application;
[0042] Figure 3 This is a schematic diagram of an attack graph model of an industrial control system disclosed in this application;
[0043] Figure 4 This is a schematic diagram of a vulnerability risk quantification process disclosed in this application.
[0044] Figure 5 This is a flowchart of a specific industrial control vulnerability risk assessment method disclosed in this application;
[0045] Figure 6 This is a schematic diagram of the structure of a vulnerability risk assessment device for an oil and gas production industrial control system disclosed in this application;
[0046] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION
[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0048] Existing vulnerability scoring methods focus specifically on confidentiality, integrity, and availability, and are applicable to information technology networks. They fail to consider the evolution of vulnerability risks from the cyber domain to the physical domain. Consequently, they lack applicability in industrial control systems, where availability and integrity are prioritized, severely impacting the accuracy of vulnerability risk assessments.
[0049] To this end, this application provides an oil and gas production industrial control system vulnerability risk assessment solution, which can improve the accuracy of industrial control vulnerability risk assessment in the case of highly concealed attacks on industrial control systems penetrating from the information domain to the physical domain.
[0050] The embodiment of the present invention discloses a method for assessing the vulnerability risk of an oil and gas production industrial control system. Figure 1 As shown in the figure, this method can be used to implement vulnerability risk assessment of the integrated functional and information security of industrial control systems in oil and gas production through the Industrial Vulnerability Scoring System (IVSS). The method includes:
[0051] Step S11: determining a target to be evaluated, and constructing an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine a total industrial control vulnerability score of the target to be evaluated according to the industrial control vulnerability evaluation index.
[0052] In this embodiment of the present application, an industrial control system requiring vulnerability risk assessment is selected as the target to be assessed. For the target to be assessed, based on the idea that vulnerabilities in industrial control systems are exploited through the use of required permissions, and based on basic industrial control vulnerability metrics and the scope of industrial control vulnerability impact, a set of industrial control vulnerability assessment indicators that can be applied to the industrial vulnerability scoring system is constructed to generate a vulnerability scoring table. Based on the vulnerability scoring table and the various industrial control vulnerability assessment indicators, the industrial control vulnerabilities present in the target to be assessed are scored to determine the target's total industrial control vulnerability score.
[0053] Step S12: constructing a corresponding attack graph model according to the system structure of the target to be evaluated and preset vulnerability risk information, and determining the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score.
[0054] In the embodiments of the present application, an attack graph model from the attacker's perspective is constructed by collecting information on potential industrial control vulnerability risks based on the system structure of the target to be evaluated. The attack graph model can show in detail the process by which an attacker achieves his ultimate goal through a series of steps, integrating the structures of a fault tree and an attack tree. Using the conditional probability method, the total industrial control vulnerability score is used to calculate the probability based on the dependencies between the nodes in the attack graph model, thereby determining the industrial control vulnerability risk probability value of the target to be evaluated.
[0055] It's important to note that when analyzing the probability of an attacker successfully exploiting a specific security vulnerability, a quantitative metric called "Vulnerability Value" is proposed. This metric determines the probability of each basic attack node in the attack graph model, accurately expressing the relative risk of each vulnerability being exploited. Specifically, this metric assesses the likelihood of successful exploitation using a numerical value derived from the Industrial Control Vulnerability Total Score (ICV). This value is a simplified calculated ICSVulnerability Total Score. By determining the probability of each basic attack node, the ICSVulnerability Risk Probability value for the target being assessed can be further determined.
[0056] Step S13: Based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated.
[0057] In the embodiment of the present application, the risk level will change according to the different actual conditions of different targets to be evaluated. If, in an actual industrial process, a vulnerability of the target to be evaluated is successfully exploited by an attacker, this will change the reachability probability of each attack node in the attack graph model and have an impact on the overall industrial control system risk assessment. Therefore, based on the actual exploitation of the vulnerability of the target to be evaluated and the determined industrial control vulnerability risk probability value, the industrial control vulnerability risk probability value of the target to be evaluated is dynamically updated in real time to determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated. In this way, once the result of the attack behavior is monitored, the system risk status can be refreshed immediately to ensure the correctness and timeliness of the risk assessment.
[0058] The present application provides a vulnerability risk assessment method for an oil and gas production industrial control system, comprising: determining a target to be assessed, and constructing an industrial control vulnerability assessment index for the target to be assessed, so as to determine the total industrial control vulnerability score of the target to be assessed based on the industrial control vulnerability assessment index; constructing a corresponding attack graph model based on the system structure and preset vulnerability risk information of the target to be assessed, and based on the attack graph model, determining the industrial control vulnerability risk probability value of the target to be assessed using the total industrial control vulnerability score; based on the attack graph model, determining the dynamic risk probability value of the industrial control vulnerability of the target to be assessed according to the actual exploitation of the vulnerabilities of the target to be assessed in the industrial process and using the industrial control vulnerability risk probability value.
[0059] The beneficial technical effect of the present application is as follows: combining the idea of the permissions required for exploiting vulnerabilities in industrial control systems, an industrial control vulnerability assessment index is constructed for the target to be assessed to evaluate the severity of vulnerabilities in the industrial control system. The total industrial control vulnerability score of the target to be assessed is calculated based on the industrial control vulnerability assessment index, so as to quantify the vulnerabilities in the industrial control system. In this way, it can help the security team quickly identify vulnerabilities and prioritize the most critical vulnerabilities, formulate corresponding repair strategies, and thus ensure the information security of the industrial control system. Furthermore, based on the system structure of the target to be assessed and the preset vulnerability risk information of the target to be assessed, an attack graph model from the attacker's perspective is constructed. Based on the attack graph model, the total industrial control vulnerability score is used for probability calculation to determine the industrial control vulnerability risk probability value of the target to be assessed; due to the different actual situations of different targets to be assessed, their risk levels will change dynamically. If a vulnerability in the industrial process of the target to be assessed is successfully exploited by an attacker, the reachability probability of each node in the attack graph model will change, and will affect the overall risk assessment. Therefore, based on the actual exploitation of vulnerabilities in the industrial process of the target to be evaluated, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined using the industrial control vulnerability risk probability value. This can ensure that once the results of the attack behavior are monitored, the system risk status of the target to be evaluated is immediately refreshed, thereby ensuring the timeliness of the risk assessment and improving the accuracy of the risk assessment.
[0060] Based on the above embodiment, this embodiment will specifically explain S11 in the above embodiment. Table 1 below is an exemplary vulnerability scoring table provided in this embodiment that is generated using the industrial control vulnerability assessment indicators constructed for the target to be assessed. Figure 2 The following embodiment utilizes this scoring table to implement a process for calculating the overall score of industrial control vulnerabilities of the target to be assessed. In this way, the industrial control vulnerability scoring system can help security teams quickly identify and prioritize the most critical vulnerabilities and develop corresponding remediation strategies based on the various industrial control vulnerability assessment indicators in the vulnerability scoring table.
[0061] Table 1
[0062]
[0063] Furthermore, in order to determine the total industrial control vulnerability score of the target to be evaluated by using the industrial vulnerability scoring system and the industrial control vulnerability assessment indicators in the vulnerability scoring table, the process of constructing the industrial control vulnerability assessment indicators for the target to be evaluated and determining the total industrial control vulnerability score of the target to be evaluated based on the industrial control vulnerability assessment indicators may include the following steps:
[0064] Constructing an industrial control vulnerability assessment index for the target to be assessed, and determining an industrial control vulnerability basic score and an industrial control vulnerability environmental impact score of the target to be assessed based on a first index and a second index in the industrial control vulnerability assessment index;
[0065] The industrial control vulnerability basic score and the industrial control vulnerability environmental impact score are used to determine the total industrial control vulnerability score of the target to be evaluated.
[0066] In the embodiment of the present application, the basic score of the industrial control vulnerability is first calculated, and then the final total score of the industrial control vulnerability is determined based on the basic score of the industrial control vulnerability combined with industrial process and environmental influencing factors.
[0067] The basic score is the core metric for assessing vulnerability severity. A higher score indicates a greater vulnerability risk. The basic score includes an ICS vulnerability basic score and an ICS vulnerability environmental impact score. The ICS vulnerability basic score is calculated by analyzing offensive factors, while the ICS vulnerability environmental impact score is calculated by analyzing impact factors.
[0068] In a specific embodiment, according to Table 1, the basic indicators involved are scored by experts to calculate the basic score of industrial control vulnerabilities. Specifically, the process of determining the basic score of industrial control vulnerabilities of the target to be evaluated based on the first indicator of the industrial control vulnerability assessment indicators includes the following steps:
[0069] The basic severity score of the target to be evaluated is determined using a first preset calculation formula; the first preset calculation formula is: ; Wherein, BS is the basic severity score, EC is the event complexity index value, RC is the source credibility index value, BC is the consequence type index value of the vulnerability, and RL is the repair solution index value;
[0070] The basic availability score of the target to be evaluated is determined using a second preset calculation formula; the second preset calculation formula is: ; Wherein, BEX is the basic exploitability score, EC is the event complexity index value, EX is the vulnerability maturity index value, AU is the required authority level index value, and UI is the user interaction requirement index value;
[0071] Based on the basic severity score and the basic exploitability score, a third preset calculation formula is used to determine the basic industrial control vulnerability score of the target to be evaluated; the third preset calculation formula is: ; Among them, CN is the basic score of the industrial control vulnerability, and AV is the threat vector requirement index value.
[0072] In another specific embodiment, similarly, according to Table 1, the basic indicators involved are scored by experts to calculate the industrial control vulnerability environmental impact score. Specifically, the process of determining the industrial control vulnerability environmental impact score of the target to be evaluated based on the second indicator in the industrial control vulnerability assessment indicator includes the following steps:
[0073] The fourth preset calculation formula is used to determine the initial environmental impact score of the industrial control vulnerability of the target to be evaluated; the initial environmental impact score of the industrial control vulnerability includes: a local accessibility score, a process consequence score, and a system impact score; the fourth preset calculation formula includes: 、 ; Wherein, CON is the process consequence score, VI is the process visibility consequence index value, MI is the process monitoring consequence index value, CI is the process control consequence index value; IMP is the system impact score, CD is the financial loss impact index value, PI is the system generation impact index value, RI is the system reliability impact index value, and SI is the system safety impact index value;
[0074] Based on the initial industrial control vulnerability environmental impact score, a fifth preset calculation formula is used to determine the industrial control vulnerability environmental impact score of the target to be evaluated; the industrial control vulnerability environmental impact score includes an adjusted accessibility score and an adjusted system impact score; the fifth preset calculation formula includes: 、 ; Among them, ADJACC is the adjusted accessibility score, LA is the asset access index value, and ADJIMP is the adjusted system impact score.
[0075] In this embodiment, we first determine an initial environmental impact score for an industrial control vulnerability based on industrial processes and environmental factors. We then propose an adjusted quantitative metric for the ease of exploitation based on the system characteristics of the target being assessed. Calculating the ease of exploitation is a crucial step in assessing vulnerability severity. We quantify vulnerabilities in industrial control systems based on both ease of exploitation and impact.
[0076] Furthermore, after determining the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score, the total industrial control vulnerability score is calculated. Specifically, based on the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score, the total industrial control vulnerability score of the target to be evaluated is determined using a sixth preset calculation formula; the sixth preset calculation formula is: ; Among them, FS is the total industrial control vulnerability score of the target to be evaluated, CN is the basic score of the industrial control vulnerability, ADJIMP is the adjusted system impact score in the industrial control vulnerability environmental impact score, and ADJACC is the adjusted accessibility score in the industrial control vulnerability environmental impact score.
[0077] Based on the above embodiment, this embodiment will specifically explain S12 in the above embodiment. The process of constructing a corresponding attack graph model based on the system structure of the target to be evaluated and the preset vulnerability risk information, and determining the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score may include the following steps:
[0078] Determining attack nodes according to the preset vulnerability risk information, and determining node relationships between the attack nodes according to the system structure of the target to be assessed and the preset vulnerability risk information;
[0079] Constructing an attack graph model of the target to be evaluated according to the attack nodes and the node relationships;
[0080] The total industrial control vulnerability score is used to determine a basic probability value for each attack node in the attack graph model, and based on the basic probability value and the node relationship in the attack graph model, the industrial control vulnerability risk probability value of the target to be evaluated is determined.
[0081] In this embodiment of the application, based on the oil and gas station industrial network topology and potential risk information data, an attack graph model is constructed using the industrial control system in the production and extraction process of an oil and gas station as an example. If the target to be evaluated has the following risk hazards:
[0082] (1) Attackers exploit USB ferry vulnerabilities to gain access to the monitoring network, leading to the leakage of sensitive information, such as obtaining sensitive information from the supplier's web server or corporate email server. Furthermore, attackers can replace legitimate apps or files provided by the website, causing illegal files to be downloaded and hidden, and the office host becomes a springboard, thereby achieving code injection attacks on the PLC.
[0083] (2) Attackers can establish a connection with the PLC by cracking the wireless password, and then conduct read, write, reprogram, or denial-of-service attacks on the PLC. This type of attack not only threatens the integrity and availability of the system, but can also cause disruption to the production process, thus affecting the normal operation of the factory.
[0084] (3) Attackers can remotely access the engineering station through RPC and exploit vulnerabilities to obtain server configuration information, and use hard-coded bypass vulnerabilities to obtain key monitoring information. This type of attack can allow attackers to obtain high-level permissions to tamper with key control data, disrupt control loops, and cause serious physical damage or production accidents.
[0085] (4) Attackers may also physically access the slave link, elevate to administrative privileges, and tamper with data to disrupt the control process. This direct physical access attack is often difficult to detect with traditional network security measures, and requires a closer collaboration mechanism between physical security and network security to prevent it.
[0086] Based on the above information and related knowledge, the attack map of the oil and gas station is constructed as follows: Figure 3 shown.
[0087] In the embodiment of the present application, the total score of the industrial control vulnerability is used to determine the basic probability value of each attack node in the attack graph model, thereby accurately expressing the relative risk of each vulnerability being exploited. In order for these scores to be used for probability calculation, they need to be appropriately scaled. Among them, the score corresponding to each attack node represents the probability value of the possibility of successfully exploiting the vulnerability, which can be calculated using the following formula:
[0088] .
[0089] It is understandable that the constructed attack graph model contains parent nodes and child nodes, with "OR" and "AND" relationships. This dependency reflects the possibility of a node being attacked under the influence of specific preconditions.
[0090] First, the conditional probability of each attack node in the attack graph model is determined according to the following formula:
[0091] If it is an "or" relationship, then:
[0092] ;
[0093] Where, Given its parent node Cases, Events Probability of occurrence; yes A collection of parent nodes; Is the parent node set A node in is a node Probability of occurrence.
[0094] If it is an "and" relationship, then:
[0095] ;
[0096] Where, Given its parent node Cases, Events Probability of occurrence; yes A collection of parent nodes; Is the parent node set A node in is a node Probability of occurrence.
[0097] Furthermore, after obtaining the above conditional probability, the industrial control vulnerability risk probability value of the target to be assessed is determined according to the following formula: .
[0098] Understandably, the risk level will vary depending on the specific circumstances of the target being assessed. If a vulnerability within the system is successfully exploited by an attacker, this will change the reachability of each attack node in the attack graph model and affect the overall risk assessment. Therefore, once the results of an attack are detected, the system risk status should be immediately updated to ensure the accuracy and timeliness of the risk assessment.
[0099] Specifically, the target attack node corresponding to the target to be evaluated when the attacker successfully exploits a vulnerability in the industrial process is determined in the attack graph model; the basic probability values of other attack nodes in the attack graph model are updated according to the target attack node to determine the updated probability values of the other attack nodes in the attack graph model; based on the updated probability value and the node relationship in the attack graph model, the industrial control vulnerability risk probability value is used to determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated.
[0100] Assume that the attacker has successfully achieved a node Vulnerability attack, that is, the corresponding node attack success probability , then the updated probability formula will be used to In the case of a successful attack, the node The dynamic arrival probability is expressed as , the calculation formula is as follows:
[0101] ;
[0102] Where, is the jth node; is the i-th node; is a node The current probability of yes The conditional probability of .
[0103] like Figure 4 The figure shows a schematic diagram of a vulnerability risk quantification process provided in combination with the disclosed content of the above embodiments. The dynamic risk probability value of the industrial control vulnerability is determined based on the industrial control vulnerability risk probability value of the target to be evaluated, the total score of the industrial control vulnerability of the target to be evaluated, and the dependency relationship between the attack nodes in the attack graph model. Figure 5 The following diagram illustrates the integrated functional and information security ICS vulnerability risk assessment process. ICS vulnerabilities in the target are scored using the industrial vulnerability scoring system. An attack graph model of the vulnerability in the target is constructed based on attack graph knowledge. The ICS vulnerability risk probability is analyzed using the overall ICS vulnerability score, probabilistic reasoning, and conditional probability. The ICS vulnerability risk probability is then updated based on the actual situation of the system being assessed.
[0104] Correspondingly, the present application also discloses a device for assessing the vulnerability risk of an oil and gas production industrial control system, see Figure 6 As shown, the device includes:
[0105] The scoring determination module 11 is used to determine a target to be evaluated and construct an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine the total industrial control vulnerability score of the target to be evaluated based on the industrial control vulnerability evaluation index;
[0106] a risk probability value determination module 12, configured to construct a corresponding attack graph model according to the system structure of the target to be evaluated and preset vulnerability risk information, and determine the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score;
[0107] The dynamic risk probability value determination module 13 is used to determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value.
[0108] Among them, for more specific working processes of the above modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.
[0109] It can be seen that the above scheme of this embodiment includes: determining the target to be evaluated, and constructing an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine the total industrial control vulnerability score of the target to be evaluated based on the industrial control vulnerability evaluation index; constructing a corresponding attack graph model according to the system structure and preset vulnerability risk information of the target to be evaluated, and based on the attack graph model, using the industrial control vulnerability total score to determine the industrial control vulnerability risk probability value of the target to be evaluated; based on the attack graph model, according to the actual exploitation of the vulnerabilities of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated.
[0110] The beneficial technical effect of the present application is as follows: combining the idea of the permissions required for exploiting vulnerabilities in industrial control systems, an industrial control vulnerability assessment index is constructed for the target to be assessed to evaluate the severity of vulnerabilities in the industrial control system. The total industrial control vulnerability score of the target to be assessed is calculated based on the industrial control vulnerability assessment index, so as to quantify the vulnerabilities in the industrial control system. In this way, it can help the security team quickly identify vulnerabilities and prioritize the most critical vulnerabilities, formulate corresponding repair strategies, and thus ensure the information security of the industrial control system. Furthermore, based on the system structure of the target to be assessed and the preset vulnerability risk information of the target to be assessed, an attack graph model from the attacker's perspective is constructed. Based on the attack graph model, the total industrial control vulnerability score is used for probability calculation to determine the industrial control vulnerability risk probability value of the target to be assessed; due to the different actual situations of different targets to be assessed, their risk levels will change dynamically. If a vulnerability in the industrial process of the target to be assessed is successfully exploited by an attacker, the reachability probability of each node in the attack graph model will change, and will affect the overall risk assessment. Therefore, based on the actual exploitation of vulnerabilities in the industrial process of the target to be evaluated, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined using the industrial control vulnerability risk probability value. This can ensure that once the results of the attack behavior are monitored, the system risk status of the target to be evaluated is immediately refreshed, thereby ensuring the timeliness of the risk assessment and improving the accuracy of the risk assessment.
[0111] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be considered as any limitation to the scope of use of the present application.
[0112] Figure 7This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the oil and gas production industrial control system vulnerability risk assessment method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.
[0113] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.
[0114] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, a magnetic disk, or an optical disk. The resources stored thereon may include an operating system 221, a computer program 222, and data 223. The data 223 may include various data. The storage method can be temporary storage or permanent storage.
[0115] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222. The operating system 221 can be Windows Server, NetWare, Unix, Linux, etc. In addition to including a computer program capable of implementing the oil and gas production industrial control system vulnerability risk assessment method executed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.
[0116] Furthermore, the embodiments of the present application also disclose a computer-readable storage medium, wherein the computer-readable storage medium mentioned here includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, magnetic disk or optical disk, or any other form of storage medium known in the technical field. When the computer program is executed by the processor, the aforementioned oil and gas production industrial control system vulnerability risk assessment method is implemented. For the specific steps of the method, reference can be made to the corresponding content disclosed in the aforementioned embodiments, and no further description will be given here.
[0117] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.
[0118] The steps of the oil and gas production industrial control system vulnerability risk assessment method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of both. The software module can be stored in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0119] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.
[0120] The above is a detailed introduction to the oil and gas production industrial control system vulnerability risk assessment method and device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for general technical personnel in this field, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.
Claims
1. A method for assessing the vulnerability risk of an oil and gas production industrial control system, characterized in that: include: Determine a target to be evaluated, and construct an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine a total industrial control vulnerability score of the target to be evaluated according to the industrial control vulnerability evaluation index; According to the system structure of the target to be evaluated and the preset vulnerability risk information, a corresponding attack graph model is constructed, and based on the attack graph model, the industrial control vulnerability risk probability value of the target to be evaluated is determined using the total industrial control vulnerability score; Based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined.
2. The oil and gas production industrial control system vulnerability risk assessment method according to claim 1 is characterized in that: The step of constructing an industrial control vulnerability assessment index for the target to be assessed, so as to determine the total industrial control vulnerability score of the target to be assessed according to the industrial control vulnerability assessment index, includes: Constructing an industrial control vulnerability assessment index for the target to be assessed, and determining an industrial control vulnerability basic score and an industrial control vulnerability environmental impact score of the target to be assessed based on a first index and a second index in the industrial control vulnerability assessment index; The industrial control vulnerability basic score and the industrial control vulnerability environmental impact score are used to determine the total industrial control vulnerability score of the target to be evaluated.
3. The oil and gas production industrial control system vulnerability risk assessment method according to claim 2 is characterized in that: Determining the industrial control vulnerability basic score of the target to be evaluated based on the first indicator in the industrial control vulnerability evaluation indicators includes: The basic severity score of the target to be evaluated is determined using a first preset calculation formula; the first preset calculation formula is: ; Wherein, BS is the basic severity score, EC is the event complexity index value, RC is the source credibility index value, BC is the consequence type index value of the vulnerability, and RL is the repair solution index value; The basic availability score of the target to be evaluated is determined using a second preset calculation formula; the second preset calculation formula is: ; Wherein, BEX is the basic exploitability score, EC is the event complexity index value, EX is the vulnerability maturity index value, AU is the required authority level index value, and UI is the user interaction requirement index value; Based on the basic severity score and the basic exploitability score, a third preset calculation formula is used to determine the basic score of the industrial control vulnerability of the target to be evaluated; the third preset calculation formula is: ; Among them, CN is the basic score of the industrial control vulnerability, and AV is the threat vector requirement index value.
4. The oil and gas production industrial control system vulnerability risk assessment method according to claim 2 is characterized in that: Determining the industrial control vulnerability environmental impact score of the target to be evaluated based on the second indicator in the industrial control vulnerability evaluation indicator includes: The fourth preset calculation formula is used to determine the initial environmental impact score of the industrial control vulnerability of the target to be evaluated; the initial environmental impact score of the industrial control vulnerability includes: local accessibility score, process consequence score and system impact score; the fourth preset calculation formula includes: , ; Wherein, CON is the process consequence score, VI is the process visibility consequence index value, MI is the process monitoring consequence index value, CI is the process control consequence index value; IMP is the system impact score, CD is the financial loss impact index value, PI is the system generation impact index value, RI is the system reliability impact index value, and SI is the system safety impact index value; Based on the initial environmental impact score of the industrial control vulnerability, the environmental impact score of the industrial control vulnerability of the target to be evaluated is determined using a fifth preset calculation formula; the environmental impact score of the industrial control vulnerability includes an adjusted accessibility score and an adjusted system impact score; the fifth preset calculation formula includes: , ; Among them, ADJACC is the adjusted accessibility score, LA is the asset access index value, and ADJIMP is the adjusted system impact score.
5. The oil and gas production industrial control system vulnerability risk assessment method according to claim 2 is characterized in that: The determining of the total industrial control vulnerability score of the target to be evaluated by using the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score includes: Based on the industrial control vulnerability basic score and the industrial control vulnerability environmental impact score, a sixth preset calculation formula is used to determine the total industrial control vulnerability score of the target to be evaluated; the sixth preset calculation formula is: ; Among them, FS is the total industrial control vulnerability score of the target to be evaluated, CN is the basic score of the industrial control vulnerability, ADJIMP is the adjusted system impact score in the environmental impact score of the industrial control vulnerability, and ADJACC is the adjusted accessibility score in the environmental impact score of the industrial control vulnerability.
6. The method for assessing the vulnerability risk of an oil and gas production industrial control system according to any one of claims 1 to 5, characterized in that: The step of constructing a corresponding attack graph model according to the system structure of the target to be evaluated and the preset vulnerability risk information, and determining the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score, includes: Determining attack nodes according to the preset vulnerability risk information, and determining node relationships between the attack nodes according to the system structure of the target to be evaluated and the preset vulnerability risk information; Constructing an attack graph model of the target to be evaluated according to the attack nodes and the node relationships; The total industrial control vulnerability score is used to determine the basic probability value of each attack node in the attack graph model, and based on the basic probability value and the node relationship in the attack graph model, the industrial control vulnerability risk probability value of the target to be evaluated is determined.
7. The oil and gas production industrial control system vulnerability risk assessment method according to claim 6 is characterized in that: Based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value, the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated is determined, including: Determine in the attack graph model a target attack node corresponding to when the vulnerability of the target to be evaluated is successfully exploited by an attacker in the industrial process; Updating basic probability values of other attack nodes in the attack graph model according to the target attack node to determine updated probability values of other attack nodes in the attack graph model; Based on the updated probability value and according to the node relationship in the attack graph model, the industrial control vulnerability risk probability value is utilized to determine the industrial control vulnerability dynamic risk probability value of the target to be evaluated.
8. A vulnerability risk assessment device for oil and gas production industrial control systems, characterized in that: include: A scoring determination module, used to determine a target to be evaluated, and to construct an industrial control vulnerability evaluation index for the target to be evaluated, so as to determine the total industrial control vulnerability score of the target to be evaluated according to the industrial control vulnerability evaluation index; A risk probability value determination module is used to construct a corresponding attack graph model according to the system structure of the target to be evaluated and the preset vulnerability risk information, and determine the industrial control vulnerability risk probability value of the target to be evaluated based on the attack graph model and the total industrial control vulnerability score; The dynamic risk probability value determination module is used to determine the dynamic risk probability value of the industrial control vulnerability of the target to be evaluated based on the attack graph model, according to the actual exploitation of the vulnerability of the target to be evaluated in the industrial process, and using the industrial control vulnerability risk probability value.
9. An electronic device, characterized in that: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the vulnerability risk assessment method for the oil and gas production industrial control system as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein the computer program, when executed by the processor, implements the oil and gas production industrial control system vulnerability risk assessment method as described in any one of claims 1 to 7.