Network security risk quantitative evaluation method for power distribution network information physical system

Abstract

The invention discloses an automatic network security risk quantitative evaluation method for a power distribution network information physical system. The method comprises the following steps: carrying out vulnerability scanning on a target network by utilizing a Nessus vulnerability scanner; the Mu lVAL tool generates an attack graph by using the vulnerability scanning result and the input network topology and security policy; searching corresponding vulnerability description in a vulnerability library according to a vulnerability scanning result, and outputting CVSS measurement classification of vulnerabilities through a CVSS measurement classification prediction model; and carrying out system risk quantitative evaluation according to the attack graph, the CVSS measurement and an input physical result, and calculating a risk value of each node in the target network. According to the method, the problem of automatic generation of the attack graph is solved by using an open source tool, and the problem of CVSS information dependence is solved through a CVSS measurement classification prediction model; by designing a plurality of classifiers sharing a multi-layer network, synchronous classification prediction and classification feature sharing of each CVSS metric are realized.

Description

Technical Field

[0001] The present invention relates to an evaluation method, and in particular to an automated network security risk quantitative evaluation method for a power distribution network information-physical system. Background Art

[0002] Existing cybersecurity risk assessment methods for distribution network cyber-physical systems (CPS) mainly model attack paths through attack graphs and perform risk quantification calculations based on the Common Vulnerability Scoring System (CVSS) information in the vulnerability library. However, most of these methods use manual methods to construct attack graphs and are highly dependent on CVSS information in the vulnerability library, which cannot cope with the common situation of missing CVSS information.

[0003] While information and communication technology has brought intelligence to the development of distribution networks, it has also brought hidden dangers of cyber attacks. Distribution network CPS is a typical cyber-physical system. Cyber ​​attacks against it often use vulnerabilities or security defects of information equipment (i.e., power secondary equipment) as the entry point, and adopt multi-host multi-step attack forms to ultimately affect power facilities (i.e., power primary equipment). The network security risk assessment method for distribution network CPS can use attack graphs to model the attack path, and use the CVSS information provided by the vulnerability library to perform risk quantification calculations to guide the adoption of targeted security protection strategies and improve the ability of distribution network CPS to resist cyber attacks.

[0004] Attack graph is one of the main technologies used for automated risk assessment. Compared with other risk assessment methods, attack graph does not focus on a single vulnerability, but models the interaction between the attacker's lateral movement and the vulnerability, so it is more suitable for modeling complex multi-host multi-step attacks. Specifically, the risk assessment method based on attack graph analyzes the target network from the attacker's perspective, and uses network configuration and vulnerability information to mine all possible attack paths. In addition, it also realizes the visualization of the attack process, intuitively showing the association between vulnerabilities and network configurations in the target network, and the potential risks they generate. Based on the mined attack path, high-risk nodes on the target network can be identified, thereby guiding network security managers to take key defense measures; when an attack occurs, the intruder's attack intention can also be inferred, thereby guiding targeted measures.

[0005] CVSS is an internationally accepted vulnerability scoring standard designed to help organizations and security experts quantify the severity of vulnerabilities. The "harm level" information in the vulnerability database is the CVSS score of the vulnerability. CVSS consists of three measurement groups: basic, time, and environment. Among them, the basic measurement group represents the inherent characteristics of the vulnerability that will not change over time and the user environment; the time measurement group reflects the characteristics of the vulnerability that change over time; and the environment measurement group represents the vulnerability characteristics that are unique to the user environment. The basic measurement group provides a score of 0 to 10 for the vulnerability. The higher the score, the more serious the vulnerability. This part is recorded in the vulnerability database, while the other two measurement groups are less used.

[0006] (2) Existing solutions

[0007] The existing scheme [Wang Jinfang, Guo Yuanbo. Cybersecurity risk assessment of physical information systems based on attack graphs [J]. Science, Technology and Engineering, 2023, 23(28): 12175-12181.] defines risk as the product of attack probability, attack impact and power recovery factor, as follows:

[0008]

[0009] In formula (2-1): R is the final risk of CPS; is the probability of successfully attacking the target; C cs The impact on the communication network; C ps The impact on the power system; F re is the power system recovery factor. For the explanation of the subscripts, please refer to the above text. re means recovery, and goal means attack success.

[0010] The attack success rate and attack gain are calculated based on the attack graph. The attack graph is defined as AG = (S, E, P, B, C), where S is the set of attribute state nodes; E is the set of directed edges; P is the set of single-step attack success probabilities; P i is the state node S i To S i+1 The transfer probability of a single-step attack; B is the single-step attack benefit, that is, the threat of each attack to the system; C is the attack cost of a single-step attack, and i, i+1 represent the vulnerability index.

[0011] Node S i The probability of successful attack on vulnerability i is expressed as:

[0012]

[0013] In formula (2-2): The probability of exploitation of the vulnerability is calculated according to CVSS 3.1:

[0014]

[0015] In formula (2-3), i represents the vulnerability index, and the superscript l represents the exploited AV. i , AC i , PR i 、UI i They are attack vector, attack complexity, permission requirement and user interaction of the basic attribute group of the vulnerability in CVSS, both representing the static feature score of the vulnerability; RE i and EX i are the patch repair degree and vulnerability exposure degree of the vulnerability, respectively, indicating the dynamic feature score of the vulnerability; ω, δ, γ, ξ, θ, and λ are the weights of different factors affecting the probability of successful exploitation of the vulnerability.

[0016] For the vulnerability repair level RE i and vulnerability exposure EX i , using Weibull distribution and Pareto distribution for calculation, the calculation formulas are:

[0017]

[0018]

[0019] In formula (2-4) and (2-5): T i is the release time of vulnerability i; α and β are the parameters of Weibull distribution and Pareto distribution respectively.

[0020] is the attacker's ability to exploit the target node's vulnerability, and its calculation formula is:

[0021]

[0022] In formula (2-6), k is the attacker's proficiency in knowledge, and k∈[0,1]; N i is the total number of vulnerabilities; t is the number of attacks by the attacker on vulnerability i.

[0023] The single-step attack gain is the gain gained by the attacker for each attack step, which can be expressed as:

[0024]

[0025] In formula (2-7): and They are respectively the intrusion system nodes S i and S i+1 The threat value to the network, that is, node S i To S i+1 Single-step attack gain; For node Si The attack complexity of the exploitable vulnerability i is in the range of [1,10], that is, the attack node S i The cost of attack.

[0026] Based on the above single-step attack success rate and single-step attack gain, the cumulative attack success rate and cumulative attack gain can be calculated. The calculation formula is as follows:

[0027]

[0028]

[0029] The impact of cyber attacks on the network system layer is evaluated by the delay of data packets sent from the control center to the bay layer OT devices. The calculation formula is as follows:

[0030]

[0031] In formula (2-10): N substation is the nth substation; RTT avg,i is the average round trip delay of the ith data packet; T margin is the minimum acceptable delay, and avg and margin are used to mark different delays.

[0032] By analyzing the state of the power system before and after the cyber attack, the overall impact on the operation of the power system is calculated. The calculation formula is:

[0033] C ps =ω 1 C 1 +ω 2 C V (2-11)

[0034] In formula (2-11): ω 1 ,ω 2 are the experience weighting factors, ranging from [0,100]; C 1 , C V They are load loss and voltage deviation, the influencing factors of the power system, and their calculation formulas are:

[0035]

[0036]

[0037] In formula (2-12) and (2-13): N load is the load of the nth node; N voltage is the voltage of the nth node; ΔU i When a network attack risk event occurs, the node voltage is affected, causing the system node voltage to drop; P init,iis the initial load loss; ΔP load,i is the difference in load loss before and after the network attack; and are the upper and lower voltages of node i on the physical side before the network attack occurs.

[0038] The power system restoration factor, which quantifies the effort required to restore the power system after a cyber attack, takes into account the disconnection of generators as well as the generation capacity and type, and is formulated as follows:

[0039]

[0040] In formula (2-14): F re is the power system recovery factor; N generator The nth generator; P nominal,i is the nominal capacity of generator i; P total is the total installed capacity of the power system; a i is the generator circuit breaker status, that is, 1 represents the circuit breaker status is open; T is initialized to 0 and calculated according to the disconnected generator type, the calculation formula is:

[0041]

[0042] In formula (2-15): T i 'Restore index for generator i.

[0043] The simultaneous restoration procedure of the disconnected generator sets begins, and the power system restoration index is given by the maximum restoration index of the generator. Generator sets with black start capability, such as hydropower plants, have a restoration index of 0.5, while thermal power plants have a restoration index of 0.8. The restoration index for connecting to the adjacent grid is 1, because resynchronization can only be started after the power system restoration is completed.

[0044] The existing methods mainly construct attack graphs manually and are highly dependent on CVSS information in the vulnerability library. However, this method cannot effectively deal with the common problem of missing CVSS information. The present invention proposes a quantitative assessment method for network security risks of distribution network CPS automation, which uses open source tools to solve the problem of automatic generation of attack graphs and solves the problem of CVSS information dependence through a CVSS metric classification prediction model. The existing CVSS metric classification prediction method has problems such as large model scale, high time cost, data imbalance, and ignoring the correlation between metrics. The prediction model implemented by the present invention performs better in terms of accuracy, model scale, and time cost. Summary of the invention

[0045] In order to solve the defects in the prior art, the present invention discloses an automated network security risk quantitative assessment method for a distribution network cyber-physical system, and its technical solution is as follows:

[0046] Step 1: Use Nessus vulnerability scanner to scan the target network for vulnerabilities;

[0047] Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy;

[0048] Step 3: Search for the corresponding vulnerability description in the vulnerability database based on the vulnerability scan results, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model;

[0049] Step 4: Perform a quantitative assessment of system risk based on the attack graph, CVSS metrics, and input physical consequences, and calculate the risk value of each node in the target network.

[0050] Beneficial Effects

[0051] (1) The present invention proposes a quantitative assessment method for network security risks in CPS automation of distribution networks, uses open source tools to solve the problem of automatic generation of attack graphs, and solves the problem of CVSS information dependence through a CVSS metric classification prediction model.

[0052] (2) The present invention proposes a CVSS metric classification prediction model based on multi-task learning. The model designs a network layer structure that integrates hard parameter sharing and soft parameter sharing, takes into account the uniqueness of tasks and the correlation between tasks for modeling, and realizes the synchronous classification prediction and classification feature sharing of each CVSS metric by designing multiple classifiers that share a multi-layer network. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of the risk quantitative assessment framework of the present invention;

[0054] Figure 2 Schematic diagram of the CVSS metric classification prediction model of the present invention. DETAILED DESCRIPTION

[0055] This paper proposes a risk quantitative assessment method based on attack graph and vulnerability CVSS measurement, see Figure 1 As shown in the figure, the process of quantitative risk assessment is as follows:

[0056] Step 1: Use Nessus vulnerability scanner to scan the target network for vulnerabilities;

[0057] Nessus is a very popular vulnerability scanning tool that can identify potential security risks and patch them in a timely manner. When Nessus performs a vulnerability scan, it gradually scans the target system's open ports, operating system, application vulnerabilities, etc. During the scan, Nessus will try to match potential vulnerabilities in the target system with a known vulnerability database. The scan time depends on the size of the target and the set scan depth.

[0058] After the scan is complete, Nessus will generate a detailed scan report. The report is divided into several sections:

[0059] (1) Vulnerability risk level

[0060] Nessus scores each vulnerability based on its severity (e.g., Critical, High, Medium, Low).

[0061] (2) Vulnerability description and repair suggestions

[0062] Each vulnerability is accompanied by a detailed description, including the name of the vulnerability, description of the vulnerability, impact of the vulnerability, CVE number of the vulnerability, suggestions for vulnerability repair or official repair method.

[0063] Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy;

[0064] MulVAL is a tool for analyzing network security vulnerabilities. It can generate attack graphs by inputting vulnerability scan results, network topology, and security policies. The purpose of attack graphs is to help security experts understand how attackers may exploit vulnerabilities in the network and simulate potential attack paths to identify and mitigate network security risks.

[0065] In MulVAL, attack paths are deduced through logical rules that take into account multiple factors such as vulnerability exploitation, network communication, access control, and protection measures. The core of MulVAL is the attack graph generation based on logical reasoning. It generates attack graphs through the following steps:

[0066] (1) Vulnerability Modeling

[0067] MulVAL first converts the vulnerabilities in the scan results into nodes in the graph model. Each vulnerability node contains detailed information about the vulnerability, such as the type of vulnerability, the impact of the vulnerability, and the conditions for exploiting the vulnerability.

[0068] (2) Network topology modeling

[0069] The network topology information is modeled as edges in the graph, representing the connections between different devices and nodes in the network. MulVAL represents network devices, routers, firewalls, etc. as nodes in the network topology and connects these nodes through edges.

[0070] (3) Security Policy Modeling

[0071] By modeling the access control of network devices, MulVAL can determine whether an attacker can reach the target system through certain paths under a specific security policy. The model of the security policy can include: firewall rules, access control, authentication mechanism, etc.

[0072] (4) Reasoning about attack paths

[0073] MulVAL uses a set of logical rules (usually based on predicate logic or modal logic) to infer possible attack paths. These rules include: vulnerability exploitation rules, privilege escalation rules, and lateral movement rules. MulVAL uses these rules to infer possible attack paths from the attacker's initial point to the final target.

[0074] (5) Visualization of attack graph

[0075] MulVAL will generate an attack graph that shows possible attack paths, including: the attacker's initial entry point, the steps to exploit the vulnerability, the lateral movement across the network boundary, and the achievement of the final goal.

[0076] Step 3: Search for the corresponding vulnerability description in the vulnerability database based on the vulnerability scan results, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model;

[0077] The CVSS metric classification prediction model models the CVSS classification prediction task as eight text classification tasks for NVD vulnerability description texts, and can classify and predict all CVSS metrics at the same time. The overall structure of the model is detailed in the attached Figure 2 The model consists of a shared network layer, an expert network layer, a gated network layer, and a tower network layer.

[0078] The shared network layer uses DistilBERT as the encoder and a feedforward neural network as the feature extractor. The input text is first divided into a token sequence by the WordPiece tokenizer and converted into a computable token embedding sequence for input into the DistilBERT model. The Transformer encoder model stacked inside DistilBERT further extracts semantic features and outputs a sequence of word vectors corresponding to the token sequence. The [CLS] word vector in the sequence is taken as input and used as the sentence feature vector of the upper model after linear transformation.

[0079] The expert network layer is composed of three expert networks with the same structure, each of which is composed of a simple linear layer and a ReLU activation function layer. The sentence feature vectors output by the shared network layer are input into the expert network to obtain three feature vectors.

[0080] The gated network layer consists of 8 gated networks, each of which consists of a stacked linear layer, a ReLU activation function layer, and a Softmax layer. The output of the shared network layer is converted into an N-dimensional vector (N is the number of expert networks) after two rounds of linear operations, and then normalized using the Softmax activation function to obtain the output weight of each expert network. All outputs of the expert network layer are weighted and summed according to the output weights learned by the task-specific gated network as the input of the task-specific tower network.

[0081] The tower network layer consists of 8 tower networks, each of which consists of a simple Softmax layer. The tower network first performs a linear operation on the input feature vector, and then uses the Softmax activation function to convert it into a classification probability distribution corresponding to the CVSS metric.

[0082] Vulnerability databases are currently the most important source of vulnerability information, recording a large amount of vulnerability-related information in structured and semi-structured forms. Common Vulnerabilities & Exposures (CVE) is a globally recognized vulnerability dictionary maintained by MITRE, which identifies unique names for widely recognized information security vulnerabilities or weaknesses. Through this CVE name, you can learn more about vulnerabilities from many CVE-compatible databases.

[0083] NVD is a comprehensive vulnerability database maintained by the National Institute of Standards and Technology of the United States. It is also the most complete CVE vulnerability data source and is widely used in vulnerability classification and other related research. The NVD vulnerability database provides historical vulnerability files in json and xml formats, which contain information such as the vulnerability's CVE number, vulnerability description, vulnerability score, vulnerability solution, etc.

[0084] The China National Vulnerability Database (CNVD) is the most important vulnerability database in China, containing a large number of public domestic software vulnerabilities. Based on the industry or application type affected by the vulnerability, CNVD divides the vulnerability into the types shown in Table 8-1. A CNVD vulnerability record contains information such as CNVD number, disclosure / reporting / collection / update time, hazard level, affected products, CVE number, vulnerability description, patch and solution.

[0085] Table 8-1 CNVD vulnerability classification

[0086]

[0087]

[0088] In addition to CVE, MITRE has also initiated or operated a number of knowledge bases in the field of cybersecurity, including CAPEC (Common Attack Pattern Enumeration and Classification), CWE (Common Weakness Enumeration), ATT&CK (Adversarial Tactics, Techniques and Common Knowledge), etc. Together, they have built a security ecosystem covering threat modeling, attack classification, threat intelligence, and other aspects. CAPEC is a publicly available common attack pattern catalog that records important information such as attack name, probability of occurrence, attack severity, and implementation conditions in a semi-structured form. The CWE database contains network defects of all software and hardware products, and classifies and identifies vulnerability types, vulnerability-related security issues, and vulnerability prevention measures. The ATT&CK model

[58] was launched by MITRE in 2013 and is continuously updated based on actual observation data. It is recognized as an authority on the behavioral models and technologies used by attackers against enterprises. The ATT&CK model covers four dimensions: organization, software, assets, tactics, and technology matrix, and presents the tactics and techniques used by cyber attackers when carrying out cyber attacks in a structured form.

[0089] CVSS:

[0090] In the most widely used CVSS 3.x version, the basic metric group consists of two sub-metric groups and one scope (S) metric. The optional values ​​and corresponding scores of each metric in the basic metric group are shown in Table 8-2.

[0091] The Exploitability sub-metric group mainly measures the possibility of a vulnerability being successfully exploited, including four metrics: Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), and User Interaction (UI). The Impact sub-metric group includes three metrics: Confidentiality (C), Integrity (I), and Availability (A). All metrics in the CVSS basic metric group can be represented by a CVSS vector, with each metric represented by a “:” and separated by “ / ”, such as “AV:N / AC:L / PR:N / UI:N / S:U / C:N / I:N / A:H”.

[0092] The AV metric mainly reflects the environment in which the vulnerability can be exploited. The farther away the attacker is from exploiting the vulnerability, the higher the score. The AC metric measures the complexity of vulnerability exploitation. The attacker must meet certain conditions to successfully exploit the vulnerability. The PR metric indicates the level of permissions that the attacker must have in order to successfully exploit the vulnerability. The highest score is when no special permissions are required. The UI metric indicates whether the attacker can exploit the vulnerability without the participation of other users. The C, I, and A metrics measure the impact on the confidentiality, integrity, and availability of the component after the vulnerability is successfully exploited.

[0093] Table 8-2 CVSS metric classification and scoring

[0094]

[0095]

[0096] Compared with CVSS 2.0, CVSS 3.x has made adjustments in both measurement and scoring. The newly introduced "scope" (S) indicates whether the vulnerability in the component will affect resources outside the component or obtain permissions outside the component. There are two cases: "unchanged" and "variable". The value of "scope" will affect the score of "required permissions" and will also affect the score calculation of the vulnerability. Specifically, the base score (BaseScore) depends on the impact (Impact) and exploitability (Exploitability), and their calculation methods are shown in formulas (8-1)(8-2)(8-3) and (8-4):

[0097] ISS=1-[(1-C)×(1-I)×(1-A)] (8-1)

[0098]

[0099] (8-2)

[0100] Exploitability=8.22×AV×AC×PR×UI

[0101] (8-3)

[0102]

[0103] The Roundup function returns the smallest number that is greater than or equal to the input parameter, and the number is rounded to one decimal place (for example, Roundup(4.02) returns 4.1, and Roundup(4.00) returns 4.0); the Min function returns the smaller value of the two input parameters.

[0104] Step 4: Perform a quantitative assessment of system risk based on the attack graph, CVSS metric classification, and input physical consequences, and calculate the risk value of each node in the target network.

[0105] The attack graph establishes the attack path of the target network, and the CVSS metric assigns an initial probability to each network node. The Bayesian network can further calculate the probability of successful node attack and the probability of attack path occurrence. Finally, the final risk value can be calculated using the probability and consequence index, and the relationship is expressed as formula (4-1):

[0106] R=P·C

[0107] (4-1)

[0108] In formula (4-1), R represents the risk value, P represents the probability of successful attack, and C represents the consequences caused by the successful exploitation of the vulnerability in the distribution network CPS.

[0109] Calculation of attack success probability:

[0110] The attack graph can be defined as AG = (S, τ, P, p), where S is the node set, τ is the directed edge set, P represents the node's successful exploitation probability set, and p represents the node's initial probability set. The nodes can be divided into three categories S = {F, A, D}, where F is the basic fact node set, A is the exploitation node set, and D is the derived fact node set. The directed edge consists of a triple τ i,j =(S i ,S j ,e),e∈{AND,OR}, represents the head node S i and the tail node S j There is an "and" or "or" relationship.

[0111] When calculating the attack success probability of a node, it is necessary to consider the attack success probability of all preceding nodes and the initial probability of the node itself. Based on the initial probability, the probability of each node being successfully exploited P is further calculated based on the Bayesian network. i , the calculation formula is shown in formula (4-2):

[0112]

[0113] In formula (4-2), m is the node S i The number of nodes preceding the "and" relationship, n is the node S i The number of preceding nodes of the "or" relationship, Represents the attack success probability of the jth predecessor node.

[0114] For node S i Assign initial probability p i When , the initial probability of the basic fact node and the derived fact node is assigned to 1, that is, The initial probability of exploiting a node needs to take into account the attacker's ability and the nature of the vulnerability itself, because exploiting a node is mainly related to the exploitation of the vulnerability. The following factors are considered when calculating the initial probability:

[0115] (1) Ease of exploitation (EL). The more difficult it is to exploit a vulnerability, the lower the probability of successful attack. The ease of exploitation of a vulnerability is calculated using the attack vector (AV), attack complexity (AC), required permissions (PR), and user interaction (UI) metrics in CVSSv3.1. The calculation is shown in formula (4-3):

[0116] EL=8.22×AV×AC×PR×UI

[0117] (4-3)

[0118] (2) Average vulnerability exposure (EX). The longer the time since the vulnerability was released, the more people know about the vulnerability, so the higher the success rate of the attack. This can be measured using the Pareto distribution, as shown in formula (4-4):

[0119]

[0120] (4-4)

[0121] In formula (4-4), T is the release time of the vulnerability, k and α are the parameters of the Pareto distribution, and their values ​​are 0.00161 and 0.26 respectively.

[0122] (3) Average vulnerability repair degree (RE). The longer the time from the vulnerability release, the higher the degree of vulnerability repair and the lower the attack success rate. It can be measured using Weibull distribution, see formula (4-5):

[0123]

[0124] (4-5)

[0125] In formula (4-5), T is the release time of the vulnerability, λ and β are the parameters of Weibull distribution, and their values ​​are 0.209 and 4.04 respectively.

[0126] According to the above analysis, using node A i The initial probability of being successfully utilized is p i It can be expressed by formula (4-6):

[0127] p i =Softmax(EL i ×EX i / RE i )

[0128] (4-6)

[0129] In formula (4-6), EL i 、EX i ,RE i They respectively represent the difficulty of exploiting vulnerability i, the average exposure level, and the average repair level. Softmax is a normalization function.

[0130] Attack consequence calculation:

[0131] The distribution network CPS is a complex system with deep coupling between information space and cyberspace. Therefore, when assessing the network security risk of the distribution network CPS, it is necessary to consider not only the consequences of successful exploitation of vulnerabilities in the information space, but also the consequences of failures caused in the physical space. The risk is defined as follows:

[0132] C=C cs +C ps

[0133] (4-7)

[0134] In formula (4-7), C cs and C ps They represent the consequence indicators of the information space and physical space of the distribution network CPS respectively.

[0135] Impact of successful exploitation of the vulnerability on the CPS information space of the distribution network CS We can use the confidentiality C, integrity I, availability A and scope S metrics in the vulnerability CVSS to calculate. First, we calculate the CVSS metric ISS. The calculation formula is shown in equations (4-8) and (4-9):

[0136] ISS=1-[(1-C)×(1-I)×(1-A)]

[0137] (4-8)

[0138]

[0139] The impact of successful exploitation of the vulnerability in the physical space C ps It can be calculated by using power indicators such as load loss and voltage deviation before and after the vulnerability is exploited. Impact of physical space C ps Directly using the input quantized value is not the focus of this method.

[0140] This paper proposes an automated network security risk quantitative assessment method for distribution network CPS based on the risk quantitative assessment framework of attack graph and vulnerability CVSS measurement. The framework integrates the open source Nessus vulnerability scanner and MulVAL attack graph generation tool, as well as the CVSS measurement classification prediction model, which effectively solves the problem of automatic generation of attack graphs and CVSS information dependence, and provides strong support for network security risk assessment of distribution network CPS.

[0141] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. An automated cybersecurity risk quantitative assessment method for a distribution network cyber-physical system, characterized by: Step 1: Use Nessus vulnerability scanner to scan the target network for vulnerabilities; Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy; Step 3: Search for the corresponding vulnerability description in the vulnerability database based on the vulnerability scan results, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model; Step 4: Perform a quantitative assessment of system risk based on the attack graph, CVSS metrics, and input physical consequences, and calculate the risk value of each node in the target network.

2. The automated network security risk quantitative assessment method for the information-physical system of the distribution network according to claim 1 is characterized by: The attack graph establishes the attack path of the target network, and the CVSS metric assigns an initial probability to each network node. The Bayesian network can further calculate the probability of successful node attack and the probability of attack path occurrence. Finally, the final risk value can be calculated using the probability and consequence index, and the relationship is expressed as formula (4-1): R=P·C (4-1) Where: R represents the risk value, P represents the probability set of successful exploitation of the node, and C represents the consequences caused by the successful exploitation of the vulnerability in the distribution network CPS; Calculation of the probability of successful exploitation of a node: The attack graph is defined as AG = (S, τ, P, p), where S is a node set, τ is a directed edge set, P represents the node successful exploitation probability set, and p represents the node initial probability set; the nodes can be divided into three categories S = {F, A, D}, where F is the basic fact node set, A is the exploitation node set, and D is the derived fact node set; the directed edge consists of a triple τ i,j =(S i ,S j ,e),e∈{AND,OR}, represents the head node S i and the tail node S j There is an "and" or "or" relationship, where i represents the subscript of the head node, and j represents the subscript of the head node.

3. The automated network security risk quantitative assessment method for the information-physical system of the distribution network according to claim 1 is characterized by: When calculating the attack success probability of a node, it is necessary to consider the attack success probability of all preceding nodes and the initial probability of the node itself. Based on the initial probability, the probability P of each node being successfully exploited is calculated based on the Bayesian network. i , the calculation formula is shown in formula (4-2): In formula (4-2), i represents the subscript of the head node, j represents the subscript of the head node, and m represents the subscript of the node S. i The number of nodes preceding the "and" relationship, n is the number of nodes S i The number of preceding nodes of the "or" relationship, represents the attack success probability of the jth predecessor node; i Assign initial probability p i When , the initial probability of the basic fact node and the derived fact node is assigned to 1, that is, 4. The automated network security risk quantitative assessment method for the information-physical system of the distribution network according to claim 3 is characterized by: exist The following factors are considered when calculating the initial probability: (1) Vulnerability Exploitation Difficulty EL; the greater the vulnerability exploitation difficulty, the lower the probability of successful attack. The vulnerability exploitation difficulty is calculated using the attack vector AV, attack complexity AC, required permissions PR, and user interaction UI metrics in CVSS v3.

1. The calculation is shown in formula (4-3): EL=8.22×AV×AC×PR×UI (4-3) (2) Average vulnerability exposure level EX; The longer the time from the vulnerability release, the more people know about the vulnerability, so the higher the success rate of the attack; use Pareto distribution to measure, see formula (4-4): In formula (4-4), T is the release time of the vulnerability, k and α are the parameters of the Pareto distribution; (3) Average vulnerability repair degree RE; the longer the time from the vulnerability release, the higher the vulnerability repair degree and the lower the attack success rate; Use Weibul l distribution to measure, see formula (4-5): In formula (4-5), T is the release time of the vulnerability, λ and β are the parameters of Weibull distribution; Using Node A i The initial probability of being successfully utilized is p i Expressed by formula (4-6): p i =Softmax(EL i ×EX i / RE i ) (4-6) In formula (4-6), EL i 、EX i ,RE i They represent the difficulty of exploitation, average exposure, and average repair degree of vulnerability i, respectively. Softmax is a normalization function, and i represents the vulnerability index. Attack consequence calculation: The distribution network CPS is a complex system with deep coupling between information space and cyberspace. Therefore, when assessing the network security risk of the distribution network CPS, it is necessary to consider not only the consequences of successful exploitation of vulnerabilities in the information space, but also the consequences of failures caused in the physical space. The risk is defined as follows: C=C cs +C ps (4-7) In formula (4-7), C cs and C ps They represent the consequence indicators of the information space and physical space of the distribution network CPS, respectively; the subscripts cs and ps represent the information space and physical space, respectively; Impact of successful exploitation of the vulnerability on the CPS information space of the distribution network CS The confidentiality C, integrity I, availability A and scope S metrics in the vulnerability CVSS can be used for calculation. U represents unchanged and C represents variable. First, the CVSS metric ISS is calculated. The calculation formula is shown in formulas (4-8) and (4-9): ISS=1-[(1-C)×(1-I)×(1-A)] (4-8) The impact of successful exploitation of the vulnerability in the physical space C ps Calculated by load loss and voltage deviation power indicators before and after vulnerability exploitation; the impact of physical space C ps Directly use the input quantized value.

5. The automated network security risk quantitative assessment method for the information-physical system of the distribution network according to claim 1 is characterized by: The prediction model is a CVSS metric classification prediction model based on multi-task learning. The prediction model models the CVSS classification prediction task as 8 text classification tasks for NVD vulnerability description texts, and can perform classification prediction on all CVSS metrics at the same time.

6. The automated network security risk quantitative assessment method for the information-physical system of the distribution network according to claim 5 is characterized by: The prediction model includes a shared network layer, an expert network layer, a gated network layer and a tower network layer; Shared network layer: DistilBERT is used as the encoder and a feedforward neural network is used as the feature extractor; The input text is first divided into a token sequence by the WordPiece tokenizer and converted into a computable token embedding sequence for input into the DistilBERT model. The stacked Transformer encoder model inside DistilBERT further extracts semantic features and outputs a word vector sequence corresponding to the token sequence. The [CLS] word vector in the sequence is taken as input and used as the sentence feature vector of the upper model after linear transformation. Expert network layer: It is composed of three expert networks with the same structure. Each expert network consists of a simple linear layer and a ReLU activation function layer. The sentence feature vectors output by the shared network layer are input into the expert network to obtain three feature vectors. Gated network layer: It is composed of 8 gated networks, each of which is composed of stacked linear layers, ReLU activation function layers and Softmax layers. The output of the shared network layer is converted into an N-dimensional vector after two rounds of linear operations, and then normalized using the Softmax activation function to obtain the output weight of each expert network. All outputs of the expert network layer are weighted and summed according to the output weights learned by the task-specific gated network, which serves as the input of the task-specific tower network. Tower network layer: It consists of 8 tower networks, each of which consists of a simple Softmax layer. The tower network first performs linear operations on the input feature vector, and then uses the Softmax activation function to convert it into the classification probability distribution corresponding to the CVSS metric.

7. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

8. An electronic device, characterized in that: It comprises a processor and a memory; the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein the computer-readable instructions execute the method described in any one of claims 1 to 6 when executed.

Images