A method for security situation assessment of industrial control systems

Abstract

The present invention relates to the field of information network security technology, and specifically to a method for assessing the security situation of an industrial control system. The method comprises obtaining first data; searching to obtain a first production device to an Nth production device, a first data transmission interface to an Nth data transmission interface, and a first data transmission link to an Mth data transmission link; calculating to obtain a first power data sequence to an Nth power data sequence, a first flow data sequence to an Nth flow data sequence, and a first transmission data sequence to an Mth transmission data sequence; calculating an industrial control system security situation assessment value using a security situation assessment algorithm; and obtaining a security situation assessment result based on the industrial control system security situation assessment value. The present invention implements security situation assessment by performing matching calculations on industrial control system equipment and network data.

Description

Technical Field

[0001] The present invention relates to the technical field of information network security, and in particular to a method for assessing the security situation of an industrial control system. Background Art

[0002] With the rapid development of industrial automation, the tobacco industry has shifted from traditional manual labor to intelligent, automated production. Modern tobacco production lines employ industrial control systems to achieve precise control and efficient management of the production process, encompassing multiple steps including tobacco leaf pretreatment, shredding, rolling, and packaging.

[0003] The tobacco industry's control system is a complex automation network encompassing numerous sensors, actuators, controllers, and other automated equipment. These devices are interconnected via communication networks such as Industrial Ethernet and fieldbus, forming a comprehensive data acquisition, monitoring, and control system. During the production process, real-time data exchange and coordinated collaboration between various process devices are required to ensure consistent product quality and continuous production.

[0004] The security and reliability of industrial control systems are directly related to tobacco companies' production efficiency and product quality. In key processes like silk making and rolling, precise control of process parameters has a decisive impact on final product quality. The coordination between equipment in each process requires real-time and reliable data transmission. Any equipment failure or network anomaly could cause an entire production line to halt or fluctuate product quality.

[0005] However, in actual production, industrial control systems may experience equipment or network failures. For example, if the data transmission interface of a tobacco cutter fails, the cutter cannot transmit tobacco parameter data to the tobacco dryer. As a result, the tobacco dryer's drying parameters do not match the cutter's cutting parameters, ultimately resulting in defective tobacco products. This not only affects product quality but also may reduce production efficiency and cause financial losses.

[0006] Currently, fault diagnosis for industrial control systems primarily relies on manual inspections or single-point monitoring, lacking a comprehensive approach to assessing the security posture of the entire industrial control system. This is particularly true in continuous production processes like those in the tobacco industry, where various industrial control system devices operate in close coordination. Any device or network anomaly can impact the normal operation of the entire production line. Therefore, an assessment method is urgently needed to promptly identify potential security risks in industrial control systems to ensure production stability and product quality. Summary of the Invention

[0007] (1) Technical problems to be solved

[0008] The purpose of the present invention is to provide a method for assessing the security situation of an industrial control system, so as to achieve security situation assessment of the industrial control system.

[0009] (2) Technical solution

[0010] To achieve the above object, the present invention provides a method for assessing the security situation of an industrial control system, the method comprising the following steps:

[0011] S1, obtaining first data; the first data includes the number N of production equipment.

[0012] S2, number the production equipment to obtain the first production equipment to the Nth production equipment; the power supply interfaces of the first production equipment to the Nth production equipment are respectively installed with the first power collector to the Nth power collector; the first production equipment to the Nth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the Nth data transmission interface; search for the data transmission link between the first data transmission interface to the Nth data transmission interface and the data transmission link from the first data transmission interface to the Nth data transmission interface and the human-machine interface, which are respectively recorded as the first data transmission link to the Mth data transmission link; M is the number of data transmission links.

[0013] S3, read the electric power measured by the first power collector to the Nth power collector within the preset first evaluation period, and calculate the first power data sequence to the Nth power data sequence; read the data flow flowing out of the first data transmission interface to the Nth data transmission interface within the first evaluation period, and obtain the first flow data sequence to the Nth flow data sequence; read the data flow from the first data transmission link to the Mth data transmission link within the first evaluation period, and obtain the first transmission data sequence to the Mth transmission data sequence.

[0014] S4. Based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm; and a security situation assessment result is obtained based on the security situation assessment value of the industrial control system.

[0015] Furthermore, the method of reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period and calculating the first power data sequence to the Nth power data sequence includes:

[0016] The electric power measured by the first power collector to the Nth power collector within the first evaluation period is read according to a preset first sampling frequency to obtain a first measured power sequence to an Nth measured power sequence.

[0017] The rated powers of the first production equipment to the Nth production equipment are read to obtain the first rated power to the Nth rated power.

[0018] The first power data sequence to the Nth power data sequence are calculated based on the first measured power sequence to the Nth measured power sequence and the first rated power to the Nth rated power. The calculation formula for the first power data sequence to the Nth power data sequence is:

[0019]

[0020] Among them, D i Indicates the i-th rated power; P ij represents the jth element in the i-th measured power sequence; represents the jth element in the i-th power data sequence; i is an integer variable with a value from 1 to N; j is an integer variable with a value from 1 to H; the calculation formula for H is:

[0021] H = Tf;

[0022] Wherein, T represents the first evaluation period in seconds; f represents the first sampling frequency in Hertz.

[0023] Furthermore, the method of reading the data flow flowing out of the first data transmission interface to the Nth data transmission interface in the first evaluation period to obtain the first flow data sequence to the Nth flow data sequence includes:

[0024] The data flow rate flowing out of the first data transmission interface to the Nth data transmission interface per second is read in the first evaluation period to obtain the first monitoring flow sequence to the Nth monitoring flow sequence.

[0025] The number of bytes of data output per second by the first data transmission interface to the Nth data transmission interface when the first production equipment to the Nth production equipment are operating at rated power is read to obtain the first rated flow rate to the Nth rated flow rate.

[0026] The first flow data sequence to the Nth flow data sequence are calculated based on the first monitoring flow sequence to the Nth monitoring flow sequence and the first rated flow sequence to the Nth rated flow sequence; the calculation formula for the first flow data sequence to the Nth flow data sequence is:

[0027]

[0028] Among them, G i Indicates the i-th rated flow rate; L ir Represents the rth element in the i-th monitored traffic sequence; r is an integer variable with a value from 1 to T; Represents the rth element in the i-th traffic data sequence.

[0029] Furthermore, the method of reading the data flow from the first data transmission link to the Mth data transmission link in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence includes:

[0030] The data flow rate flowing through the first data transmission link to the Mth data transmission link per second is read in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence.

[0031] Furthermore, the method for calculating the security situation assessment value of the industrial control system by using a security situation assessment algorithm based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence includes:

[0032] According to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence, a first security situation assessment sub-item value F1 is obtained by using a device network matching algorithm.

[0033] According to the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence, a data traffic matching algorithm is used to obtain a second security situation assessment sub-item value F2.

[0034] The industrial control system security situation assessment value F3 is calculated based on the first security situation assessment sub-item value and the second security situation assessment sub-item value. The calculation formula of the industrial control system security situation assessment value is:

[0035] F3=F1+F2.

[0036] Furthermore, the method of obtaining the first security situation assessment sub-item value F1 using a device network matching algorithm based on the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence includes:

[0037] The first power identification sequence to the Nth power identification sequence are calculated based on the first power data sequence to the Nth power data sequence. The calculation formula of the first power identification sequence to the Nth power identification sequence is:

[0038]

[0039] Among them, B ij represents the jth element in the i-th power identification sequence; μ1 represents the preset power threshold.

[0040] The first power identification sequence to the Nth power identification sequence are time-series aggregated to obtain the first power matching sequence to the Nth power matching sequence.

[0041] The first security situation assessment sub-item value is calculated based on the first power matching sequence to the Nth power matching sequence and the first flow data sequence to the Nth flow data sequence. The calculation formula of the first security situation assessment sub-item value is:

[0042]

[0043] Among them, C ir represents the rth element in the i-th power matching sequence.

[0044] Furthermore, the method of performing time-series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence includes:

[0045] The first power matching sequence to the Nth power matching sequence are calculated based on the first power identification sequence to the Nth power identification sequence. The calculation formula of the first power matching sequence to the Nth power matching sequence is:

[0046]

[0047] Furthermore, the method of obtaining the second security situation assessment sub-item value F2 by using a data flow matching algorithm based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence includes:

[0048] The second security situation assessment sub-item value is calculated based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence. The calculation formula of the second security situation assessment sub-item value is:

[0049]

[0050] Among them, Y kr Represents the rth element in the kth transmitted data sequence; k is an integer variable with a value from 1 to M.

[0051] Furthermore, the method for obtaining a security situation assessment result according to the industrial control system security situation assessment value includes:

[0052] The security situation assessment value of the industrial control system is compared with the pre-set assessment threshold. When the security situation assessment value of the industrial control system is less than the assessment threshold, the security situation assessment result is that the security situation of the industrial control system meets the requirements. When the security situation assessment value of the industrial control system is greater than or equal to the assessment threshold, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements.

[0053] (3) Beneficial effects

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] By calculating the first security situation assessment sub-item value, the matching degree between the equipment operation status and the industrial control system network transmission data is evaluated. By calculating the second security situation assessment sub-item value, the data transmission matching degree between the network transmission data link and the data transmission interface is evaluated, thereby realizing the assessment of the security situation of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flowchart of a method for assessing the security situation of an industrial control system according to Example 1 of the present invention. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0058] Before giving examples, it is necessary to explain the application scenario of the present invention. The present invention is applied to the security situation assessment of tobacco industrial control systems.

[0059] Example 1: Figure 1 As shown, this embodiment provides a method for assessing the security situation of an industrial control system, the method comprising the following steps:

[0060] S1, obtaining first data; the first data includes the number N of production equipment.

[0061] For example, the automated tobacco production line has eight production equipment, including a shredder, a cigarette drying machine, a cigarette making machine, a filter rod forming machine, a connecting machine, a packaging machine, a cartoning machine, and an elevator, where N=8.

[0062] S2, number the production equipment to obtain the first production equipment to the Nth production equipment; the power supply interfaces of the first production equipment to the Nth production equipment are respectively installed with the first power collector to the Nth power collector; the first production equipment to the Nth production equipment are all installed with data transmission interfaces, which are respectively recorded as the first data transmission interface to the Nth data transmission interface; search for the data transmission link between the first data transmission interface to the Nth data transmission interface and the data transmission link from the first data transmission interface to the Nth data transmission interface and the human-machine interface, which are respectively recorded as the first data transmission link to the Mth data transmission link; M is the number of data transmission links.

[0063] For example, the production equipment is numbered to obtain the first through eighth production equipment. Each of the first through eighth production equipment is connected to the distribution transformer of the tobacco automation factory via a power supply interface. The power supply interfaces of the first through eighth production equipment are respectively equipped with the first through eighth power harvesters. In the industrial control system of the automated production line, each production equipment is equipped with a data transmission interface, which is connected via a data transmission link for data exchange. The data transmission interface and the data transmission link together constitute the industrial control system data network. Each of the first through eighth production equipment is equipped with a data transmission interface, which is respectively designated as the first through eighth data transmission interface. The data transmission links between the first through eighth data transmission interfaces and the data transmission links between the first through eighth data transmission interfaces and the human-machine interface are searched for. A total of ten data transmission links are found, designated as the first through tenth data transmission links. For example, the first data transmission link is the data transmission link between the data transmission interface installed on the shredder and the data transmission interface installed on the tobacco drying machine. During the production process, the shredder cuts tobacco leaves into fine strands, which are then transported to the tobacco drying machine via a crawler belt for drying. In order to match the tobacco drying parameters such as the tobacco drying temperature and tobacco drying humidity of the tobacco drying machine with the tobacco output speed and tobacco output volume of the tobacco cutter, it is necessary to transmit the tobacco output speed and tobacco output volume data of the tobacco cutter to the data transmission interface installed on the tobacco drying machine through the first data transmission link, so that the tobacco drying machine can adaptively adjust the tobacco drying parameters such as the tobacco drying temperature and tobacco drying humidity according to the tobacco cutting parameters such as the tobacco output speed and tobacco output volume of the tobacco cutter.

[0064] S3, read the electric power measured by the first power collector to the Nth power collector within the preset first evaluation period, and calculate the first power data sequence to the Nth power data sequence; read the data flow flowing out of the first data transmission interface to the Nth data transmission interface within the first evaluation period, and obtain the first flow data sequence to the Nth flow data sequence; read the data flow from the first data transmission link to the Mth data transmission link within the first evaluation period, and obtain the first transmission data sequence to the Mth transmission data sequence.

[0065] For example, the pre-set first evaluation period is 3600 seconds. Therefore, the power consumption measured by the first power collector to the eighth power collector is read to obtain the first to eighth power data sequences. The data flow rate flowing out of the first data transmission interface to the eighth data transmission interface within 3600 seconds is read to obtain the first to eighth flow data sequences. The data flow rate of the first data transmission link to the tenth data transmission link within 3600 seconds is read to obtain the first to tenth transmission data sequences.

[0066] S4. Based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm; and a security situation assessment result is obtained based on the security situation assessment value of the industrial control system.

[0067] Exemplarily, based on the first power data sequence to the eighth power data sequence, the first flow data sequence to the eighth flow data sequence, and the first transmission data sequence to the tenth transmission data sequence, a security situation assessment value of the industrial control system is calculated by a security situation assessment algorithm. A security situation assessment result is obtained based on the industrial control system security situation assessment value. The security situation assessment result is one of "the security situation of the industrial control system meets the requirements" and "the security situation of the industrial control system does not meet the requirements". If the security situation assessment result is "the security situation of the industrial control system meets the requirements", it means that there is no fault in the first production equipment to the eighth production equipment, the first data transmission interface to the eighth data transmission interface, and the first data transmission link to the tenth data transmission link. If the security situation assessment result is "the security situation of the industrial control system does not meet the requirements", it means that there is a device fault or a network fault in the first production equipment to the eighth production equipment, the first data transmission interface to the eighth data transmission interface, and the first data transmission link to the tenth data transmission link. For example, the first flow data sequence is a 0 sequence, while the first power data sequence is a 1 sequence. The security situation assessment algorithm calculates the industrial control system security situation assessment value to be 0.2125, which is greater than the pre-set assessment threshold of 0.1. Therefore, the security situation assessment result indicates that the industrial control system security situation does not meet the requirements, indicating that there is a device failure or network failure in the first to eighth production equipment, the first to eighth data transmission interfaces, and the first to tenth data transmission links. Upon investigation, it was discovered that the data transmission interface installed on the shredder, namely the first data transmission interface, had failed, preventing the data transmission interface installed on the shredder from transmitting data to the data transmission interface installed on the shredder. In this case, the shredder's drying parameters, such as drying temperature and drying humidity, cannot match the shredder's cutting parameters, such as tobacco output speed and tobacco output volume, resulting in defective tobacco products.

[0068] Furthermore, the method of reading the electric power measured by the first power collector to the Nth power collector within a preset first evaluation period and calculating the first power data sequence to the Nth power data sequence includes:

[0069] The electric power measured by the first power collector to the Nth power collector within the first evaluation period is read according to a preset first sampling frequency to obtain a first measured power sequence to an Nth measured power sequence.

[0070] For example, the preset first sampling frequency is 10 Hz. Therefore, the power consumption measured by the first to eighth power harvesters within 3600 seconds is read at the first sampling frequency of 10 Hz to obtain first to eighth measured power sequences. The length of each of the first to eighth measured power sequences is 36000.

[0071] The rated powers of the first production equipment to the Nth production equipment are read to obtain the first rated power to the Nth rated power.

[0072] Exemplarily, the rated powers of the first to eighth production equipment are read from the nameplates of the production equipment to obtain the first to eighth rated powers.

[0073] The first power data sequence to the Nth power data sequence are calculated based on the first measured power sequence to the Nth measured power sequence and the first rated power to the Nth rated power. The calculation formula for the first power data sequence to the Nth power data sequence is:

[0074]

[0075] Among them, D i Indicates the i-th rated power; P ij represents the jth element in the i-th measured power sequence; represents the jth element in the i-th power data sequence; i is an integer variable with a value from 1 to N; j is an integer variable with a value from 1 to H; the calculation formula for H is:

[0076] H = Tf;

[0077] Wherein, T represents the first evaluation period in seconds; f represents the first sampling frequency in Hertz.

[0078] Furthermore, the method of reading the data flow flowing out of the first data transmission interface to the Nth data transmission interface in the first evaluation period to obtain the first flow data sequence to the Nth flow data sequence includes:

[0079] The data flow rate flowing out of the first data transmission interface to the Nth data transmission interface per second is read in the first evaluation period to obtain the first monitoring flow sequence to the Nth monitoring flow sequence.

[0080] For example, the data flow rate flowing out of the first data transmission interface to the eighth data transmission interface per second within 3600 seconds is read, where the data flow rate is in bytes per second, to obtain the first monitoring flow sequence to the eighth monitoring flow sequence.

[0081] The number of bytes of data output per second by the first data transmission interface to the Nth data transmission interface when the first production equipment to the Nth production equipment are operating at rated power is read to obtain the first rated flow rate to the Nth rated flow rate.

[0082] For example, the first to eighth rated flow rates are obtained by reading the number of bytes of data output per second by the first to eighth data transmission interfaces of the first to eighth production equipment when operating at rated power. For example, when operating at rated power, the tobacco output speed and tobacco output volume data are output via the first data transmission interface of the tobacco cutter. The data transmission frequency is 100 times per second, and each output data packet of tobacco output speed and tobacco output volume is 548 bytes. Therefore, the first rated flow rate is 54,800 bytes.

[0083] The first flow data sequence to the Nth flow data sequence are calculated based on the first monitoring flow sequence to the Nth monitoring flow sequence and the first rated flow sequence to the Nth rated flow sequence; the calculation formula for the first flow data sequence to the Nth flow data sequence is:

[0084]

[0085] Among them, G i Indicates the i-th rated flow rate; L ir Represents the rth element in the i-th monitored traffic sequence; r is an integer variable with a value from 1 to T; Represents the rth element in the i-th traffic data sequence.

[0086] Furthermore, the method of reading the data flow from the first data transmission link to the Mth data transmission link in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence includes:

[0087] The data flow rate flowing through the first data transmission link to the Mth data transmission link per second is read in the first evaluation period to obtain the first transmission data sequence to the Mth transmission data sequence.

[0088] Furthermore, the method for calculating the security situation assessment value of the industrial control system by using a security situation assessment algorithm based on the first power data sequence to the Nth power data sequence, the first flow data sequence to the Nth flow data sequence, and the first transmission data sequence to the Mth transmission data sequence includes:

[0089] According to the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence, a first security situation assessment sub-item value F1 is obtained by using a device network matching algorithm.

[0090] For example, the first security posture assessment sub-item value F1 reflects the degree of compatibility between the device's operating status and the data transmitted over the industrial control system network. A larger value F1 indicates a poorer match between the device's operating status and the data transmitted over the industrial control system network. Reasons for an excessively large first security posture assessment sub-item value F1 include: a damaged data transmission interface.

[0091] According to the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence, a data traffic matching algorithm is used to obtain a second security situation assessment sub-item value F2.

[0092] For example, the second security posture assessment sub-item value F2 reflects the degree of data transmission matching between the network transmission data link and the data transmission interface. A larger second security posture assessment sub-item value F2 indicates a poorer data transmission matching between the network transmission data link and the data transmission interface. Reasons for an excessively large second security posture assessment sub-item value F2 include: a damaged data transmission link.

[0093] The industrial control system security situation assessment value F3 is calculated based on the first security situation assessment sub-item value and the second security situation assessment sub-item value. The calculation formula of the industrial control system security situation assessment value is:

[0094] F3=F1+F2.

[0095] Exemplarily, the calculation yields F1 = 0.2037, F2 = 0.0088, and therefore F3 = 0.2125.

[0096] Furthermore, the method of obtaining the first security situation assessment sub-item value F1 using a device network matching algorithm based on the first power data sequence to the Nth power data sequence and the first flow data sequence to the Nth flow data sequence includes:

[0097] The first power identification sequence to the Nth power identification sequence are calculated based on the first power data sequence to the Nth power data sequence. The calculation formula of the first power identification sequence to the Nth power identification sequence is:

[0098]

[0099] Among them, B ij represents the jth element in the i-th power identification sequence; μ1 represents the preset power threshold.

[0100] For example, the preset power threshold μ1 = 0.5. The purpose of setting the power threshold is to filter out the influence of the device startup transition process.

[0101] The first power identification sequence to the Nth power identification sequence are time-series aggregated to obtain the first power matching sequence to the Nth power matching sequence.

[0102] The first security situation assessment sub-item value is calculated based on the first power matching sequence to the Nth power matching sequence and the first flow data sequence to the Nth flow data sequence. The calculation formula of the first security situation assessment sub-item value is:

[0103]

[0104] Among them, C ir represents the rth element in the i-th power matching sequence.

[0105] Furthermore, the method of performing time-series aggregation on the first power identification sequence to the Nth power identification sequence to obtain the first power matching sequence to the Nth power matching sequence includes:

[0106] The first power matching sequence to the Nth power matching sequence are calculated based on the first power identification sequence to the Nth power identification sequence. The calculation formula of the first power matching sequence to the Nth power matching sequence is:

[0107]

[0108] Furthermore, the method of obtaining the second security situation assessment sub-item value F2 by using a data flow matching algorithm based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring flow sequence to the Nth monitoring flow sequence includes:

[0109] The second security situation assessment sub-item value is calculated based on the first transmission data sequence to the Mth transmission data sequence and the first monitoring traffic sequence to the Nth monitoring traffic sequence. The calculation formula of the second security situation assessment sub-item value is:

[0110]

[0111] Among them, Y kr Represents the rth element in the kth transmitted data sequence; k is an integer variable with a value from 1 to M.

[0112] Furthermore, the method for obtaining a security situation assessment result according to the industrial control system security situation assessment value includes:

[0113] The security situation assessment value of the industrial control system is compared with the pre-set assessment threshold. When the security situation assessment value of the industrial control system is less than the assessment threshold, the security situation assessment result is that the security situation of the industrial control system meets the requirements. When the security situation assessment value of the industrial control system is greater than or equal to the assessment threshold, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements.

[0114] For example, the security situation assessment value of the industrial control system calculated by the security situation assessment algorithm is 0.2125, which is greater than the pre-set assessment threshold of 0.1. Therefore, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements.

[0115] Finally, it should be noted that although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for assessing the security situation of an industrial control system, characterized in that: The method comprises the following steps: S1, obtain first data; the first data includes the number of production equipment N ; S2, number the production equipment, and get the number of production equipment from the first to the N Production equipment; the first production equipment to the N The power supply interfaces of the production equipment are respectively equipped with the first power collector to the N Power harvester; the first production equipment to the N The production equipment is equipped with data transmission interfaces, which are respectively recorded as the first data transmission interface to the N Data transmission interface; search the first data transmission interface to the N The data transmission link between the data transmission interfaces and the first data transmission interface to the second N The data transmission links between the data transmission interface and the human-machine interface are respectively recorded as the first data transmission link to the first data transmission link. M Data transmission link; M is the number of data transmission links; S3, read the first power collector to the first power collector in the preset first evaluation period. N The power data sequence from the first to the second is calculated by the power collector. N Power data sequence; the first power data sequence to the N The calculation formula for the power data series is: ； in, Indicates the Rated power; Indicates the The first elements; Indicates the The first elements; The value range is 1 to N integer variable; The value range is 1 to H integer variable; H The calculation formula is: ； in, Indicates the first evaluation period in seconds; Indicates the first sampling frequency in Hertz; Read the data transmitted from the first data transmission interface to the first data transmission interface in the first evaluation period. N The data flow of the data transmission interface is obtained from the first flow data sequence to the N Traffic data series; The first flow data sequence to the N The calculation formula for the flow data series is: ； in, Indicates the Rated flow rate; Indicates the Monitor the flow sequence elements; The value range is 1 to T integer variable; Indicates the The first elements; Read the first data transmission link to the first data transmission link in the first evaluation period M The data flow of the data transmission link is obtained by M Transmit data sequence; S4, according to the first power data sequence to the N Power data sequence, first flow data sequence to the N Traffic data sequence, first transmission data sequence to the M Transmit the data sequence, calculate the security situation assessment value of the industrial control system through the security situation assessment algorithm; and obtain the security situation assessment result based on the security situation assessment value of the industrial control system; The first power data sequence to the N Power data sequence, first flow data sequence to the N Traffic data sequence, first transmission data sequence to the M The method for transmitting a data sequence and calculating a security situation assessment value of an industrial control system using a security situation assessment algorithm includes: According to the first power data sequence to the N Power data sequence, first flow data sequence to the N Traffic data sequence, using the device network matching algorithm to obtain the first security situation assessment sub-item value ; According to the first transmission data sequence to the M Transmission data sequence, first monitoring flow sequence to the N Monitor the traffic sequence and use the data traffic matching algorithm to obtain the second security situation assessment sub-item value ; The industrial control system security situation assessment value is calculated based on the first security situation assessment sub-item value and the second security situation assessment sub-item value. The calculation formula for the industrial control system security situation assessment value is: ； The calculation formula for the first security posture assessment sub-item value is: ； in, Indicates the The first in the power matching sequence elements; The first power matching sequence to the N The calculation formula of the power matching sequence is: ； in, Indicates the The first elements; The first power identification sequence to the N The calculation formula of the power identification sequence is: ； Indicates the preset power threshold; The calculation formula for the second security situation assessment sub-item value is: ； in, Indicates the The first elements; The value range is 1 to M An integer variable.

2. The method for assessing the security situation of an industrial control system according to claim 1, wherein: The reading of the first power collector to the first power collector in the preset first evaluation period N The power data sequence from the first to the second is calculated by the power collector. N Methods for power data series include: The first power collector to the first power collector in the first evaluation period is read according to the preset first sampling frequency. N The power collector measures the power consumption, and obtains the first measured power sequence to the N Measuring power sequence; Read the first production equipment to the N The rated power of the production equipment is obtained from the first rated power to the N Rated power; According to the first power measurement sequence to the N Measure power sequence, first rated power to the N The rated power is calculated to obtain the first power data sequence to the N Power data series.

3. The method for assessing the security situation of an industrial control system according to claim 2, wherein: The data transmitted from the first data transmission interface to the first data transmission interface during the first evaluation period is read N The data flow of the data transmission interface is obtained from the first flow data sequence to the N Methods for flow data series include: Read the data flowing out of the first data transmission interface to the first data transmission interface per second during the first evaluation period. N The data flow of the data transmission interface is obtained from the first monitoring flow sequence to the N Monitoring traffic sequences; Read the first production equipment to the N When the production equipment is in rated power operation, the first data transmission interface is connected to the second N The number of bytes of data output per second by the data transmission interface is obtained from the first rated flow to the second rated flow. N Rated flow rate; According to the first monitoring flow sequence to the N Monitor flow sequence, first rated flow to N The rated flow rate is calculated to obtain the first flow rate data sequence to the N Traffic data series.

4. The method for assessing the security situation of an industrial control system according to claim 3, wherein: The first data transmission link to the first data transmission link in the first evaluation period is read M The data flow of the data transmission link is obtained by M Methods for transmitting data sequences include: Read the data flowing through the first data transmission link to the second data transmission link every second in the first evaluation period. M The data flow of the data transmission link is obtained by M Transmit data sequence.

5. The method for assessing security situation of an industrial control system according to claim 4, wherein: The first power data sequence to the N Power data sequence, first flow data sequence to the N Traffic data sequence, using the device network matching algorithm to obtain the first security situation assessment sub-item value The methods include: According to the first power data sequence to the N The power data sequence is calculated to obtain the first power identification sequence to the N Power identification sequence; For the first power identification sequence to the N The power identification sequence is time-series aggregated to obtain the first power matching sequence to the N Power matching sequence; According to the first power matching sequence to the N Power matching sequence, first flow data sequence to the N The traffic data sequence is calculated to obtain the first security situation assessment sub-item value.

6. The method for assessing the security situation of an industrial control system according to claim 5, wherein: The first power identification sequence to the N The power identification sequence is time-series aggregated to obtain the first power matching sequence to the N Methods for power matching sequences include: According to the first power identification sequence to the N The power identification sequence is calculated to obtain the first power matching sequence to the N Power matching sequence.

7. The method for assessing the security situation of an industrial control system according to claim 6, wherein: The first transmission data sequence to the M Transmission data sequence, first monitoring flow sequence to the N Monitor the traffic sequence and use the data traffic matching algorithm to obtain the second security situation assessment sub-item value The methods include: According to the first transmission data sequence to the M Transmission data sequence, first monitoring flow sequence to the N The traffic sequence is monitored and calculated to obtain the second security situation assessment sub-item value.

8. The method for assessing security situation of an industrial control system according to claim 7, wherein: The method for obtaining a security situation assessment result according to the industrial control system security situation assessment value includes: The security situation assessment value of the industrial control system is compared with the pre-set assessment threshold. When the security situation assessment value of the industrial control system is less than the assessment threshold, the security situation assessment result is that the security situation of the industrial control system meets the requirements. When the security situation assessment value of the industrial control system is greater than or equal to the assessment threshold, the security situation assessment result is that the security situation of the industrial control system does not meet the requirements.

Images