Quantitative assessment method for cyber security risk of distribution network cyber-physical system

Abstract

An automated network security risk quantitative assessment method for a power distribution network cyber-physical system includes: using the Nessus vulnerability scanner to perform a vulnerability scan on a target network; using the MulVAL tool to generate an attack graph using the vulnerability scan results and input network topology and security policies; searching a vulnerability library for corresponding vulnerability descriptions based on the vulnerability scan results, and outputting the vulnerability's CVSS metric classification using a CVSS metric classification prediction model; performing a quantitative system risk assessment based on the attack graph, CVSS metrics, and input physical consequences, and calculating the risk value of each node in the target network. The present invention utilizes open source tools to address the problem of automatic attack graph generation, and uses a CVSS metric classification prediction model to address the problem of CVSS information dependency. Furthermore, by designing multiple classifiers that share a multi-layer network, synchronous classification prediction and classification feature sharing of each CVSS metric are achieved.

Description

Technical Field

[0001] This invention relates to an assessment method, and more particularly to an automated quantitative assessment method for cybersecurity risks in distribution network cyber-physical systems. Background Technology

[0002] Existing cybersecurity risk assessment methods for distribution network cyber-physical systems (CPS) primarily model attack paths using attack graphs and quantify risks based on Common Vulnerability Scoring System (CVSS) information from vulnerability databases. However, these methods mostly rely on manual attack graph construction and are highly dependent on CVSS information in vulnerability databases, making them unable to address common situations where CVSS information is missing.

[0003] While information and communication technologies (ICT) bring intelligence to the development of power distribution networks, they also introduce the vulnerability to cyberattacks. Power distribution network cybersecurity systems (CPS) are typical examples of cyber-physical systems, and cyberattacks targeting them often exploit vulnerabilities or security flaws in information equipment (i.e., secondary power equipment), employing multi-host, multi-step attack methods to ultimately impact power facilities (i.e., primary power equipment). Cybersecurity risk assessment methods for power distribution network CPS can employ attack graphs to model attack paths and use CVSS information provided by vulnerability databases for risk quantification calculations to guide targeted security protection strategies and improve the resilience of power distribution network CPS against cyberattacks.

[0004] Attack graphs are a key technology for automated risk assessment. Compared to other risk assessment methods, attack graphs do not focus on individual vulnerabilities but rather model the interaction between the attacker's lateral movement and vulnerabilities, making them more suitable for modeling complex multi-host, multi-step attacks. Specifically, attack graph-based risk assessment methods analyze the target network from the attacker's perspective, using network configuration and vulnerability information to uncover all possible attack paths. Furthermore, it visualizes the attack process, intuitively showing the correlation between vulnerabilities and network configurations within the target network, and the potential risks they pose. Based on the uncovered attack paths, high-risk nodes on the target network can be identified, guiding network security managers to take targeted defensive measures; when an attack occurs, the attacker's intent can also be inferred, guiding targeted countermeasures.

[0005] CVSS is an internationally recognized vulnerability scoring standard designed to help organizations and security experts quantify the severity of vulnerabilities. The "Severity Level" information in the vulnerability database is the CVSS score of a vulnerability. CVSS consists of three measurement groups: Basic, Time, and Environment. The Basic measurement group represents the inherent characteristic of a vulnerability that does not change over time or with the user environment; the Time measurement group reflects the characteristics of a vulnerability that change over time; and the Environment measurement group represents the vulnerability characteristics specific to the user environment. The Basic measurement group provides a score from 0 to 10 for a vulnerability, with higher scores indicating more severe vulnerabilities. This is the portion recorded in the vulnerability database, while the other two measurement groups are less commonly used.

[0006] (2) Existing solutions

[0007] The existing solution [Wang Jinfang, Guo Yuanbo. Network security risk assessment of physical information systems based on attack graphs [J]. Science Technology and Engineering, 2023, 23(28): 12175-12181.] defines risk as the product of attack probability, attack impact, and power recovery factor, as shown in the following formula:

[0008]

[0009] In equation (2-1): R is the final risk of CPS; C represents the probability of successfully attacking the target. cs For the impact on communication networks; C ps For the impact on the power system; F re This is the power system recovery factor. Please refer to the above for the explanation of the subscripts. "re" means recovery, and "goal" means a successful attack.

[0010] Attack success rate and attack gain are calculated based on the attack graph. The attack graph is defined as AG = (S, E, P, B, C), where S is the set of attribute state nodes; E is the set of directed edges; P is the set of single-step attack success probabilities; and PB is the set of attack success probabilities. i State node S i To S i+1 B is the transition probability; B is the single-step attack benefit, i.e., the threat to the system from each attack; C is the attack cost of a single-step attack; i, i+1 represent the vulnerability index.

[0011] Node S i The probability of successfully attacking vulnerability i is expressed as:

[0012]

[0013] In equation (2-2): The probability of exploiting the vulnerability, referring to CVSS version 3.1, is calculated using the following formula:

[0014]

[0015] In equation (2-3): i represents the vulnerability index, and the superscript l indicates the exploited AV. i AC i PR i UI i These represent the attack vector, attack complexity, privilege requirements, and user interaction in the basic attribute group of CVSS, respectively, all indicating the static feature score of the vulnerability; RE i and EX i ω represents the patch fixation level and vulnerability exposure level of the vulnerability, respectively, and represents the dynamic characteristic score of the vulnerability; ω, δ, γ, ξ, θ, and λ are the weights of different factors on the probability of successful exploitation of the vulnerability.

[0016] Regarding the extent of vulnerability remediation (RE) i and vulnerability exposure level EX i The calculations are performed using the Weibull and Pareto distributions, respectively, with the following formulas:

[0017]

[0018]

[0019] In equations (2-4) and (2-5): T i Let be the duration of vulnerability i's release; α and β are the parameters of the Weibull and Pareto distributions, respectively.

[0020] The formula for calculating an attacker's ability to exploit vulnerabilities in a target node is as follows:

[0021]

[0022] In equation (2-6): k represents the attacker's proficiency with the knowledge, and k∈[0,1]; N i t represents the total number of vulnerabilities; t represents the number of times an attacker targets vulnerability i.

[0023] Single-step attack gain is the benefit gained by the attacker at each step of the attack, which can be expressed as:

[0024]

[0025] In equation (2-7): and They are respectively the intrusion system node S i and S i+1 The threat value to the network, i.e., node S i To S i+1 Single-step attack buff; For node Si The attack complexity of exploitable vulnerability i is in the range of [1, 10], i.e., the attack complexity of attack node S. i The cost of the attack.

[0026] Based on the single-step attack success rate and single-step attack gain mentioned above, the cumulative attack success rate and cumulative attack benefit can be calculated using the following formula:

[0027]

[0028]

[0029] The impact of a network attack on the network system layer is assessed by the latency of data packets sent from the control center to the interval layer OT devices, calculated using the following formula:

[0030]

[0031] In equation (2-10): N substation For the nth substation; RTT avg,i T represents the average round-trip time of the i-th data packet; margin The minimum acceptable latency is indicated by avg and margin, which are used to mark different latency levels.

[0032] By analyzing the state of the power system before and after the cyberattack, the overall impact on the power system operation is calculated using the following formula:

[0033] C ps =ω1C1+ω2C V (2-11)

[0034] In equation (2-11): ω1 and ω2 are empirical weighting factors, ranging from [0, 100]; C1 and C2 are empirical weighting factors. V These are the load losses and voltage deviation, which are influencing factors of the power system, and their calculation formulas are as follows:

[0035]

[0036]

[0037] In equations (2-12) and (2-13): N load N represents the load of the nth node; voltage The voltage at the nth node; ΔU i When a network attack occurs, the node voltage is affected, causing a drop in system node voltage; P init,i For initial load loss; ΔP load,i This represents the difference in load loss before and after the network attack. and These represent the upper and lower voltages of physical node i before the network attack occurred.

[0038] The power system recovery factor, used to quantify the effort required to restore the power system after a cyberattack, takes into account generator disconnections as well as generation capacity and type, and is formulated as follows:

[0039]

[0040] In equation (2-14): F re N is the power system recovery factor. generator The nth generator; P nominal,i P represents the nominal capacity of generator i; total The total installed capacity of the power system; a i The generator circuit breaker status is represented by 1, indicating the circuit breaker is open. T is initialized to 0 and calculated based on the type of generator that is disconnected. The calculation formula is as follows:

[0041]

[0042] In equation (2-15): T i 'This is the recovery index for generator i.

[0043] The recovery process begins simultaneously with the disconnection of the generator set. The power system recovery index is given by the generator's maximum recovery index. Generator sets with black-start capability, such as hydroelectric power plants, have a recovery index of 0.5, while thermal power plants have a recovery index of 0.8. The recovery index for connections to adjacent power grids is 1, because resynchronization can only begin after the power system recovery is complete.

[0044] Existing methods primarily rely on manual attack graph construction and are highly dependent on CVSS information from vulnerability databases. However, these methods are ineffective in addressing common issues such as missing CVSS information. This invention proposes a quantitative assessment method for automated network security risks in distribution network CPS. It utilizes open-source tools to solve the problem of automatic attack graph generation and addresses the CVSS information dependency issue through a CVSS metric classification and prediction model. Existing CVSS metric classification and prediction methods suffer from problems such as large model size, high time cost, data imbalance, and neglect of correlations between metrics. The prediction model implemented in this invention outperforms these methods in terms of accuracy, model size, and time cost. Summary of the Invention

[0045] To address the shortcomings of existing technologies, this invention discloses an automated quantitative assessment method for cybersecurity risks in distribution network cyber-physical systems, the technical solution of which is as follows:

[0046] Step 1: Use the Nessus vulnerability scanner to scan the target network for vulnerabilities;

[0047] Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy;

[0048] Step 3: Based on the vulnerability scan results, search for the corresponding vulnerability description in the vulnerability database, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model;

[0049] Step 4: Based on the attack graph, CVSS metric, and input physical consequences, perform a quantitative assessment of system risk and calculate the risk value of each node in the target network.

[0050] Beneficial effects

[0051] (1) This invention proposes a quantitative assessment method for network security risks of CPS automation in distribution networks. It uses open-source tools to solve the problem of automatic generation of attack graphs and solves the problem of CVSS information dependence through a CVSS metric classification prediction model.

[0052] (2) This invention proposes a CVSS metric classification prediction model based on multi-task learning. The model designs a network layer structure that integrates hard parameter sharing and soft parameter sharing, taking into account the uniqueness of the task and the correlation between tasks in the modeling. By designing multiple classifiers that share a multi-layer network, synchronous classification prediction and classification feature sharing of each CVSS metric are achieved. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of the risk quantitative assessment framework of the present invention;

[0054] Figure 2 This is a schematic diagram of the CVSS metric classification prediction model of the present invention. Detailed Implementation

[0055] This invention proposes a quantitative risk assessment method based on attack graphs and vulnerability CVSS metrics. (See [link to relevant documentation]). Figure 1 As shown, the process for quantitative risk assessment is as follows:

[0056] Step 1: Use the Nessus vulnerability scanner to scan the target network for vulnerabilities;

[0057] Nessus is a popular vulnerability scanning tool that identifies potential security risks and patches them promptly. When performing a vulnerability scan, Nessus progressively scans the target system for open ports, operating system vulnerabilities, application vulnerabilities, and more. During the scan, Nessus attempts to match potential vulnerabilities in the target system against its known vulnerability database. Scanning time depends on the size of the target system and the depth of the scan settings.

[0058] After the scan is complete, Nessus will generate a detailed scan report. The report is divided into several parts:

[0059] (1) Vulnerability risk level

[0060] Nessus rates each vulnerability based on its severity (e.g., Critical, High, Medium, Low).

[0061] (2) Vulnerability description and remediation recommendations

[0062] Each vulnerability will be accompanied by a detailed description, including the vulnerability name, vulnerability description, vulnerability impact, vulnerability CVE number, and suggestions for vulnerability remediation or official remediation methods.

[0063] Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy;

[0064] MulVAL is a tool for analyzing cybersecurity vulnerabilities. It generates attack graphs based on input vulnerability scan results, network topology, and security policies. The purpose of attack graphs is to help security experts understand how attackers might exploit vulnerabilities in the network, simulate potential attack paths, and thus identify and mitigate cybersecurity risks.

[0065] In MulVAL, attack paths are deduced through logical rules that consider multiple factors such as vulnerability exploitation, network communication, access control, and protective measures. The core of MulVAL is attack graph generation based on logical reasoning. It generates attack graphs through the following steps:

[0066] (1) Vulnerability Modeling

[0067] MulVAL first converts the vulnerabilities in the scan results into nodes in a graph model. Each vulnerability node contains detailed information about the vulnerability, such as: the type of vulnerability, the impact of the vulnerability, and the conditions for exploitation.

[0068] (2) Network topology modeling

[0069] Network topology information is modeled as edges in a graph, representing connections between different devices and nodes in the network. MulVAL represents network devices, routers, firewalls, etc., as nodes in the network topology and connects these nodes through edges.

[0070] (3) Modeling of security strategies

[0071] Security policies model access control for network devices. MulVAL can determine whether an attacker can reach a target system through certain paths under a specific security policy. The model of a security policy can include firewall rules, access control mechanisms, authentication mechanisms, etc.

[0072] (4) Reasoning of attack paths

[0073] MulVAL uses a set of logical rules (typically based on predicate logic or modal logic) to infer possible attack paths. These rules include: exploit rules, privilege escalation rules, and lateral movement rules. MulVAL uses these rules to infer possible attack paths from the attacker's initial point to the final target.

[0074] (5) Visualization of attack graphs

[0075] MulVAL will generate an attack graph that shows possible attack paths, including: the attacker's initial entry point, the steps to exploit the vulnerability, lateral movement across network boundaries, and the achievement of the final goal.

[0076] Step 3: Based on the vulnerability scan results, search for the corresponding vulnerability description in the vulnerability database, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model;

[0077] The CVSS metric classification prediction model models the CVSS classification prediction task as eight text classification tasks targeting NVD vulnerability description text, capable of simultaneously classifying and predicting all CVSS metrics. See the appendix for the overall model structure. Figure 2 The model consists of a shared network layer, an expert network layer, a gated network layer, and a tower network layer.

[0078] The shared network layer uses DistilBERT as the encoder and a feedforward neural network as the feature extractor. The input text is first segmented into a token sequence by the WordPiece tokenizer and then transformed into a computable token embedding sequence, which is input into the DistilBERT model. The stacked Transformer encoder models within DistilBERT further extract semantic features, outputting a sequence of word vectors corresponding to the token sequence. The [CLS] word vectors from the sequence are taken as input, and after linear transformation, they become the sentence feature vectors for the upper-layer model.

[0079] The expert network layer consists of three expert networks with the same structure. Each expert network consists of a simple linear layer and a ReLU activation function layer. The sentence feature vector output from the shared network layer is input into the expert networks to obtain three feature vectors.

[0080] The gated network layer consists of eight gated networks, each comprising stacked linear layers, ReLU activation function layers, and softmax layers. The output of the shared network layer is transformed into an N-dimensional vector (N being the number of expert networks) after two rounds of linear computation, and then normalized using the softmax activation function to obtain the output weights of each expert network. All outputs of the expert network layer are weighted and summed based on the output weights learned by the task-specific gated networks, serving as the input to the task-specific tower network.

[0081] The tower network layer consists of 8 tower networks, each of which is a simple softmax layer. The tower network first performs linear operations on the input feature vector, and then uses the softmax activation function to transform it into a classification probability distribution corresponding to the CVSS metric.

[0082] Vulnerability databases are currently the primary source of vulnerability information, recording a vast amount of vulnerability-related information in structured and semi-structured formats. Common Vulnerabilities & Exposures (CVE) is a globally recognized vulnerability dictionary maintained by MITRE, assigning unique names to widely recognized information security vulnerabilities or weaknesses. Using this CVE name, more vulnerability-related information can be obtained from numerous CVE-compatible databases.

[0083] NVD is a comprehensive vulnerability database maintained by the National Institute of Standards and Technology (NIST) in the United States. It is also the most complete CVE vulnerability data source and is widely used in vulnerability classification and related research. The NVD vulnerability database provides historical vulnerability files in both JSON and XML formats, containing information such as the vulnerability's CVE number, vulnerability description, vulnerability score, and vulnerability solution.

[0084] The China National Vulnerability Database (CNVD) is the most important vulnerability database in China, containing a large number of publicly disclosed vulnerabilities in domestically developed software. Based on the industry sectors or application types affected by the vulnerabilities, CNVD categorizes vulnerabilities into the types shown in Table 8-1. A CNVD vulnerability record includes information such as the CNVD number, the time of publication / reporting / inclusion / update, the severity level, affected products, CVE number, vulnerability description, patch, and solution.

[0085] Table 8-1 CNVD Vulnerability Classification

[0086]

[0087]

[0088] In addition to CVE, MITRE has also initiated or operated several knowledge bases in the field of cybersecurity, including CAPEC (Common Attack Pattern Enumeration and Classification), CWE (Common Weakness Enumeration), ATT&CK (Adversarial Tactics, Techniques and Common Knowledge). Together they have built a security ecosystem that covers threat modeling, attack classification, threat intelligence and other aspects. CAPEC is a publicly available directory of common attack patterns that records important information such as attack name, probability of occurrence, attack severity, and implementation conditions in a semi-structured form. The CWE database contains network defects of all software and hardware products and classifies and identifies vulnerability types, vulnerability-related security issues and vulnerability prevention measures. The ATT&CK model

[58] was launched by MITRE in 2013 and is constantly updated based on actual observation data. It is recognized as an authority on understanding the behavioral models and technologies used by attackers against enterprises. The ATT&CK model covers four dimensions: organization, software, assets, tactics and technology matrix. It presents the tactics and technologies used by network attackers when carrying out network attacks in a structured form.

[0089] CVSS:

[0090] In the most widely used CVSS 3.x version, the base measure group consists of two sub-measure groups and one scope (S) measure. The possible values ​​and corresponding scores for each measure in the base measure group are shown in Table 8-2.

[0091] The Exploitability sub-metric group primarily measures the likelihood of a vulnerability being successfully exploited, including four metrics: Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), and User Interaction (UI). The Impact sub-metric group includes three metrics: Confidentiality (C), Integrity (I), and Availability (A). All metrics in the CVSS basic metric group can be represented by a CVSS vector, with each metric indicated by a colon (:) and separated by slashes ( / ), such as "AV:N / AC:L / PR:N / UI:N / S:U / C:N / I:N / A:H".

[0092] The AV metric primarily reflects the environment in which vulnerabilities can be exploited; the farther the attacker is from exploiting the vulnerability, the higher the score. The AC metric measures the complexity of vulnerability exploitation; attackers must meet certain conditions to successfully exploit the vulnerability. The PR metric indicates the privilege level an attacker must have to successfully exploit the vulnerability; it scores highest when no special privileges are required. The UI metric indicates whether an attacker can exploit the vulnerability without the involvement of other users. The C, I, and A metrics respectively measure the impact of successful vulnerability exploitation on component confidentiality, integrity, and availability.

[0093] Table 8-2 CVSS metric classification and scoring

[0094]

[0095]

[0096] Compared to CVSS version 2.0, CVSS version 3.x has made adjustments to both metrics and scores. One newly introduced concept is "Scope" (S), which indicates whether a vulnerability in a component will affect resources outside the component or grant privileges outside the component. It has two possible values: "unchanged" and "variable." The value of "Scope" affects the score for "required privileges" and also influences the vulnerability's score calculation. Specifically, the base score depends on the impact and exploitability, calculated using equations (8-1), (8-2), (8-3), and (8-4):

[0097] ISS=1-[(1-C)×(1-I)×(1-A)] (8-1)

[0098] (8-2)

[0099] Exploitability=8.22×AV×AC×PR×UI (8-3)

[0100]

[0101] The Roundup function returns the smallest number greater than or equal to the input parameter, with one decimal place (e.g., Roundup(4.02) returns 4.1, and Roundup(4.00) returns 4.0); the Min function returns the smaller of the two input parameters.

[0102] Step 4: Based on the attack graph, CVSS metric classification, and input physical consequences, perform a quantitative assessment of system risk and calculate the risk value of each node in the target network.

[0103] The attack graph establishes the attack paths to the target network, while the CVSS metric assigns an initial probability to each network node. A Bayesian network is then used to further calculate the probability of a node's attack success and the probability of the attack path occurring. Finally, the probability and consequence metrics are used to calculate the final risk value, as shown in formula (4-1):

[0104] R = P·C

[0105] (4-1)

[0106] In Equation (4-1), R represents the risk value, P represents the probability of a successful attack, and C represents the consequences of successful exploitation of the vulnerability in the distribution network CPS.

[0107] Calculation of attack success probability:

[0108] An attack graph can be defined as AG = (S, τ, P, p), where S is the set of nodes, τ is the set of directed edges, P represents the set of probabilities of nodes being successfully exploited, and p represents the set of initial probabilities of nodes. Nodes can be further divided into three categories: S = {F, A, D}, where F is the set of basic fact nodes, A is the set of exploited nodes, and D is the set of derived fact nodes. Directed edges are composed of triplets τ. i,j =(S i ,S j Let S, e ∈ {AND, OR}, represent the head node S. i Tail node S j There is an "AND" or "OR" relationship.

[0109] When calculating the success probability of an attack on a node, it is necessary to consider both the success probabilities of attacks on all preceding nodes and the node's own initial probability. Based on the initial probabilities, the probability P of each node being successfully exploited is further calculated using a Bayesian network. i The formula for calculation is shown in equation (4-2):

[0110]

[0111] In equation (4-2), m represents node S. i The number of preceding nodes in the AND relation, where n is the number of nodes S. i The number of preceding nodes in the "OR" relation. This represents the probability of a successful attack on the j-th preceding node.

[0112] For node S i Assign initial probability p i At that time, the initial probability of the basic fact node and the derived fact node is assigned to 1, that is... The initial probability of exploiting a node needs to consider both the attacker's capabilities and the nature of the vulnerability itself, as node exploitation is primarily related to vulnerability exploitation. The following factors should be considered when calculating the initial probability:

[0113] (1) Exploitation Difficulty (EL). The greater the exploit difficulty, the lower the probability of a successful attack. The exploit difficulty is calculated using attack vector (AV), attack complexity (AC), required privileges (PR), and user interaction (UI) metrics in CVSSv3.1. The calculation is shown in formula (4-3):

[0114] EL = 8.22 × AV × AC × PR × UI

[0115] (4-3)

[0116] (2) Average vulnerability exposure (EX). The longer the time since the vulnerability was released, the more information is available about the vulnerability, and therefore the higher the success rate of the attack. This can be measured using the Pareto distribution, as shown in equation (4-4):

[0117]

[0118] (4-4)

[0119] In equation (4-4), T is the duration of the vulnerability release, and k and α are the parameters of the Pareto distribution, with values ​​of 0.00161 and 0.26, respectively.

[0120] (3) Average Remediation Rate (RE). The longer the time since the vulnerability was released, the higher the remediation rate and the lower the attack success rate. This can be measured using the Weibull distribution, as shown in equation (4-5):

[0121]

[0122] (4-5)

[0123] In equation (4-5), T is the duration of the vulnerability release, and λ and β are the parameters of the Weibull distribution, with values ​​of 0.209 and 4.04, respectively.

[0124] Based on the above analysis, using node A i The initial probability p of being successfully utilized i This can be expressed by formula (4-6):

[0125] p i =Softmax(EL i ×EX i / RE i )

[0126] (4-6)

[0127] In equation (4-6) EL i EX i RE irepresents the difficulty of exploiting vulnerability i, the average exposure level, and the average repair level, respectively, and Softmax is the normalization function.

[0128] Attack consequences calculation:

[0129] Distribution network cybersecurity systems (CPS) are complex systems deeply coupled in information space and cyberspace. Therefore, when assessing the cybersecurity risks of distribution network CPS, it is necessary to consider both the consequences of successful vulnerability exploitation in information space and the consequences of faults caused in physical space. The risks are defined as shown in formula (4-7):

[0130] C = C cs +C ps

[0131] (4-7)

[0132] In equation (4-7), C cs and C ps These represent the consequences in the information space and physical space of the distribution network CPS, respectively.

[0133] The impact of successful exploitation of the vulnerability on the CPS information space of the distribution network. CS The confidentiality (C), integrity (I), availability (A), and scope (S) metrics in the vulnerability CVSS can be used for calculation. First, let's calculate the CVSS metric ISS. The calculation formulas are shown in equations (4-8) and (4-9):

[0134] ISS = 1 - [(1-C) × (1-I) × (1-A)]

[0135] (4-8)

[0136]

[0137] The physical impact of a successful exploit C ps The impact can be calculated using electrical parameters such as load loss and voltage deviation before and after the vulnerability exploitation. The physical space impact C ps Directly using the input quantized value is not the focus of this method.

[0138] This invention proposes an automated quantitative risk assessment method for distribution network CPS based on an attack graph and vulnerability CVSS metric risk assessment framework. The framework integrates the open-source Nessus vulnerability scanner and the MulVAL attack graph generation tool, as well as a CVSS metric classification and prediction model, effectively solving the challenges of automatic attack graph generation and CVSS information dependence, thus providing strong support for distribution network CPS cybersecurity risk assessment.

[0139] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. An automated quantitative assessment method for cybersecurity risks in distribution network cyber-physical systems, characterized by: Step 1: Use the Nessus vulnerability scanner to scan the target network for vulnerabilities; Step 2: The MulVAL tool generates an attack graph using the vulnerability scan results and the input network topology and security policy; Step 3: Based on the vulnerability scan results, search for the corresponding vulnerability description in the vulnerability database, and output the CVSS metric classification of the vulnerability through the CVSS metric classification prediction model; Step 4: Based on the attack graph, CVSS metric, and input physical consequences, perform a quantitative assessment of system risk and calculate the risk value of each node in the target network; Its features are as follows: the prediction model is a CVSS metric classification prediction model based on multi-task learning. This prediction model models the CVSS classification prediction task as 8 text classification tasks for NVD vulnerability description text, and can simultaneously perform classification prediction for all CVSS metrics.

2. The quantitative assessment method for automated network security risks of distribution network cyber-physical systems according to claim 1, characterized in that: The attack graph establishes the attack path of the target network, and the CVSS metric assigns an initial probability to each network node. A Bayesian network can then be used to further calculate the probability of a node's attack success and the probability of the attack path occurring. Finally, the final risk value can be calculated using the probability and consequence indices, as shown in formula (4-1): （4-1） in: Indicates the risk value. This represents the set of probabilities that a node is successfully utilized. This indicates the consequences of successfully exploiting the vulnerability in a distribution network CPS. Calculation of the probability of a node being successfully exploited: The attack graph is defined as follows: , For a set of nodes, Let be a set of directed edges. This represents the set of probabilities that a node is successfully utilized. This represents the initial probability set of nodes; the nodes can be further divided into three categories. , For the set of basic fact nodes, To utilize the node set, It is a set of derived fact nodes; directed edges are composed of triples. , indicating the head node Tail node There exists an "AND" or "OR" relationship, where i represents the index of the head node and j represents the index of the head node.

3. The quantitative assessment method for automated network security risks of distribution network cyber-physical systems according to claim 1, characterized in that: When calculating the success probability of an attack on a node, it is necessary to consider both the success probabilities of attacks on all preceding nodes and the node's own initial probability. Based on the initial probabilities, the probability of each node being successfully exploited is calculated using a Bayesian network. The formula for calculation is shown in equation (4-2): （4-2） In equation (4-2), i represents the index of the head node, and j represents the index of the head node. For nodes The number of preceding nodes in the AND relationship. For nodes The number of preceding nodes in the "OR" relation. Representing the The probability of a successful attack on a given preceding node; for a node Assign initial probability At that time, the initial probability of the basic fact node and the derived fact node is assigned to 1, that is... .

4. The quantitative assessment method for automated network security risks of distribution network cyber-physical systems according to claim 3, characterized in that: exist The following factors should be considered when calculating the initial probability: (1) Exploitation difficulty EL; the greater the exploitation difficulty, the lower the probability of successful attack. The exploitation difficulty is calculated using attack vector AV, attack complexity AC, required privileges PR, and user interaction UI metrics in CVSS v3.

1. The calculation is shown in formula (4-3): （4-3） (2) Average vulnerability exposure level EX; The longer the time since the vulnerability was released, the more information is available about the vulnerability, and therefore the higher the success rate of the attack; this can be measured using the Pareto distribution, as shown in equation (4-4): （4-4） In equation (4-4) The duration of the vulnerability's release, and These are the parameters of the Pareto distribution; (3) Average vulnerability repair level (RE); the longer the time since the vulnerability was released, the higher the repair level and the lower the attack success rate; the Weibull distribution is used to measure this, see equation (4-5): （4-5） In equation (4-5) The duration of the vulnerability's release, and These are the parameters of the Weibull distribution; Utilizing nodes The initial probability of being successfully utilized Expressed using formula (4-6): （4-6） In equation (4-6) , , These represent vulnerabilities. The ease of use, average exposure level, and average repair level. Here, i is the normalization function, representing the vulnerability index. Attack consequences calculation: Distribution network cybersecurity systems (CPS) are complex systems deeply coupled in information space and cyberspace. Therefore, when assessing the cybersecurity risks of distribution network CPS, it is necessary to consider both the consequences of successful vulnerability exploitation in information space and the consequences of faults caused in physical space. The risks are defined as shown in formula (4-7): （4-7） In equation (4-7) and These represent the consequences indicators in the information space and physical space of the distribution network CPS, respectively; the subscripts cs and ps represent the information space and physical space, respectively. Impact of successful exploitation of the vulnerability on the CPS information space of the distribution network We will use the confidentiality (C), integrity (I), availability (A), and scope (S) metrics from the vulnerability CVSS to perform calculations, where U represents immutability and C represents variability. First, we will calculate the CVSS metrics. The calculation formulas are shown in equations (4-8) and (4-9): （4-8） （4-9） The physical impact of a successful exploit Calculations were performed based on load loss and voltage deviation power indicators before and after vulnerability exploitation; the impact of physical space was also considered. The input quantized value is used directly.

5. The quantitative assessment method for automated network security risks of distribution network cyber-physical systems according to claim 1, characterized in that: The prediction model includes a shared network layer, an expert network layer, a gated network layer, and a tower network layer. Shared network layer: DistilBERT is used as the encoder, and a feedforward neural network is used as the feature extractor; The input text is first segmented into a token sequence by the WordPiece tokenizer and then converted into a computable token embedding sequence, which is then input into the DistilBERT model. The stacked Transformer encoder model inside DistilBERT further extracts semantic features and outputs a sequence of word vectors corresponding to the token sequence. The [CLS] word vector in the sequence is taken as input and, after linear transformation, is used as the sentence feature vector of the upper-layer model. Expert network layer: It consists of 3 expert networks with the same structure. Each expert network consists of a simple linear layer and a ReLU activation function layer. The sentence feature vector output by the shared network layer is input into the expert network to obtain 3 feature vectors. Gated network layer: It consists of 8 gated networks. Each gated network consists of stacked linear layers, ReLU activation function layers and Softmax layers. The output of the shared network layer is transformed into an N-dimensional vector after two rounds of linear operations. Then, it is normalized using the Softmax activation function to obtain the output weights of each expert network. All outputs of the expert network layer are weighted and summed according to the output weights learned by the task-specific gated network, and used as the input of the task-specific tower network. Tower network layer: It consists of 8 tower networks, each of which is a simple softmax layer. The tower network first performs linear operations on the input feature vector, and then uses the softmax activation function to transform it into the classification probability distribution of the corresponding CVSS metric.

6. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein the program, when executed, controls the device where the non-volatile storage medium is located to perform the method described in any one of claims 1 to 5.

7. An electronic device, characterized in that, It includes a processor and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform the method according to any one of claims 1 to 6.

Images