Industrial control system security situation assessment method

Abstract

The invention relates to the technical field of information network security, in particular to an industrial control system security situation assessment method, which comprises the following steps: acquiring first data; searching to obtain a first production device to an Nth production device, a first data transmission interface to an Nth data transmission interface, and a first data transmission link to an Mth data transmission link; calculating to obtain first to Nth power data sequences, first to Nth flow data sequences, and first to Mth transmission data sequences; calculating a security situation assessment value of the industrial control system through a security situation assessment algorithm; and obtaining a security situation assessment result according to the industrial control system security situation assessment value. According to the invention, matching calculation is carried out on industrial control system equipment and network data, so that security situation assessment is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of information network security, and in particular to a method for assessing the security situation of an industrial control system. Background Art

[0002] With the rapid development of industrial automation, the production mode of the tobacco industry has shifted from traditional manual operations to intelligent and automated production. Modern tobacco production lines use industrial control systems to achieve precise control and efficient management of the production process, involving multiple processes such as tobacco leaf pretreatment, silk making, rolling, and packaging.

[0003] The tobacco industrial control system is a complex automation control network, which contains a large number of sensors, actuators, controllers and other automation equipment. These devices are interconnected through industrial Ethernet, fieldbus and other communication networks to form a complete data acquisition, monitoring and control system. In the production process, real-time data interaction and coordination are required between the equipment in each process to ensure the consistency of product quality and the continuity of the production process.

[0004] The safety and reliability of industrial control systems are directly related to the production efficiency and product quality of tobacco companies. Especially in key processes such as silk making and rolling, the precise control of process parameters has a decisive influence on the quality of the final product. The coordination between the equipment in each process requires real-time and reliable data transmission. Any equipment failure or network anomaly may cause the entire production line to stop production or product quality fluctuations.

[0005] However, in the actual production process, the industrial control system may have equipment failure or network failure. For example, when the data transmission interface of the cutter fails, the cutter cannot transmit the tobacco parameter data to the dryer, resulting in the dryer's drying parameters not matching the cutter's cutting parameters, and ultimately producing defective tobacco products. This not only affects product quality, but may also cause a decrease in production efficiency and economic losses.

[0006] At present, fault diagnosis of industrial control systems mainly relies on manual inspection or single-point monitoring, and there is a lack of a method that can comprehensively evaluate the security situation of the entire industrial control system. Especially in the continuous production process such as the tobacco industry, there is a close collaborative relationship between the various devices in the industrial control system, and any abnormality in the device or network may affect the normal operation of the entire production line. Therefore, there is an urgent need for an evaluation method that can promptly detect safety hazards in the industrial control system to ensure the stability of the production process and product quality. Summary of the invention

[0007] (1) Technical issues to be solved

[0008] The purpose of the present invention is to provide a method for assessing the security situation of an industrial control system, so as to achieve the security situation assessment of the industrial control system.

[0009] (2) Technical solution

[0010] To achieve the above object, the present invention provides a method for assessing the security situation of an industrial control system, the method comprising the following steps:

[0011] S1, obtaining first data; the first data includes the number N of production equipment.

[0012] S2, number the production equipment to obtain the first production equipment to the Nth production equipment; the power supply interfaces of the first production equipment to the Nth production equipment are respectively installed with the first power collector to the Nth power collector; the first production equipment to the Nth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the Nth data transmission interface; search for the data transmission link between the first data transmission interface to the Nth data transmission interface and the data transmission link between the first data transmission interface to the Nth data transmission interface and the human-machine interface, which are respectively recorded as the first data transmission link to the Mth data transmission link; M is the number of data transmission links.

[0013] S3, read the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period, and calculate the first power data sequence to the Nth power data sequence; read the data flow flowing out of the first data transmission interface to the Nth data transmission interface within the first evaluation period, and obtain the first flow data sequence to the Nth flow data sequence; read the data flow from the first data transmission link to the Mth data transmission link within the first evaluation period, and obtain the first transmission data sequence to the Mth transmission data sequence.

[0014] S4. According to the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm; and a security situation assessment result is obtained according to the security situation assessment value of the industrial control system.

[0015] Furthermore, the method of reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period and calculating the first power data sequence to the Nth power data sequence includes:

[0016] The electric power measured by the first power collector to the Nth power collector in the first evaluation period is read according to a preset first sampling frequency to obtain the first measured power sequence to the Nth measured power sequence.

[0017] The rated powers of the first production equipment to the Nth production equipment are read to obtain the first rated power to the Nth rated power.

[0018] The first power data sequence to the Nth power data sequence are calculated according to the first measured power sequence to the Nth measured power sequence and the first rated power to the Nth rated power; the calculation formula of the first power data sequence to the Nth power data sequence is:

[0019]

[0020] Among them, D i represents the i-th rated power; P ij represents the jth element in the i-th measured power sequence; represents the jth element in the i-th power data sequence; i is an integer variable with a value from 1 to N; j is an integer variable with a value from 1 to H; the calculation formula of H is:

[0021] H = Tf;

[0022] Wherein, T represents the first evaluation period, in seconds; f represents the first sampling frequency, in Hertz.

[0023] Further, the method of reading the data flow from the first data transmission interface to the Nth data transmission interface in the first evaluation period to obtain the first flow data sequence to the Nth flow data sequence includes:

[0024] The data flow that flows out of the first data transmission interface to the Nth data transmission interface per second is read in the first evaluation cycle to obtain the first monitoring flow sequence to the Nth monitoring flow sequence.

[0025] The number of bytes of data output per second from the first data transmission interface to the Nth data transmission interface when the first production equipment to the Nth production equipment are operating at rated power is read to obtain the first rated flow rate to the Nth rated flow rate.

[0026] The first flow data sequence to the Nth flow data sequence are calculated according to the first monitoring flow sequence to the Nth monitoring flow sequence and the first rated flow sequence to the Nth rated flow sequence; the calculation formula of the first flow data sequence to the Nth flow data sequence is:

[0027]

[0028] Among them, G i Indicates the i-th rated flow rate; L ir represents the rth element in the i-th monitored traffic sequence; r is an integer variable with a value from 1 to T; Represents the rth element in the i-th traffic data sequence.

[0029] Further, the method of reading the data flow from the first data transmission link to the Mth data transmission link in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence includes:

[0030] The data flow rate flowing through the first data transmission link to the Mth data transmission link per second is read in the first evaluation cycle to obtain the first transmission data sequence to the Mth transmission data sequence.

[0031] Further, the method of calculating the security situation assessment value of the industrial control system through a security situation assessment algorithm based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence includes:

[0032] According to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence, a first security situation assessment sub-item value F1 is obtained by using a device network matching algorithm.

[0033] According to the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence, a data traffic matching algorithm is used to obtain a second security situation assessment sub-item value F2.

[0034] According to the first security situation assessment sub-item value and the second security situation assessment sub-item value, the industrial control system security situation assessment value F3 is calculated; the calculation formula of the industrial control system security situation assessment value is:

[0035] F3=F1+F2.

[0036] Furthermore, the method of obtaining the first security situation assessment sub-item value F1 by using a device network matching algorithm according to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence includes:

[0037] The first power identification sequence to the Nth power identification sequence are calculated according to the first power data sequence to the Nth power data sequence; the calculation formula of the first power identification sequence to the Nth power identification sequence is:

[0038]

[0039] Among them, B ij represents the jth element in the i-th power identification sequence; μ1 represents the preset power threshold.

[0040] The first power identification sequence to the Nth power identification sequence are time-sequence aggregated to obtain the first power matching sequence to the Nth power matching sequence.

[0041] The first security situation assessment sub-item value is calculated based on the first power matching sequence to the Nth power matching sequence and the first flow data sequence to the Nth flow data sequence; the calculation formula of the first security situation assessment sub-item value is:

[0042]

[0043] Among them, C ir represents the rth element in the i-th power matching sequence.

[0044] Furthermore, the method of performing time series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence includes:

[0045] The first power matching sequence to the Nth power matching sequence are calculated according to the first power identification sequence to the Nth power identification sequence; the calculation formula of the first power matching sequence to the Nth power matching sequence is:

[0046]

[0047] Furthermore, the method of obtaining the second security situation assessment sub-item value F2 by using a data flow matching algorithm according to the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence includes:

[0048] The second security situation assessment sub-item value is calculated based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence; the calculation formula of the second security situation assessment sub-item value is:

[0049]

[0050] Among them, Y kr Represents the rth element in the kth transmission data sequence; k is an integer variable with a value from 1 to M.

[0051] Furthermore, the method for obtaining a security situation assessment result according to the security situation assessment value of the industrial control system includes:

[0052] The industrial control system security situation assessment value is compared with a pre-set assessment threshold. When the industrial control system security situation assessment value is less than the assessment threshold, the security situation assessment result is that the industrial control system security situation meets the requirements. When the industrial control system security situation assessment value is greater than or equal to the assessment threshold, the security situation assessment result is that the industrial control system security situation does not meet the requirements.

[0053] (3) Beneficial effects

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] By calculating the first security situation assessment sub-item value, the matching degree between the equipment operation status and the industrial control system network transmission data is evaluated. By calculating the second security situation assessment sub-item value, the data transmission matching degree between the network transmission data link and the data transmission interface is evaluated, thereby realizing the assessment of the security situation of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flowchart of a method for assessing security situation of an industrial control system according to Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Before giving examples, it is necessary to explain the application scenarios of the present invention. The present invention is applied to the security situation assessment of tobacco industrial control systems.

[0059] Example 1: Figure 1 As shown, this embodiment provides a method for assessing the security situation of an industrial control system, the method comprising the following steps:

[0060] S1, obtaining first data; the first data includes the number N of production equipment.

[0061] Exemplarily, the automated tobacco production line has eight production equipment, namely, a shredder, a cigarette drying machine, a cigarette making machine, a filter rod forming machine, a connecting machine, a packaging machine, a cartoning machine, and an elevator, where N=8.

[0062] S2, number the production equipment to obtain the first production equipment to the Nth production equipment; the power supply interfaces of the first production equipment to the Nth production equipment are respectively installed with the first power collector to the Nth power collector; the first production equipment to the Nth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the Nth data transmission interface; search for the data transmission link between the first data transmission interface to the Nth data transmission interface and the data transmission link between the first data transmission interface to the Nth data transmission interface and the human-machine interface, which are respectively recorded as the first data transmission link to the Mth data transmission link; M is the number of data transmission links.

[0063] Exemplarily, the production equipment is numbered to obtain the first production equipment to the eighth production equipment. The first production equipment to the eighth production equipment are all connected to the distribution transformer of the tobacco automation factory through the power supply interface, and the power supply interfaces of the first production equipment to the eighth production equipment are respectively installed with the first power collector to the eighth power collector. In the industrial control system of the automated production line, data transmission interfaces are installed on the production equipment, and the data transmission interfaces are connected through data transmission links to perform data interaction. The data transmission interface and the data transmission link together constitute the industrial control system data network. The first production equipment to the eighth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the eighth data transmission interface. Search for the data transmission link between the first data transmission interface to the eighth data transmission interface and the data transmission link between the first data transmission interface to the eighth data transmission interface and the human-machine interface. There are a total of ten data transmission links, which are respectively recorded as the first data transmission link to the tenth data transmission link. For example, the first data transmission link refers to the data transmission link between the data transmission interface installed on the shredder and the data transmission interface installed on the shredder. During the production process, the shredder cuts the tobacco leaves into fine filaments, and then transmits them to the shredder for drying through the crawler. In order to match the tobacco drying parameters such as the drying temperature and drying humidity of the drying machine with the tobacco output speed and tobacco output amount of the cutting machine, it is necessary to transmit the tobacco output speed and tobacco output amount data of the cutting machine to the data transmission interface installed on the drying machine through the first data transmission link, so that the drying machine can adaptively adjust the drying parameters such as the drying temperature and drying humidity according to the tobacco output speed and tobacco output amount of the cutting machine.

[0064] S3, read the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period, and calculate the first power data sequence to the Nth power data sequence; read the data flow flowing out of the first data transmission interface to the Nth data transmission interface within the first evaluation period, and obtain the first flow data sequence to the Nth flow data sequence; read the data flow from the first data transmission link to the Mth data transmission link within the first evaluation period, and obtain the first transmission data sequence to the Mth transmission data sequence.

[0065] Exemplarily, the preset first evaluation period is 3600 seconds, so the power consumption measured by the first power collector to the eighth power collector is read, and the first power data sequence to the eighth power data sequence are calculated. The data flow rate flowing out of the first data transmission interface to the eighth data transmission interface within 3600 seconds is read to obtain the first flow data sequence to the eighth flow data sequence. The data flow rate of the first data transmission link to the tenth data transmission link within 3600 seconds is read to obtain the first transmission data sequence to the tenth transmission data sequence.

[0066] S4. According to the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm; and a security situation assessment result is obtained according to the security situation assessment value of the industrial control system.

[0067] Exemplarily, according to the first power data sequence to the eighth power data sequence, the first flow data sequence to the eighth flow data sequence, and the first transmission data sequence to the tenth transmission data sequence, the security situation assessment value of the industrial control system is calculated by the security situation assessment algorithm. A security situation assessment result is obtained according to the security situation assessment value of the industrial control system. The security situation assessment result is one of "the security situation of the industrial control system meets the requirements" and "the security situation of the industrial control system does not meet the requirements". If the security situation assessment result is "the security situation of the industrial control system meets the requirements", it means that there is no fault in the first production equipment to the eighth production equipment, the first data transmission interface to the eighth data transmission interface, and the first data transmission link to the tenth data transmission link. If the security situation assessment result is "the security situation of the industrial control system does not meet the requirements", it means that there is an equipment fault or a network fault in the first production equipment to the eighth production equipment, the first data transmission interface to the eighth data transmission interface, and the first data transmission link to the tenth data transmission link. For example, the first flow data sequence is a 0 sequence, and the first power data sequence is a 1 sequence. The security situation assessment value of the industrial control system calculated by the security situation assessment algorithm is 0.2125, which is greater than the pre-set assessment threshold of 0.1. Therefore, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements, indicating that there is a device failure or network failure in the first production equipment to the eighth production equipment, the first data transmission interface to the eighth data transmission interface, and the first data transmission link to the tenth data transmission link. After investigation, it was found that the data transmission interface installed on the shredder, that is, the first data transmission interface, failed, resulting in the data transmission interface installed on the shredder being unable to transmit data to the data transmission interface installed on the shredder. In this case, the shredder's drying parameters such as drying temperature and drying humidity cannot match the shredder's tobacco output speed, tobacco output volume and other shredder parameters, thereby producing defective tobacco products.

[0068] Furthermore, the method of reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period and calculating the first power data sequence to the Nth power data sequence includes:

[0069] The electric power measured by the first power collector to the Nth power collector in the first evaluation period is read according to a preset first sampling frequency to obtain the first measured power sequence to the Nth measured power sequence.

[0070] Exemplarily, the preset first sampling frequency is 10 Hz, so the power consumption measured by the first power collector to the eighth power collector within 3600 seconds is read according to the first sampling frequency of 10 Hz to obtain the first measured power sequence to the eighth measured power sequence. The lengths of the first measured power sequence to the eighth measured power sequence are all 36000.

[0071] The rated powers of the first production equipment to the Nth production equipment are read to obtain the first rated power to the Nth rated power.

[0072] Exemplarily, the rated powers of the first to eighth production equipment are read from the nameplates of the production equipment to obtain the first to eighth rated powers.

[0073] The first power data sequence to the Nth power data sequence are calculated according to the first measured power sequence to the Nth measured power sequence and the first rated power to the Nth rated power; the calculation formula of the first power data sequence to the Nth power data sequence is:

[0074]

[0075] Among them, D i represents the i-th rated power; P ij represents the jth element in the i-th measured power sequence; represents the jth element in the i-th power data sequence; i is an integer variable with a value from 1 to N; j is an integer variable with a value from 1 to H; the calculation formula of H is:

[0076] H = Tf;

[0077] Wherein, T represents the first evaluation period, in seconds; f represents the first sampling frequency, in Hertz.

[0078] Further, the method of reading the data flow from the first data transmission interface to the Nth data transmission interface in the first evaluation period to obtain the first flow data sequence to the Nth flow data sequence includes:

[0079] The data flow that flows out of the first data transmission interface to the Nth data transmission interface per second is read in the first evaluation cycle to obtain the first monitoring flow sequence to the Nth monitoring flow sequence.

[0080] Exemplarily, the data flow rate flowing out of the first data transmission interface to the eighth data transmission interface per second within 3600 seconds is read, and the data flow rate unit is bytes per second, to obtain the first monitoring flow sequence to the eighth monitoring flow sequence.

[0081] The number of bytes of data output per second from the first data transmission interface to the Nth data transmission interface when the first production equipment to the Nth production equipment are operating at rated power is read to obtain the first rated flow rate to the Nth rated flow rate.

[0082] Exemplarily, the number of bytes of data output per second by the first data transmission interface to the eighth data transmission interface of the first production equipment to the eighth production equipment under rated power operation is read to obtain the first rated flow rate to the eighth rated flow rate. Taking the shredder as an example, the shredder outputs the tobacco output speed and tobacco output volume data through the first data transmission interface under rated power operation. The frequency of data transmission is 100 times per second, and the tobacco output speed and tobacco output volume data packets output each time are 548 bytes, so the first rated flow rate is 54800 bytes.

[0083] The first flow data sequence to the Nth flow data sequence are calculated according to the first monitoring flow sequence to the Nth monitoring flow sequence and the first rated flow sequence to the Nth rated flow sequence; the calculation formula of the first flow data sequence to the Nth flow data sequence is:

[0084]

[0085] Among them, G i Indicates the i-th rated flow rate; L ir represents the rth element in the i-th monitored traffic sequence; r is an integer variable with a value from 1 to T; Represents the rth element in the i-th traffic data sequence.

[0086] Further, the method of reading the data flow from the first data transmission link to the Mth data transmission link in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence includes:

[0087] The data flow rate flowing through the first data transmission link to the Mth data transmission link per second is read in the first evaluation cycle to obtain the first transmission data sequence to the Mth transmission data sequence.

[0088] Further, the method of calculating the security situation assessment value of the industrial control system through a security situation assessment algorithm based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence includes:

[0089] According to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence, a first security situation assessment sub-item value F1 is obtained by using a device network matching algorithm.

[0090] Exemplarily, the first security situation assessment sub-item value F1 reflects the matching degree between the device operation status and the industrial control system network transmission data. The larger the first security situation assessment sub-item value F1, the worse the matching degree between the device operation status and the industrial control system network transmission data. The reasons for the first security situation assessment sub-item value F1 being too large include: the data transmission interface is damaged.

[0091] According to the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence, a data traffic matching algorithm is used to obtain a second security situation assessment sub-item value F2.

[0092] Exemplarily, the second security situation assessment sub-item value F2 reflects the data transmission matching degree between the network transmission data link and the data transmission interface. The larger the second security situation assessment sub-item value F2 is, the worse the data transmission matching degree between the network transmission data link and the data transmission interface is. The reasons for the second security situation assessment sub-item value F2 being too large include: the data transmission link is damaged.

[0093] According to the first security situation assessment sub-item value and the second security situation assessment sub-item value, the industrial control system security situation assessment value F3 is calculated; the calculation formula of the industrial control system security situation assessment value is:

[0094] F3=F1+F2.

[0095] Exemplarily, the calculation yields F1=0.2037, F2=0.0088, and therefore F3=0.2125.

[0096] Furthermore, the method of obtaining the first security situation assessment sub-item value F1 by using a device network matching algorithm according to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence includes:

[0097] The first power identification sequence to the Nth power identification sequence are calculated according to the first power data sequence to the Nth power data sequence; the calculation formula of the first power identification sequence to the Nth power identification sequence is:

[0098]

[0099] Among them, B ij represents the jth element in the i-th power identification sequence; μ1 represents the preset power threshold.

[0100] Exemplarily, the preset power threshold μ1=0.5. The purpose of setting the power threshold is to filter out the influence of the device startup transition process.

[0101] The first power identification sequence to the Nth power identification sequence are time-sequence aggregated to obtain the first power matching sequence to the Nth power matching sequence.

[0102] The first security situation assessment sub-item value is calculated based on the first power matching sequence to the Nth power matching sequence and the first flow data sequence to the Nth flow data sequence; the calculation formula of the first security situation assessment sub-item value is:

[0103]

[0104] Among them, C ir represents the rth element in the i-th power matching sequence.

[0105] Furthermore, the method of performing time series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence includes:

[0106] The first power matching sequence to the Nth power matching sequence are calculated according to the first power identification sequence to the Nth power identification sequence; the calculation formula of the first power matching sequence to the Nth power matching sequence is:

[0107]

[0108] Furthermore, the method of obtaining the second security situation assessment sub-item value F2 by using a data flow matching algorithm according to the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence includes:

[0109] The second security situation assessment sub-item value is calculated based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence; the calculation formula of the second security situation assessment sub-item value is:

[0110]

[0111] Among them, Y kr Represents the rth element in the kth transmission data sequence; k is an integer variable with a value from 1 to M.

[0112] Furthermore, the method for obtaining a security situation assessment result according to the security situation assessment value of the industrial control system includes:

[0113] The industrial control system security situation assessment value is compared with a pre-set assessment threshold. When the industrial control system security situation assessment value is less than the assessment threshold, the security situation assessment result is that the industrial control system security situation meets the requirements. When the industrial control system security situation assessment value is greater than or equal to the assessment threshold, the security situation assessment result is that the industrial control system security situation does not meet the requirements.

[0114] For example, the security situation assessment value of the industrial control system calculated by the security situation assessment algorithm is 0.2125, which is greater than the preset assessment threshold of 0.1. Therefore, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements.

[0115] Finally, it should be noted that: Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for assessing the security situation of an industrial control system, characterized in that: The method comprises the following steps: S1, obtaining first data; the first data includes the number N of production equipment; S2, numbering the production equipment to obtain the first production equipment to the Nth production equipment; the power supply interfaces of the first production equipment to the Nth production equipment are respectively installed with the first power collector to the Nth power collector; the first production equipment to the Nth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the Nth data transmission interface; searching for the data transmission link between the first data transmission interface to the Nth data transmission interface and the data transmission link between the first data transmission interface to the Nth data transmission interface and the human-machine interface, which are respectively recorded as the first data transmission link to the Mth data transmission link; M is the number of data transmission links; S3, reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period, and calculating the first power data sequence to the Nth power data sequence; reading the data flow flowing out of the first data transmission interface to the Nth data transmission interface within the first evaluation period, and obtaining the first flow data sequence to the Nth flow data sequence; reading the data flow from the first data transmission link to the Mth data transmission link within the first evaluation period, and obtaining the first transmission data sequence to the Mth transmission data sequence; S4. According to the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm; and a security situation assessment result is obtained according to the security situation assessment value of the industrial control system.

2. The method for assessing the security situation of an industrial control system according to claim 1, characterized in that: The method of reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period and calculating the first power data sequence to the Nth power data sequence includes: Read the electric power measured by the first power collector to the Nth power collector in the first evaluation period according to the preset first sampling frequency to obtain the first measured power sequence to the Nth measured power sequence; Read the rated powers of the first production equipment to the Nth production equipment to obtain the first rated power to the Nth rated power; The first power data sequence to the Nth power data sequence are calculated according to the first measured power sequence to the Nth measured power sequence and the first rated power to the Nth rated power; the calculation formula of the first power data sequence to the Nth power data sequence is: Among them, D i represents the i-th rated power; P ij represents the jth element in the i-th measured power sequence; represents the jth element in the i-th power data sequence; i is an integer variable with a value from 1 to N; j is an integer variable with a value from 1 to H; the calculation formula of H is: H = Tf; Wherein, T represents the first evaluation period, in seconds; f represents the first sampling frequency, in Hertz.

3. The method for assessing the security situation of an industrial control system according to claim 2, characterized in that: The method of reading the data flow from the first data transmission interface to the Nth data transmission interface in the first evaluation period to obtain the first flow data sequence to the Nth flow data sequence includes: Read the data flow from the first data transmission interface to the Nth data transmission interface per second in the first evaluation period to obtain the first monitoring flow sequence to the Nth monitoring flow sequence; Read the number of bytes of data output per second from the first data transmission interface to the Nth data transmission interface when the first production equipment to the Nth production equipment are in the rated power operation state, and obtain the first rated flow rate to the Nth rated flow rate; The first flow data sequence to the Nth flow data sequence are calculated according to the first monitoring flow sequence to the Nth monitoring flow sequence and the first rated flow sequence to the Nth rated flow sequence; the calculation formula of the first flow data sequence to the Nth flow data sequence is: Among them, G i Indicates the i-th rated flow rate; L ir represents the rth element in the i-th monitored traffic sequence; r is an integer variable with a value from 1 to T; Represents the rth element in the i-th traffic data sequence.

4. The method for assessing the security situation of an industrial control system according to claim 3, characterized in that: The method of reading the data flow from the first data transmission link to the Mth data transmission link in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence includes: The data flow rate flowing through the first data transmission link to the Mth data transmission link per second is read in the first evaluation cycle to obtain the first transmission data sequence to the Mth transmission data sequence.

5. The method for assessing the security situation of an industrial control system according to claim 4, characterized in that: The method of calculating the security situation assessment value of the industrial control system through a security situation assessment algorithm according to the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence includes: According to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence, a first security situation assessment sub-item value F1 is obtained by using a device network matching algorithm; According to the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence, a data traffic matching algorithm is used to obtain a second security situation assessment sub-item value F2; According to the first security situation assessment sub-item value and the second security situation assessment sub-item value, the industrial control system security situation assessment value F3 is calculated; the calculation formula of the industrial control system security situation assessment value is: F3=F1+F2.

6. The method for assessing the security situation of an industrial control system according to claim 5, characterized in that: The method of obtaining the first security situation assessment sub-item value F1 by using a device network matching algorithm according to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence includes: The first power identification sequence to the Nth power identification sequence are calculated according to the first power data sequence to the Nth power data sequence; the calculation formula of the first power identification sequence to the Nth power identification sequence is: Among them, B ij represents the jth element in the i-th power identification sequence; μ1 represents the preset power threshold; Performing time series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence; The first security situation assessment sub-item value is calculated based on the first power matching sequence to the Nth power matching sequence and the first flow data sequence to the Nth flow data sequence; the calculation formula of the first security situation assessment sub-item value is: Among them, C ir represents the rth element in the i-th power matching sequence.

7. The method for assessing the security situation of an industrial control system according to claim 6, characterized in that: The method of performing time series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence comprises: The first power matching sequence to the Nth power matching sequence are calculated according to the first power identification sequence to the Nth power identification sequence; the calculation formula of the first power matching sequence to the Nth power matching sequence is:

8. The method for assessing the security situation of an industrial control system according to claim 7, characterized in that: The method of obtaining the second security situation assessment sub-item value F2 by using a data flow matching algorithm according to the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence includes: The second security situation assessment sub-item value is calculated based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence; the calculation formula of the second security situation assessment sub-item value is: Among them, Y kr Represents the rth element in the kth transmission data sequence; k is an integer variable with a value from 1 to M.

9. The method for assessing the security situation of an industrial control system according to claim 8, characterized in that: The method for obtaining a security situation assessment result according to the security situation assessment value of the industrial control system includes: The industrial control system security situation assessment value is compared with a pre-set assessment threshold. When the industrial control system security situation assessment value is less than the assessment threshold, the security situation assessment result is that the industrial control system security situation meets the requirements. When the industrial control system security situation assessment value is greater than or equal to the assessment threshold, the security situation assessment result is that the industrial control system security situation does not meet the requirements.

Images