Industrial control system risk assessment method and system, computer equipment and storage medium

Abstract

The invention is suitable for the technical field of industrial control system safety, and provides an industrial control system risk assessment method and system, computer equipment and a storage medium, and the industrial control system risk assessment method comprises the steps: determining an overall system risk value of an industrial control system based on a preset hierarchical risk assessment model, under the condition that the overall system risk value meets a preset condition, determining the probability of attacking to select each target based on a preset attack and defense game model, and determining attack propagation information based on a preset time probability Petri network model and the probability of attacking to select each target; wherein the attack propagation information comprises an attack propagation path and an attack propagation probability, so that the security risk in the ICS can be identified and evaluated more accurately, a basis is provided for formulating an effective defense strategy, and the overall security and reliability of the ICS are improved.

Description

Technical Field

[0001] The present application belongs to the field of industrial control system security technology, and in particular, relates to an industrial control system risk assessment method, system, computer equipment and storage medium. Background Art

[0002] Industrial Control System (ICS) is an automation system specially designed for monitoring and controlling industrial processes. It plays an important role in critical infrastructure and other fields. Therefore, it is also crucial to ensure its security and reliability. Due to the specific design and operating environment of ICS, the devices in ICS often cannot perform system upgrades or patch installations in a timely manner, which leads to a large number of unpatched vulnerabilities in the information layer devices, which may be exploited by attackers to attack the devices. At the same time, in the ICS information layer, various devices or hosts are connected through communication networks, cooperate with each other, and rely on each other to complete complex system functions. As a carrier of data interaction, the communication network has also become a way for attacks to spread. Network attacks can be spread through communication networks within and between various levels of the information layer, increasing the security risk of the system. In view of this, there is no good solution in the existing technology. Summary of the invention

[0003] The embodiments of the present application provide an industrial control system risk assessment method, system, computer device, and storage medium, which can more accurately identify and assess security risks in ICS, provide a basis for formulating effective defense strategies, and improve the overall security and reliability of ICS.

[0004] In a first aspect, an embodiment of the present application provides an industrial control system risk assessment method, including:

[0005] Determine the overall system risk value of the industrial control system based on the preset hierarchical risk assessment model;

[0006] When the overall system risk value meets the preset conditions, the probability of attacking each target is determined based on the preset attack and defense game model;

[0007] Based on a preset time probability Petri net model and the probability of attacking each target, attack propagation information is determined; wherein the attack propagation information includes an attack propagation path and an attack propagation probability.

[0008] In a possible implementation of the first aspect, the hierarchical risk assessment model includes a target layer, an element layer, an evaluation layer and an attack and defense game layer; the target layer includes the overall system risk value of the industrial control system; the element layer includes the enterprise management layer, the process monitoring layer and the field control layer; the evaluation layer includes equipment assets; the attack and defense game layer includes attack methods and defense methods.

[0009] In a possible implementation of the first aspect, determining the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model includes:

[0010] In the attack and defense game layer, a mixed strategy Nash equilibrium and defender benefits are obtained based on the acquired attack and defense data;

[0011] According to the mixed strategy Nash equilibrium and the defender's profit, the first security risk value r of each attack method is calculated. i ;

[0012] Obtain the first weight w″ of each attack method for the device assets in the evaluation layer i ;

[0013] According to the first weight w″ i and the first safety risk value r i , and obtain the second safety risk value R of equipment assets under different factor layers i ;

[0014] Get the second weight w′ of each equipment asset for each structural layer in the element layer i ;

[0015] According to the second weight w′ i and the second safety risk value R i , get the third safety risk value R′ of each structural layer in the element layer;

[0016] According to the third safety risk value R′ and the weight w of each structural layer to the overall system risk value i , and obtain the overall system risk value R all .

[0017] In a possible implementation manner of the first aspect, when the overall system risk value meets a preset condition, determining the probability of attacking each target based on a preset attack and defense game model includes:

[0018] When the overall system risk value is greater than a preset safety threshold, based on the attack-defense game model, the probability of attacking each target is determined;

[0019] Alternatively, a corresponding risk level is determined based on the overall system risk value, and when the risk level is greater than a preset safety level, a probability of attacking each target is determined based on the attack-defense game model.

[0020] In a possible implementation manner of the first aspect, determining the probability of attacking and selecting each target based on a preset attack and defense game model includes:

[0021] For each strategy combination in the attack and defense game model, quantify the gains and losses of both the attacker and the defender;

[0022] Construct a profit matrix based on quantified gains and losses;

[0023] The Nash equilibrium is solved based on the payoff matrix to determine the probability of attacking each target.

[0024] In a possible implementation manner of the first aspect, determining the attack propagation information based on a preset time probabilistic Petri net model and the probability of selecting each target for attack includes:

[0025] The acquired time probability and the probability of attacking each target are input into the time probability Petri net model to obtain the attack propagation path and the attack propagation probability corresponding to each attack propagation path.

[0026] In a possible implementation manner of the first aspect, the attack and defense game model is optimized based on the acquired attack and defense data and the attack propagation information.

[0027] In a second aspect, an embodiment of the present application provides an industrial control system risk assessment system, including:

[0028] A risk value determination module, used to determine the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model;

[0029] An attack probability determination module, used to determine the probability of attacking each target based on a preset attack and defense game model when the overall system risk value meets a preset condition;

[0030] The attack propagation information determination module is used to determine the attack propagation information based on a preset time probability Petri net model and the probability of attacking each target; wherein the attack propagation information includes the attack propagation path and the attack propagation probability.

[0031] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the industrial control system risk assessment method described in any one of the first aspects is implemented.

[0032] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the industrial control system risk assessment method described in any one of the first aspects is implemented.

[0033] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer device, the computer device executes the industrial control system risk assessment method described in any one of the first aspects above.

[0034] Compared with the prior art, the embodiments of the present application have the following beneficial effects: first, based on the preset hierarchical risk assessment model, the overall system risk value of the industrial control system is determined, which can accurately identify the current security risk level faced by the system and provide decision makers with a clear security situation awareness. When the overall system risk value reaches the preset conditions, the attack and defense game model and the time probability Petri net model are dynamically applied. The attack and defense game model can predict the targets that the attacker may choose and their probabilities, helping defenders understand the attacker's potential intentions and behavior patterns. The time probability Petri net model provides an effective tool for simulating the spread of attacks, which can predict the attack propagation path and attack propagation probability of attacks in the system, so that the security risks in the ICS can be more accurately identified and evaluated, providing a basis for formulating effective defense strategies and improving the overall security and reliability of the ICS.

[0035] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 It is a flowchart of an industrial control system risk assessment method provided by an embodiment of the present application;

[0038] Figure 2 It is a schematic diagram of the architecture of a hierarchical risk assessment model provided in an embodiment of the present application;

[0039] Figure 3 is a flowchart of an industrial control system risk assessment method provided by another embodiment of the present application;

[0040] Figure 4 It is a schematic diagram of the structure of the industrial control system risk assessment system provided by the embodiment of the present application;

[0041] Figure 5 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0043] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0044] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0045] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0046] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0047] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0048] In order to facilitate the understanding of the solution, the algorithms and other related contents involved in this application are first introduced here.

[0049] Fuzzy Analytic Hierarchy Process (FAHP)

[0050] FAHP combines AHP with fuzzy comprehensive evaluation. Experts then give priority relationship values ​​based on the experience of each layer of the hierarchical structure, thereby obtaining a fuzzy judgment matrix for comparing each layer of elements. This method can solve the complex process of consistency testing in the hierarchical analysis method, thereby improving the work efficiency of FAHP. The basic principles and operating steps of FAHP and AHP are roughly the same, as follows:

[0051] (a1) Establishing a hierarchical model

[0052] According to the system characteristics, the elements that affect the target results are analyzed and the relationship between each element is determined to establish a hierarchical model of the system.

[0053] (a2) Establishing the fuzzy judgment matrix

[0054] According to the fuzzy judgment of the experts on the elements 1, 2, ..., n of each layer, corresponding to the numerical scale table of element priority relationship listed in the table below, the elements are compared and their importance is empowered. Finally, the fuzzy judgment matrix of the elements of each layer is obtained in the following form:

[0055]

[0056] The meaning of the elements in the judgment matrix is ​​the importance of the horizontal factors relative to the vertical factors, which is measured by a scale of 1 to 9. The scales 1 to 9 represent increasing importance. The inverse relationship makes the judgment matrix meet the matrix requirements.

[0057] The numerical scale table of the priority relationship of table elements is as follows

[0058]

[0059]

[0060] Table 1

[0061] The fuzzy matrix constructed based on the expert fuzzy judgment is not necessarily consistent, and it needs to be transformed into a fuzzy consistency matrix. The matrix obtained by the transformation is called the fuzzy consistency matrix R′=(f ij )n×n, the conversion method is as follows.

[0062] According to the fuzzy matrix R = (r ij )n×n sums by row, recorded as

[0063]

[0064] The mathematical conversion is as follows:

[0065]

[0066] The judgment matrix R′ established by fuzzy consistent transformation is (f ij )n×n is the fuzzy consistent judgment matrix.

[0067] (a3) Calculate the relative importance (weight value) of each layer element

[0068] After the fuzzy judgment matrix is ​​converted into a fuzzy consistent judgment matrix, the weight value of each element in the evaluation layer or factor layer for the previous layer is calculated according to the following formula:

[0069]

[0070] The parameter α in formula (4) satisfies α>=(n-1) / 2. When α takes the minimum value (n-1) / 2, the difference in the relative weights of various security risk factors reaches the maximum. Therefore, the numerical analysis of the sensitivity of the weight value can be completed by changing the different values ​​of the parameter α.

[0071] (a4) Calculate the comprehensive weight of the factors.

[0072] Using the hierarchical single sorting method, the weight value of each layer of elements to the previous layer of elements is multiplied by the weight value of the next layer of elements to calculate the weight value of each layer of elements to the overall target of the hierarchical model.

[0073] Analysis of attack and defense game model

[0074] (b1) Description of the complete information game model

[0075] A most basic complete information static game model includes three basic elements: participants, participant strategies, and participant payoff functions. In this application, the participants in the game model are represented by the attackers and defenders in the industrial control system, i.e., attackers and defenders. An attack and defense game model is established for the attack methods and defense measures in the industrial control system, and is defined as follows:

[0076] The complete information static attack and defense game model can be defined as a triple, which is as follows:

[0077] (N, S, U) = (N A , N D ), (S A , S D ), (U A , U D )

[0078] Where: N = (N A , N D ) represents the set of participants in the attack and defense game model. N A , N D Represents attacker and defender respectively.

[0079] S=(S A , S D ) represents the set of actions of the participants in the attack and defense game model. Representative attacker N A A set of strategies; Representative Defender N D A collection of strategies.

[0080] The profit function U=(U A , U D ), Indicates the attacker's choice of strategy Defender Selection Strategy When , the attacker's profit function is, Indicates the attacker's choice of strategy Defender Selection Strategy , the defender's payoff function.

[0081] (b2) Calculation of attack and defense benefits

[0082] The quantification of the strategic benefits of both the offensive and defensive parties is the basis for the subsequent analysis of the offensive and defensive game model. As the input of the game model, it directly affects the outcome of the game equilibrium.

[0083] In the embodiment of the present application, due to the differences between industrial control systems and traditional computer networks, the attack and defense benefit calculation methods in computer network security assessment cannot be fully used. Therefore, based on the existing calculation methods, the embodiment of the present application combines the characteristics of industrial control systems to construct a benefit function calculation method different from that of traditional computer networks, and gives the following definition.

[0084] Definition 1: Defender Profit Function DPF, defender’s profit function, the specific calculation formula is shown in formula (5).

[0085] DPF=[-(1-RLR)×SL-DC]×ASR-(1-ASR)×DC+IOA (1)

[0086] Among them, DC represents the defense operation cost, that is, the cost of adopting a certain defense strategy; RLR represents the ratio of system loss reduction, that is, the ratio of loss reduction after the system is attacked due to the adoption of a certain defense strategy; ASR represents the attack success rate; SL represents the system loss cost, that is, the loss that may be caused by the threat to the target system after the attacker launches an attack on the system; IOA represents the attacker information, that is, the attacker information that can be obtained after the system is attacked, which can help managers make subsequent analysis of the attack behavior and is an indirect reward for the defender.

[0087] DC and RLR can be obtained by consulting the data in the defense strategy library, RSR can be obtained based on the system's attack data, and SL can be calculated using the following formula.

[0088] SL=AL×criticity×(I C ×P I +C C ×P C +A C ×P A ) (6)

[0089] Among them, AL and criticality are the degree of danger and the degree of lethality respectively. According to the security protection performance requirements of industrial control systems, the damage to security attributes is divided into completeness cost Ic, confidentiality cost Cc, and availability cost Ac. Since the security attributes of information in industrial control systems have certain weights, they can be expressed as (P I , P C , P A ) represent the weights of the completeness cost Ic, confidentiality cost Cc, and availability cost Ac, respectively, and satisfy P I +P C +P A =1.

[0090] The security attribute cost should be quantified by assigning values ​​to the environment required by the network in actual applications. It can be divided into high and low according to the degree of harm, where high harm can be assigned a value of 20 and low harm can be assigned a value of 10.

[0091] Definition 2: Attacker Profit Function APF represents the attacker's profit function. The specific calculation formula is as follows:

[0092] APF=[(1-RLR)×SL-AC]×ASR-(1-ASR)×AC+IOD (7)

[0093] Among them, AC represents the attack operation cost, that is, the cost of adopting a certain attack behavior; RLR represents the ratio of system loss reduction, that is, the ratio of loss reduction after the system is attacked due to the adoption of a certain defense strategy; ASR represents the attack success rate; SL represents the system loss cost, that is, the loss that may be caused by the threat to the target system after the attacker launches an attack on the system; IOD represents defender information, that is, the defense information deployed by the system that the attacker can obtain after attacking the target system, which is the indirect reward of the attacker.

[0094] (b3) Game Equilibrium Analysis

[0095] Nash equilibrium

[0096] In the attack-defense game model G = {(P A , P D ), (S A , S D ), (U A , U D )}, if there is a strategy combination consisting of one strategy from each player In the game, the strategy of any player i is are all combinations of strategies of other game participants. The best strategy is to All satisfy the following formula:

[0097]

[0098] Then it is called It is a Nash equilibrium of the attack and defense game model G.

[0099] Mixed strategy Nash equilibrium

[0100] In the attack and defense game model, considering the optimal strategy requirements and action uncertainty of both the attacker and the defender, the actions of the attacker and the defender are most likely a probability distribution, which is called a mixed strategy. As a rational participant, when the participant achieves the best benefit, he chooses to maintain an action probability unchanged. At this time, this action probability is called a mixed strategy Nash equilibrium, which can be used as a probability prediction of the participant's strategy. Therefore, this application gives the following two concepts, mixed strategy and mixed strategy Nash equilibrium.

[0101] Mixed strategies

[0102] Attack and defense game model G = {(P A , P D ), (S A , S D ), (U A , U D )}, the mixed strategies of the attacker and defender are as follows: If the attacker's pure strategy set By probability Make a selection, where The defender's pure strategy set By probability Make a selection, where Then it is called and They are mixed strategies for attackers and defenders respectively.

[0103] Mixed strategy Nash equilibrium

[0104] If in the attack and defense game, the attacker uses probability Execution strategy set S A , the defender has the probability Execution strategy set S D , then the expected returns of the two are calculated as follows:

[0105]

[0106] If for any P A , P D All formulas are established

[0107]

[0108] say is a mixed strategy Nash equilibrium, It can be regarded as the defender's prediction of the possibility of the attacker's behavior, indicating the probability of the attacker adopting each attack method.

[0109] Further analysis of the mixed strategy Nash equilibrium solution process is converted into the optimal solution problem of the following two joint equations: That is, the mixed strategy Nash equilibrium of the game

[0110] Combined with the above introduction, Figure 1 A schematic flow chart of the industrial control system risk assessment method provided by the present application is shown.

[0111] S101, determining the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model.

[0112] In one possible implementation, the hierarchical risk assessment model includes a target layer, an element layer, an evaluation layer and an attack and defense game layer; the target layer includes the overall system risk value of the industrial control system; the element layer includes the enterprise management layer, the process monitoring layer and the field control layer; the evaluation layer includes equipment assets; the attack and defense game layer includes attack methods and defense methods.

[0113] In the prior art, industrial control systems are highly complex, and the hierarchical structure of the industrial control system must be determined before constructing a hierarchical risk assessment model. In the prior art, industrial control is usually divided into enterprise resource layer, enterprise management layer, process monitoring layer, field control layer and field equipment layer. At present, the research objectives of security risk analysis are mostly concentrated on the enterprise management layer, process monitoring layer and field control layer. Therefore, in the embodiments of this application, these three layers are used as the main research objects of the overall system risk analysis of the industrial control system.

[0114] According to the principle of hierarchical analysis, the game theory is introduced to add a layer of attack and defense game in view of the attack and defense confrontation nature of the vulnerability, threat and defense measures in the industrial control system. The hierarchical risk assessment model is divided into the target layer, the factor layer, the evaluation layer and the attack and defense game layer. Figure 2 As shown in the figure, the overall system risk of the industrial control system is taken as the target layer, the enterprise management layer, process monitoring layer and field control layer are taken as the element layer, the equipment assets are taken as the evaluation layer, and the attack mode and defense mode together constitute the attack and defense game layer. The attack mode can select the potential threat factors in the system, and the defense mode is the defense measure deployed against the potential attack threat.

[0115] In a possible implementation, S101 determines the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model, including:

[0116] 1) In the attack and defense game layer, a mixed strategy Nash equilibrium is obtained based on the acquired attack and defense data and defender benefits

[0117] In the embodiment of the present application, according to the above formula (5) and formula (7), the attack and defense benefit matrix is ​​obtained, as shown in Table 2.

[0118]

[0119] Table 2

[0120] After obtaining the payoff matrix, we can solve the mixed strategy Nash equilibrium according to the mixed strategy Nash equilibrium formula. To facilitate the solution, we further deduced the formula and obtained the following formula, which becomes the problem of solving the optimal solution of the following formula. The mixed strategy Nash equilibrium is obtained by calculation:

[0121]

[0122] 2) According to the mixed strategy Nash equilibrium and the defender gains Calculate the first security risk value r of each attack method i .

[0123] 3) Obtain the first weight w″ of each attack method for the device assets in the evaluation layer i .

[0124] 4) According to the first weight w″ i and the first safety risk value r i , and obtain the second safety risk value R of equipment assets under different factor layers i .

[0125] In the embodiment of the present application, the weight of the attack mode relative to each device asset is determined by using the weight value determination method in the fuzzy hierarchy process. First, according to the importance assignment table in the fuzzy hierarchy process, a fuzzy judgment matrix of the attack mode relative to each device asset is constructed; then, according to (2) and (3), the fuzzy judgment matrix is ​​converted into a fuzzy consistency judgment matrix to meet the consistency requirements; finally, according to the weight calculation method of the fuzzy hierarchy process, the weight vector set w″=(w″1,…,w″) of the security risk value of the attack action relative to the device resources in the evaluation layer is obtained. n ), n is the number of attack behaviors.

[0126] In traditional information security risk assessment analysis, the probability of a threat occurring is used as i Losses caused by threats i The product of is taken as the security risk value R, and the defender is used to predict the possibility of the attacker's behavior Expressed as the probability of threat occurrence and the defender's benefit The absolute value of represents the loss caused by the threat. The product of the security risk value and weight caused by each attack method is used as the security risk value R of the device assets at different factor layers.i The security risk value of the attack method and the security risk value of the device are calculated as shown in formula (13)(14)

[0127]

[0128] 5) Obtain the second weight w′ of each equipment asset for each structural layer in the element layer i .

[0129] In obtaining the weight of each equipment asset in the evaluation layer relative to each structural layer in the element layer, the weight value determination method of the fuzzy hierarchical method is also used, and the method is the same as the above steps.

[0130] 6) According to the second weight w′ i and the second safety risk value R i , and obtain the third safety risk value R′ of each structural layer in the element layer.

[0131] In the embodiment of the present application, the calculation of the security risks of different structural layers in the control system is based on equipment assets, and the corresponding equipment assets under different structural layers are identified. At the same time, the risks of the equipment assets under the corresponding structural layers are obtained, thereby obtaining the risk values ​​of different structural layers, that is, the product of the risk values ​​of all equipment assets under the structural layer and the weight of the equipment assets under the corresponding structural layer. The security risk value of each structural layer can be calculated using formula (15).

[0132]

[0133] R' represents the security risk value of each structural layer in the element layer, w' i It represents the weight of each equipment asset in different evaluation layers under their respective structural layers, and R represents the safety risk value of the equipment asset.

[0134] 7) According to the third safety risk value R′ and the weight w of each structural layer to the overall system risk value i , and obtain the overall system risk value R all .

[0135] From the previous model analysis, we can see that the security risk in the industrial control system is always affected by the security risks of the enterprise management layer, process monitoring layer and field control layer. The weights of the three risk values ​​on the overall risk value of the industrial control system can still be determined according to the calculation method in the FAHP method. The overall security risk value of the industrial control system can be expressed by formula (16).

[0136]

[0137] R all represents the overall safety risk value of the control system, w iRepresents the weight of a certain structural layer to the overall security risk value of the system, R′ j Represents the safety risk value of a certain structural layer, R′ j This is R′ in (15).

[0138] S102, when the overall system risk value meets a preset condition, based on a preset attack and defense game model, determining the probability of attacking each target.

[0139] In one possible implementation, when the overall system risk value is greater than a preset security threshold, the probability of attacking each target is determined based on the attack and defense game model; or, the corresponding risk level is determined based on the overall system risk value, and when the risk level is greater than a preset security level, the probability of attacking each target is determined based on the attack and defense game model.

[0140] Among them, the preset security threshold, or the preset security level is pre-set, which is a key parameter set in the risk assessment and management process. The preset security threshold defines the level of risk that needs to trigger specific security measures or alarms.

[0141] In the embodiment of the present application, when the overall system risk value is greater than the preset security threshold, it indicates that the system faces a high security risk, and a series of measures need to be taken immediately to mitigate the risk and protect the system security, such as determining the probability of attacking and selecting each target based on a preset attack and defense game model, and determining the attack propagation information based on a preset time probability Petri net model and the probability of attacking and selecting each target. Alternatively, a corresponding relationship between the overall system risk value and the risk level is preset, and the corresponding risk level is determined based on the overall system risk value and the corresponding relationship. When the risk level is greater than the preset security level, the probability of attacking and selecting each target is determined based on a preset attack and defense game model, and the attack propagation information is determined based on a preset time probability Petri net model and the probability of attacking and selecting each target.

[0142] In a possible implementation, determining the probability of attacking and selecting each target based on a preset attack and defense game model includes:

[0143] For each strategy combination in the attack and defense game model, quantify the gains and losses of both the attacker and the defender;

[0144] Construct a profit matrix based on quantified gains and losses;

[0145] The Nash equilibrium is solved based on the payoff matrix to determine the probability of attacking each target.

[0146] S103, determining attack propagation information based on a preset time probability Petri net model and the probability of selecting each target for attack; wherein the attack propagation information includes an attack propagation path and an attack propagation probability.

[0147] In a possible implementation, the attack propagation information is determined based on a preset time probability Petri net model and the probability of selecting each target for attack, including:

[0148] The acquired time probability and the probability of attacking each target are input into the time probability Petri net model to obtain the attack propagation path and the attack propagation probability corresponding to each attack propagation path.

[0149] In the embodiment of the present application, the following is designed based on the propagation mode of network attacks in the information layer of the industrial control system and the protection mechanism of the information layer, combined with the topological structure, vulnerabilities, functional characteristics and other knowledge of the information layer of the industrial control system: Figure 3 The flowchart of the industrial control system information layer risk assessment method shown is (also referred to as the flowchart of the industrial control system risk assessment method provided by another embodiment).

[0150] Among them, according to the characteristics of attack propagation in the information layer, a temporal probabilistic Petri net model of the information layer is established. The probability of attack selection of each target obtained by the attack and defense game model can be used as one of the inputs of the temporal probabilistic Petri net model. The following is a detailed process of how to integrate the attack probability obtained by the attack and defense game model into the temporal probabilistic Petri net model to determine the attack propagation information:

[0151] Step 1: Analysis of the attack and defense game model

[0152] First, we need to build an attack-defense game model that defines the interactive relationship between attackers and defenders. In this model, both attackers and defenders have a series of strategies to choose from. For each strategy combination in the attack-defense game model, we need to quantify the gains and losses of both attackers and defenders. Using the quantified gains and losses, we build a payoff matrix that shows the expected results under different strategy combinations. We use the concept of Nash equilibrium to analyze the game. After solving the Nash equilibrium, we can get the probability of each strategy being selected and predict the probability of attacking each target. We design a temporal probabilistic Petri net to simulate the spread of attacks in the system. This net includes locations (representing system components), transitions (representing attack behaviors or state changes), and directed arcs (representing logical relationships between components). The probability of attacking each target obtained from the attack-defense game model is used as the probability of occurrence of transitions (attack behaviors) in the temporal probabilistic Petri net model. This means that each transition has a probability value associated with it, which represents the probability of the attacker choosing that attack behavior. In addition, for each transition in the temporal probabilistic Petri net model, in addition to the probability of attacking each target, a time parameter needs to be defined to represent the time required for the attack behavior to occur or the waiting time in the simulation. To simulate the attack propagation, the temporal probabilistic Petri net model is used for simulation. According to the probability and time probability of attacking each target for each transition, the attack propagation path of the attack in the system and the attack propagation probability corresponding to each attack propagation path are calculated.

[0153] In a possible implementation, the attack and defense game model is optimized based on the acquired attack and defense data and the attack propagation information.

[0154] In the embodiment of the present application, the simulation (the attack propagation path obtained based on the model above and the attack propagation probability corresponding to each attack propagation path) and the actual attack data are fed back to the attack and defense game model to adjust and improve the model parameters (which may include adjusting the strategy selection of the attacker and the defender, the value of the payoff matrix, the probability of attacking each target, etc.). Thus, a more accurate attack propagation path and the attack propagation probability corresponding to each attack propagation path can be obtained.

[0155] The actual attack data may be historical data obtained before the simulation, or real-time data or new attack data collected after the simulation.

[0156] For historical data (before simulation): Before constructing and initializing the temporal probabilistic Petri net model and the attack and defense game model, historical attack data is usually collected and analyzed. These historical data are used to: calibrate and verify the models to ensure that they can accurately reflect the actual attack propagation and defense effects; identify the key vulnerabilities and high-risk areas of the system; and provide input parameters for the calculation of the probability of attack selection and Nash equilibrium of each target.

[0157] For real-time data (after simulation), after simulation and actual deployment of defense measures, continuous collection of real-time data is essential to evaluate the effectiveness and adaptability of existing defense strategies. Real-time data is used to: monitor and evaluate the effectiveness of defense measures, and adjust strategies in time to respond to new threats; identify new attack methods and trends, and update models to reflect the latest security situation; enhance understanding of attacker behavior and strategies, and improve the accuracy of risk prediction.

[0158] In the embodiment of the present application. First, we think from the perspective of information security risk assessment methods, use the fuzzy hierarchical analysis method to construct a hierarchical industrial control system model, complete the importance of each layer of elements based on expert experience, and obtain the fuzzy consistent judgment matrix and the weight value formula of each element; establish an attack and defense game layer according to the attack method and defense strategy, and calculate the loss caused by the attack and the possibility of the attack; based on the weight value of each element, the loss caused by the attack and the possibility of the attack, calculate the importance weight value of each attack method to the security risk of the industrial control system and the security risk value of each layer of elements, and then calculate the overall security risk value of the industrial control system to judge the security risk level of the control system. By analyzing the impact of different attack threats and equipment asset security risk values ​​on the overall security risk of the control system, suggestions are provided for the security protection of the control system. On this basis, based on the preset attack and defense game model, the probability of attacking each target is determined, and based on the preset time probability Petri net model and the probability of attacking each target, the attack propagation information is determined; wherein, the attack propagation information includes the attack propagation path and the attack propagation probability. Thus, the security risks in ICS can be more accurately identified and evaluated, providing a basis for formulating effective defense strategies and improving the overall security and reliability of ICS.

[0159] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0160] Corresponding to the industrial control system risk assessment method described in the above embodiment, Figure 4 A structural block diagram of an industrial control system risk assessment system provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0161] Reference Figure 4 , the industrial control system risk assessment system includes:

[0162] A risk value determination module, used to determine the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model;

[0163] An attack probability determination module, used to determine the probability of attacking each target based on a preset attack and defense game model when the overall system risk value meets a preset condition;

[0164] The attack propagation information determination module is used to determine the attack propagation information based on a preset time probability Petri net model and the probability of attacking each target; wherein the attack propagation information includes the attack propagation path and the attack propagation probability.

[0165] In one possible implementation, the hierarchical risk assessment model includes a target layer, an element layer, an evaluation layer and an attack and defense game layer; the target layer includes the overall system risk value of the industrial control system; the element layer includes the enterprise management layer, the process monitoring layer and the field control layer; the evaluation layer includes equipment assets; the attack and defense game layer includes attack methods and defense methods.

[0166] In a possible implementation, the risk value determination module is used to:

[0167] In the attack and defense game layer, the mixed strategy Nash equilibrium is obtained based on the acquired attack and defense data and defender benefits

[0168] According to the mixed strategy Nash equilibrium and the defender gains Calculate the first security risk value r of each attack method i ;

[0169] Obtain the first weight w″ of each attack method for the device assets in the evaluation layer i ;

[0170] According to the first weight w″ i and the first safety risk value r i , and obtain the second safety risk value R of equipment assets under different factor layers i ;

[0171] Get the second weight w′ of each equipment asset for each structural layer in the element layer i ;

[0172] According to the second weight w′ i and the second safety risk value R i , get the third safety risk value R′ of each structural layer in the element layer;

[0173] According to the third safety risk value R′ and the weight w of each structural layer to the overall system risk value i , and obtain the overall system risk value R all .

[0174] In a possible implementation, the attack probability determination module is used to:

[0175] When the overall system risk value is greater than a preset safety threshold, the probability of attacking each target is determined based on the attack-defense game model;

[0176] Alternatively, a corresponding risk level is determined based on the overall system risk value, and when the risk level is greater than a preset safety level, a probability of attacking each target is determined based on the attack-defense game model.

[0177] In a possible implementation, the attack probability determination module is used to:

[0178] For each strategy combination in the attack and defense game model, quantify the gains and losses of both the attacker and the defender;

[0179] Construct a profit matrix based on quantified gains and losses;

[0180] The Nash equilibrium is solved based on the payoff matrix to determine the probability of attacking each target.

[0181] In a possible implementation, the attack propagation information determination module is used to:

[0182] The acquired time probability and the probability of attacking each target are input into the time probability Petri net model to obtain the attack propagation path and the attack propagation probability corresponding to each attack propagation path.

[0183] In a possible implementation, the industrial control system risk assessment system further includes an optimization module, which is used to:

[0184] Based on the acquired attack and defense data and the attack propagation information, the attack and defense game model is optimized.

[0185] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0186] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0187] An embodiment of the present application also provides a computer device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps of any of the above-mentioned method embodiments when executing the computer program.

[0188] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0189] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0190] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / computer device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0191] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0192] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0193] In the embodiments provided in the present application, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which can be electrical, mechanical or other forms.

[0194] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0195] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

[0196] Figure 5 This is a schematic diagram of the structure of a computer device provided in one embodiment of the present application. Figure 5 As shown, the computer device of this embodiment includes: at least one processor 20 ( Figure 5 Only one is shown in the figure), a memory 21, and a computer program 22 stored in the memory 21 and executable on the at least one processor 20, wherein the processor 20 implements the steps in any of the above-mentioned physiological signal processing method embodiments when executing the computer program 22.

[0197] The computer device may include, but is not limited to, a processor 20 and a memory 21. Those skilled in the art will appreciate that Figure 5 It is only an example of a computer device and does not constitute a limitation of the computer device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0198] The processor 20 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0199] In some embodiments, the memory 21 may be an internal storage unit of the computer device, such as a hard disk or memory of the computer device. In other embodiments, the memory 21 may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device. Further, the memory 21 may also include both an internal storage unit of the computer device and an external storage device. The memory 21 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 21 may also be used to temporarily store data that has been output or is to be output.

Claims

1. A risk assessment method for industrial control systems, characterized in that: include: Determine the overall system risk value of the industrial control system based on the preset hierarchical risk assessment model; When the overall system risk value meets the preset conditions, the probability of attacking each target is determined based on the preset attack and defense game model; Based on a preset time probability Petri net model and the probability of attacking each target, attack propagation information is determined; wherein the attack propagation information includes an attack propagation path and an attack propagation probability.

2. The industrial control system risk assessment method according to claim 1, characterized in that: The hierarchical risk assessment model includes a target layer, an element layer, an evaluation layer and an attack and defense game layer; the target layer includes the overall system risk value of the industrial control system; the element layer includes the enterprise management layer, the process monitoring layer and the field control layer; the evaluation layer includes equipment assets; the attack and defense game layer includes attack methods and defense methods.

3. The industrial control system risk assessment method according to claim 2, characterized in that: The overall system risk value of the industrial control system is determined based on a preset hierarchical risk assessment model, including: In the attack and defense game layer, a mixed strategy Nash equilibrium and defender benefits are obtained based on the acquired attack and defense data; According to the mixed strategy Nash equilibrium and the defender's benefit, the first security risk value r of each attack method is calculated. i ; Obtain the first weight w of each attack method for the device assets in the evaluation layer" i ; According to the first weight w" i and the first safety risk value r i , and obtain the second safety risk value R of equipment assets under different factor layers i ; Get the second weight w′ of each equipment asset for each structural layer in the element layer i ; According to the second weight w′ i and the second safety risk value R i , get the third safety risk value R′ of each structural layer in the element layer; According to the third safety risk value R′ and the weight w of each structural layer to the overall system risk value i , and obtain the overall system risk value R all .

4. The industrial control system risk assessment method according to claim 1, characterized in that: When the overall system risk value meets the preset conditions, the probability of attacking and selecting each target is determined based on the preset attack and defense game model, including: When the overall system risk value is greater than a preset safety threshold, the probability of attacking each target is determined based on the attack-defense game model; Alternatively, a corresponding risk level is determined based on the overall system risk value, and when the risk level is greater than a preset safety level, a probability of attacking each target is determined based on the attack-defense game model.

5. The industrial control system risk assessment method according to claim 1, characterized in that: The method of determining the probability of attacking and selecting each target based on a preset attack and defense game model includes: For each strategy combination in the attack and defense game model, quantify the gains and losses of both the attacker and the defender; Construct a profit matrix based on quantified gains and losses; The Nash equilibrium is solved based on the payoff matrix to determine the probability of attacking each target.

6. The industrial control system risk assessment method according to claim 1, characterized in that: The method of determining the attack propagation information based on the preset time probability Petri net model and the probability of selecting each target for attack includes: The acquired time probability and the probability of attacking each target are input into the time probability Petri net model to obtain the attack propagation path and the attack propagation probability corresponding to each attack propagation path.

7. The industrial control system risk assessment method according to claim 6, characterized in that: The method further comprises: Based on the acquired attack and defense data and the attack propagation information, the attack and defense game model is optimized.

8. An industrial control system risk assessment system, characterized in that: include: A risk value determination module, used to determine the overall system risk value of the industrial control system based on a preset hierarchical risk assessment model; An attack probability determination module, used to determine the probability of attacking each target based on a preset attack and defense game model when the overall system risk value meets a preset condition; The attack propagation information determination module is used to determine the attack propagation information based on a preset time probability Petri net model and the probability of attacking each target; wherein the attack propagation information includes the attack propagation path and the attack propagation probability.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images