Network security risk assessment method based on big data

Abstract

The invention discloses a network security risk assessment method based on big data, and particularly relates to the technical field of risk assessment, and the method comprises the steps: determining a transition probability matrix of data transmission states of other devices through the historical data of the other devices, and determining the time delay information of the other devices in combination with the transmission data attributes of the other devices, the data transmission change information of other devices is determined according to the change information amount of the data transmission of the other devices and the risk degree of the data transmission of the other devices, the key device with the high importance degree in the other devices is obtained, and the key device with the high importance degree in the other devices is obtained by collecting the feature data of the devices in the industrial Internet of Things environment. The cluster where the invaded equipment is located is determined through clustering analysis, the FP-Growth algorithm is used for mining the frequent item set in the cluster where the invaded equipment is located, early warning is carried out on other equipment with the high invasion possibility, and accurate evaluation and early warning of the network invasion risk in the industrial Internet of Things environment are facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of risk assessment, and more specifically, to a network security risk assessment method based on big data. Background Art

[0002] In the industrial Internet of Things environment, thousands of devices are interconnected through the network and transmit large amounts of data in real time. These devices are widely distributed in production workshops, logistics centers, energy management and other scenarios. Their operating status, data transmission characteristics, communication modes and geographical locations are significantly different. With the continuous development of industrial automation and intelligent manufacturing, the number of industrial Internet of Things devices is increasing, and their system complexity and connectivity have been greatly improved, which is also accompanied by increasingly serious security threats. At present, device intrusion incidents are becoming more and more frequent. Once a device is invaded, the attacker may take advantage of the close connection between devices to conduct lateral penetration, causing cascading failures in the entire network system. Traditional security monitoring methods often only focus on the anomalies of a single device, ignoring the commonalities between devices and potential attack chains. It is difficult to predict which devices may be affected by the intrusion, and thus lack the ability to accurately assess the risk of device intrusion.

[0003] In order to solve the above defects, a technical solution is now provided. Summary of the invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a network security risk assessment method based on big data to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions: A network security risk assessment method based on big data specifically includes the following steps: S1: Determine the invaded device in the IIoT environment. After the device is invaded, determine the transition probability matrix of the data transmission state of the remaining devices through the historical data of the remaining devices, and determine the time delay information of the remaining devices in combination with the transmission data attributes of the remaining devices; S2: determining the data transmission change information of the remaining devices by comparing the amount of data transmission change information of the remaining devices and the risk level of data transmission of the remaining devices; S3: Comprehensively analyze the time delay information and data transmission change information of the remaining devices, determine the importance of the remaining devices, and obtain the key devices with higher importance among the remaining devices; S4: By collecting characteristic data of devices in the industrial Internet of Things environment, the cluster of the hacked device is determined through cluster analysis, and the FP-Growth algorithm is used to mine frequent item sets in the cluster where the hacked device is located to determine the correlation information of the remaining devices. The correlation information and importance of the remaining devices are combined for analysis, and warnings are issued for the remaining devices with a higher possibility of being hacked.

[0006] In a preferred embodiment, the time delay information of the remaining devices includes: The time delay information of the remaining devices is represented by the state transition coefficient; The acquisition logic of the state transfer coefficient is: define the device data transmission state, and divide the device data transmission state into a normal transmission state, a delayed transmission state, and a timeout transmission state; Based on the historical records of device operation, determine the transmission results of different types of device data, obtain the state transition times of device data transmission status in the historical records, and construct the transition probability matrix , by solving , we get the long-term state distribution of device data transmission, and mark the long-term state distribution of device data transmission as: ,in, is the steady-state probability of the normal transmission state, is the steady-state probability of the delayed transmission state, is the steady-state probability of the timeout transmission state; For different types of data transmitted by the device, determine the type of data transmitted by the device within the monitoring interval, determine the impact of time delay on different types of data, and calculate the transmission quality score of different types of data of the device within the monitoring interval. The calculation formula of the transmission quality score is: ;in, Rate the quality of the transmission, is the weight coefficient of different types of data in normal transmission state, is the weight coefficient of different types of data in delayed transmission state, is the weight coefficient of different types of data in the timeout transmission state; Taking each device as a node, the communication relationship graph of the devices in the monitoring interval is determined. According to the topological centrality of the devices in the monitoring interval, the normalized betweenness centrality of the devices is obtained, and the state transfer coefficient is calculated. The calculation formula is: ;in, is the state transfer coefficient, is the betweenness centrality of the device.

[0007] In a preferred embodiment, the data transmission change information of the remaining devices includes: The data transmission change information of other devices is represented by the entropy value change coefficient and the data type risk assessment coefficient; The logic for obtaining the entropy value change coefficient is as follows: according to the data type transmitted by the device in the monitoring interval, the probability density distribution of different types of data is determined using kernel density estimation, the information entropy of different types of data in the monitoring interval is calculated based on the probability density distribution of different types of data, and the entropy value change coefficient is calculated according to the weight of different types of data in the industrial Internet of Things environment; The calculation formula for the probability density distribution of different types of data is: ;in, is the probability density function of different data types of the device in the monitoring interval, is the total number of samples of different data types within the monitoring interval, n is the sample index, SJ is the specified value of the data, is the data of different data types of the device in the monitoring interval, h is the bandwidth, The calculation formula of the entropy value change coefficient is: ;in, is the entropy change coefficient, The weights of different types of data in the Industrial Internet of Things environment.

[0008] In a preferred embodiment, the data type risk assessment coefficient includes: The acquisition logic of the data type risk assessment coefficient is: according to the data type generated by the device, determine the abnormal events of different types of data of the device, and based on the abnormal events of different types of data of the device, determine the impact score values ​​of different types of data; According to the data type generated by the device within the monitoring interval, a regression model is constructed by combining the impact score values ​​of different types of data within the monitoring interval and the transmission frequency of different types of data within the monitoring interval to generate a data type risk assessment coefficient; The calculation formula for the data type risk assessment coefficient is: ; in, is the data type risk assessment coefficient, 1, 2, 3, ..., i are the numbers of different types of data, , , ……、 The impact scores for different types of data are , , ……、 is the transmission frequency of different types of data, and e is the base.

[0009] In a preferred embodiment, determining the importance of the remaining devices includes: The time delay information and data transmission change information of the remaining devices are comprehensively analyzed, and weighted calculation is performed through the state transfer coefficient, entropy value change coefficient and data type risk assessment coefficient to build an equipment importance assessment model and generate the equipment importance assessment coefficient. The calculation formula of the equipment importance assessment coefficient is: ;in, is the equipment importance assessment coefficient, , , are the proportional coefficients of the state transition coefficient, entropy value change coefficient and data type risk assessment coefficient, respectively. , , They are both greater than 0; Set the device importance assessment coefficient threshold, obtain the device importance assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, compare the device importance assessment coefficients of the remaining devices with the device importance assessment coefficient threshold, if the device importance assessment coefficient is greater than the device importance assessment coefficient threshold, mark the device as a critical device, if the device importance assessment coefficient is less than the device importance assessment coefficient threshold, do not mark the device.

[0010] In a preferred embodiment, determining the association information of the remaining devices includes: The correlation information of the remaining devices is represented by the clustering correlation coefficient; The logic for obtaining the clustering correlation coefficient is as follows: obtaining the operating data of each device in the industrial Internet of Things environment, extracting features of the operating data of each device, including time features, communication features, transmission features and location features, fusing the time features, communication features, transmission features and location features, and constructing a comprehensive feature vector; The features of different units are normalized, the cosine similarity is used to calculate the similarity between devices, and the t-SNE algorithm is used to reduce the dimension, so that the device data is projected into a low-dimensional space, and the devices are clustered and analyzed using the K-Means clustering algorithm; Determine the cluster where the invaded device is located, obtain the other devices in the cluster where the invaded device is located, calculate the distance between the invaded device and the other devices in the cluster by Euclidean distance, and obtain the minimum distance between the other devices and the invaded device; Use the FP-Growth algorithm to mine frequent itemsets in the cluster where the hacked device is located, identify the frequent itemsets of the device, and obtain the support and relevance of the remaining devices in the cluster where the hacked device is located; Calculate the clustering correlation coefficient, the calculation formula is: ;in, is the clustering correlation coefficient, ZC is the support, XG is the correlation, and JL is the minimum distance between the remaining devices and the invaded device. Is a normal number.

[0011] In a preferred embodiment, the remaining devices with a high possibility of being invaded are warned, including: The device importance evaluation coefficient and the cluster correlation coefficient are weighted to generate the intrusion device evaluation coefficient. The calculation formula of the intrusion device evaluation coefficient is: ;in, is the intrusion device assessment coefficient, is the proportional coefficient of the equipment importance assessment coefficient, is the proportional coefficient of the class association coefficient, , They are both greater than 0; An intrusion device assessment coefficient threshold is set to obtain the intrusion device assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, and the intrusion device assessment coefficients of the remaining devices are compared with the intrusion device assessment coefficient threshold. If the intrusion device assessment coefficients of the remaining devices are greater than the intrusion device assessment coefficient threshold, a warning signal is generated; if the intrusion device assessment coefficients of the remaining devices are less than the intrusion device assessment coefficient threshold, no warning signal is generated.

[0012] Technical effects and advantages of the present invention: 1. The present invention analyzes the data transmitted by other devices in the industrial Internet of Things environment after the invasion, analyzes the importance of the equipment from the perspective of time delay and data change, and quantifies the importance of the equipment during operation. The present invention is deployed for key equipment to reduce the potential losses and risks caused by equipment invasion.

[0013] 2. The present invention combines time delay, data transmission changes and correlation between devices to achieve multi-angle quantitative assessment of equipment risks, provide more comprehensive and accurate security situation awareness, use clustering algorithms to narrow the scope of equipment analysis, and apply FP-Growth algorithm in clusters to efficiently mine frequent item sets, thereby quickly capturing intrusion association patterns between devices and improving detection accuracy. Through comprehensive quantification of equipment risks and correlations, it helps security managers to prioritize monitoring and protection of key equipment, achieve efficient use of resources and precise control of risks. The present invention helps to accurately assess and warn of equipment intrusion risks in industrial Internet of Things environments through multi-dimensional data fusion, cluster analysis and association rule mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings; Figure 1The present invention is a flowchart of a network security risk assessment method based on big data. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Example 1 Figure 1 The present invention is a flowchart of a network security risk assessment method based on big data, which specifically includes the following steps: S1: Determine the invaded device in the IIoT environment. After the device is invaded, determine the transition probability matrix of the data transmission state of the remaining devices through the historical data of the remaining devices, and determine the time delay information of the remaining devices in combination with the transmission data attributes of the remaining devices; S2: determining the data transmission change information of the remaining devices by comparing the amount of data transmission change information of the remaining devices and the risk level of data transmission of the remaining devices; S3: Comprehensively analyze the time delay information and data transmission change information of the remaining devices, determine the importance of the remaining devices, and obtain the key devices with higher importance among the remaining devices; S4: By collecting characteristic data of devices in the industrial Internet of Things environment, the cluster of the hacked device is determined through cluster analysis, and the FP-Growth algorithm is used to mine frequent item sets in the cluster where the hacked device is located to determine the correlation information of the remaining devices. The correlation information and importance of the remaining devices are combined for analysis, and warnings are issued for the remaining devices with a higher possibility of being hacked.

[0017] In the industrial Internet of Things environment, when a device is invaded, determining the importance of other devices and setting inspection priorities accordingly is a key strategy for network security risk control. By dynamically adjusting the priority, the false alarm processing of non-critical devices can be reduced and the work efficiency of operation and maintenance personnel can be improved. Among them, after facing device invasion, the importance of each device in the industrial Internet of Things environment is comprehensively evaluated by collecting the time delay information and data transmission change information of the remaining devices. The time delay information of the device is represented by the state transfer coefficient, and the data transmission change information of the device is represented by the entropy change coefficient and the data type risk assessment coefficient.

[0018] Among them, the advantages of the state transfer coefficient are: The state transition coefficient can effectively describe the transition characteristics of the device data transmission state. By counting the number of state transitions of historical data transmission, it can accurately reflect the trend of device communication performance changes. It can capture the performance of the device in different operating states (such as normal, delayed or timed transmission), and provide dynamic information about device communication, thereby helping the system to evaluate and optimize the communication quality of the device in real time; The state transition coefficient combines the betweenness centrality of a device to evaluate its importance in the network. For devices with high importance and high betweenness centrality, the state transition coefficient can reflect the greater impact of their potential transmission delay or timeout transmission. The system can prioritize the detection and monitoring of these key devices to reduce transmission failures or performance degradation of important devices in the network and ensure the overall stability and reliability of the system; The state transfer coefficient can also be combined with the time delay sensitivity of different data types to evaluate transmission quality. For data that is more sensitive to time delay (such as device control data), its weight in the state transfer coefficient is higher, and it can prioritize the identification of situations where delays affect system functions. This helps improve the monitoring and response capabilities of key data and ensure that tasks with high real-time requirements are processed in a timely manner.

[0019] The acquisition logic of the state transfer coefficient is: define the device data transmission state, and divide the device data transmission state into a normal transmission state, a delayed transmission state, and a timeout transmission state; It should be noted that the normal transmission status means that the data can be successfully transmitted to the target node within the preset time threshold, delayed transmission means that the data exceeds the threshold but is finally successfully transmitted, and the timeout transmission status means that the data is not successfully transmitted within the maximum tolerance time, which is regarded as a transmission failure and needs to be retransmitted or discarded.

[0020] Based on the historical records of device operation, determine the transmission results of different types of device data, obtain the state transition times of device data transmission status in the historical records, and construct the transition probability matrix , by solving , we get the long-term state distribution of device data transmission, and mark the long-term state distribution of device data transmission as: ,in, is the steady-state probability of the normal transmission state, is the steady-state probability of the delayed transmission state, is the steady-state probability of the timeout transmission state; For different types of data transmitted by the device, determine the type of data transmitted by the device within the monitoring interval, determine the impact of time delay on different types of data, and calculate the transmission quality score of different types of data of the device within the monitoring interval. The calculation formula of the transmission quality score is: ;in, Rate the quality of the transmission, is the weight coefficient of different types of data in normal transmission state, is the weight coefficient of different types of data in delayed transmission state, is the weight coefficient of different types of data in the timeout transmission state; It should be noted that a device may generate multiple types of data, and different data types have different sensitivities to time delays. The temperature, humidity and other data generated by conventional sensors are less sensitive to time delays. Therefore, the weight coefficient of data generated by conventional sensors in different device data transmission states is lower, while device control type data is more sensitive to time delays, such as the control of a robotic arm. Therefore, the weight coefficient of device control type data in different device data transmission states is higher.

[0021] Taking each device as a node, the communication relationship graph of the devices in the monitoring interval is determined. According to the topological centrality of the devices in the monitoring interval, the normalized betweenness centrality of the devices is obtained, and the state transfer coefficient is calculated. The calculation formula is: ;in, is the state transfer coefficient, is the betweenness centrality of the device; It should be noted that after normalization, the betweenness centrality of each device ranges from 0 to 1, where the betweenness centrality of the key node is 1 and the betweenness centrality of the edge node is 0.

[0022] It can be seen from the formula that the larger the state transfer coefficient is, the more important the equipment is. Secondly, if an intruder invades the equipment, the time delay may be greater. When there is equipment intrusion in the factory, the intruder is more likely to invade the equipment, so it is necessary to give priority to the detection of the equipment.

[0023] The advantages of the entropy variation coefficient are: The entropy value variation coefficient can evaluate the randomness and degree of variation of the data generated by the device within the monitoring interval by analyzing the uncertainty of the device data. Devices with large entropy values ​​have more dramatic changes during data transmission, indicating that the state of the device may be more complex or unstable. This uncertainty can help identify potential failure risks or abnormal conditions in the system, and make timely adjustments and responses; The coefficient of change of entropy can also reveal whether the device is vulnerable to intruders. Device data with high entropy values ​​indicates that there is greater uncertainty in its transmission process, which also means that the device is more likely to be attacked or interfered with. After intruders invade these devices, it may cause a greater impact, so it is necessary to give priority to intrusion detection and security protection of these devices. This provides an effective reference for the security management of the Industrial Internet of Things; In the industrial IoT environment, the types of devices are diverse and the operating conditions are complex. The entropy change coefficient can adapt to the characteristics of different devices and data types, evaluate the characteristics of different data streams, and help engineers make appropriate judgments and optimization plans based on specific situations. This flexibility enables the entropy change coefficient to be widely used in various industrial scenarios.

[0024] The logic for obtaining the entropy value change coefficient is as follows: according to the data type transmitted by the device in the monitoring interval, the probability density distribution of different types of data is determined using kernel density estimation, the information entropy of different types of data in the monitoring interval is calculated based on the probability density distribution of different types of data, and the entropy value change coefficient is calculated according to the weight of different types of data in the industrial Internet of Things environment; The calculation formula for the probability density distribution of different types of data is: ;in, is the probability density function of different data types of the device in the monitoring interval, is the total number of samples of different data types within the monitoring interval, n is the sample index, SJ is the specified value of the data, is the data of different data types of the device in the monitoring interval, h is the bandwidth, The calculation formula of the entropy value change coefficient is: ;in, is the entropy change coefficient, The weights of different types of data in the Industrial Internet of Things environment.

[0025] It can be seen from the formula that the larger the coefficient of change of the entropy value, the higher the uncertainty of the data generated by the device within the monitoring interval, the larger the amount of information generated, the higher the importance of the device, and secondly, the greater the impact the intruder may have on the device. When there is equipment intrusion in the factory, the intruder is more likely to invade the device, so it is necessary to give priority to the detection of the device.

[0026] The advantages of data type risk assessment coefficients are: The data type risk assessment coefficient can assess data risk based on abnormal events of different types of device data. By quantifying the abnormal events and impact scores of various types of data, it can accurately identify which data types are more potentially risky to the transmission and operation of the device. This allows the system to centrally monitor these high-risk data types, thereby reducing the probability of device failure or security incidents; According to the calculation of the risk assessment coefficient of the data type, devices with a higher risk coefficient may face higher security risks. Intruders are more likely to attack high-risk devices because the abnormal data they may generate or the abnormal events they may encounter can cause greater negative impacts. Therefore, the risk assessment of device intrusion can guide the security protection priority and ensure that high-risk devices are focused on detection and protection, thereby improving the overall security protection level of the factory.

[0027] The acquisition logic of the data type risk assessment coefficient is: according to the data type generated by the device, determine the abnormal events of different types of data of the device, and based on the abnormal events of different types of data of the device, determine the impact score values ​​of different types of data; According to the data type generated by the device within the monitoring interval, a regression model is constructed by combining the impact score values ​​of different types of data within the monitoring interval and the transmission frequency of different types of data within the monitoring interval to generate a data type risk assessment coefficient; The calculation formula for the data type risk assessment coefficient is: ; in, is the data type risk assessment coefficient, 1, 2, 3, ..., i are the numbers of different types of data, , , ……、 The impact scores for different types of data are , , ……、 is the transmission frequency of different types of data, and e is the base.

[0028] It should be noted that if the device does not generate a certain type of data within the monitoring interval, the transmission frequency of this type of data is 0.

[0029] It can be seen from the formula that the larger the data type risk assessment coefficient is, the higher the risk of the data generated by the device within the monitoring interval is, and the greater the negative impact caused by the intruder invading the device is likely to be. When there is a device intrusion in the factory, the intruder is more likely to invade the device, so it is necessary to give priority to the detection of the device.

[0030] The time delay information and data transmission change information of the remaining devices are comprehensively analyzed, and weighted calculation is performed through the state transfer coefficient, entropy value change coefficient and data type risk assessment coefficient to build an equipment importance assessment model and generate the equipment importance assessment coefficient. The calculation formula of the equipment importance assessment coefficient is: ;in, is the equipment importance assessment coefficient, , , are the proportional coefficients of the state transition coefficient, entropy value change coefficient and data type risk assessment coefficient, respectively. , , Both are greater than 0.

[0031] It can be seen from the formula that the larger the state transition coefficient, the entropy value change coefficient and the data type risk assessment coefficient, the larger the device importance assessment coefficient, which means that the greater the importance of the device in the monitoring interval, the greater the impact of the intruder on the device may be; conversely, the smaller the state transition coefficient, the entropy value change coefficient and the data type risk assessment coefficient, the smaller the device importance assessment coefficient, which means that the smaller the importance of the device in the monitoring interval, the smaller the impact of the intruder on the device may be.

[0032] Set the device importance assessment coefficient threshold, obtain the device importance assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, and compare the device importance assessment coefficients of the remaining devices with the device importance assessment coefficient threshold. If the device importance assessment coefficient is greater than the device importance assessment coefficient threshold, the device is marked as a critical device, indicating that the data generated by the operation of the device within the monitoring interval is of high importance and there is a high risk of intrusion. If the device importance assessment coefficient is less than the device importance assessment coefficient threshold, the device is not marked.

[0033] This embodiment analyzes the data transmitted by other devices in the industrial Internet of Things environment after the invasion, analyzes the importance of the equipment from the perspective of the impact of time delay and data change, and quantifies the importance of the equipment during operation. The present invention is deployed for key equipment to reduce the potential losses and risks caused by equipment invasion.

[0034] Example 2 The above embodiment determines the importance of a device within a monitoring interval by analyzing data generated by the device. This embodiment determines the likelihood of the remaining devices being invaded by analyzing the connection between the invaded device and the remaining devices.

[0035] By collecting the characteristic data of devices in the industrial Internet of Things environment, the cluster where the invaded device is located is determined through cluster analysis, and the FP-Growth algorithm is used to mine frequent item sets in the cluster where the invaded device is located to determine the correlation information of the device. The correlation information of the device is represented by the clustering correlation coefficient.

[0036] The advantages of clustering correlation coefficient are: Taking into account multi-dimensional features such as time, communication, transmission and location, it is possible to comprehensively characterize the similarities between devices, thereby more accurately capturing the intrinsic correlation of device behavior patterns. The t-SNE algorithm is used to reduce the dimensionality of high-dimensional data, and then combined with the K-Means clustering method, the device data is projected into a low-dimensional space to achieve accurate grouping of devices with similar comprehensive features. By calculating the minimum Euclidean distance between the invaded device and other devices in the cluster, the spatial correlation between devices can be quantified to help identify potential attack chains. The FP-Growth algorithm is used to mine frequent item sets of devices in the cluster, calculate the support and correlation of devices in intrusion events, further reveal the possibility of devices being attacked at the same time, and improve the accuracy of early warning.

[0037] The logic for obtaining the clustering correlation coefficient is as follows: obtaining the operating data of each device in the industrial Internet of Things environment, extracting features of the operating data of each device, including time features, communication features, transmission features and location features, fusing the time features, communication features, transmission features and location features to construct a comprehensive feature vector; It should be noted that time characteristics include the time period of device operation, communication characteristics include the frequency of data packet exchange between devices, transmission characteristics include traffic surges and abnormal transmission delays, and location characteristics include the physical / logical distances between devices. Time characteristics can reflect the similarity of device operation time, communication characteristics can reflect the similarity of communication modes between devices, transmission characteristics can reflect the similarity of data modes, and location characteristics can reflect the similarity of devices in the network topology.

[0038] The features of different units are normalized, the cosine similarity is used to calculate the similarity between devices, and the t-SNE algorithm is used to reduce the dimension, so that the device data is projected into a low-dimensional space, and the K-Means clustering algorithm is used to perform cluster analysis on the devices; It should be noted that the K-Means clustering algorithm classifies devices to obtain clusters of devices with similar comprehensive feature vectors, wherein the number of clusters in the clustering algorithm is determined by methods such as the elbow method, the silhouette coefficient method, and the interval statistic.

[0039] Determine the cluster where the invaded device is located, obtain the other devices in the cluster where the invaded device is located, calculate the distance between the invaded device and the other devices in the cluster by Euclidean distance, and obtain the minimum distance between the other devices and the invaded device; It should be noted that there may be multiple invaded devices in the same cluster, so the association between the remaining devices and the invaded device is quantified by the minimum distance between the remaining devices and the invaded device.

[0040] Use the FP-Growth algorithm to mine frequent itemsets in the cluster where the hacked device is located, identify the frequent itemsets of the device, and obtain the support and relevance of the remaining devices in the cluster where the hacked device is located; It should be noted that the support of the remaining devices in the cluster where the hacked device is located indicates the frequency of the device appearing in all hacked devices, that is, the importance of the device in the attack event. Frequently appearing devices are more likely to become attack targets, and their importance index should be higher. The FP-Growth algorithm is used to calculate the frequent item sets and obtain the frequency of each device appearing in the intrusion event. The higher the support of the remaining devices, the higher the possibility of being hacked. The correlation of the rest of the devices in the cluster where the hacked device is located indicates the degree of association between the device and other devices being hacked at the same time. It can be calculated using methods such as the Pearson correlation coefficient and cosine similarity. Devices with high correlation may belong to the same attack chain, and their importance index should be increased. The FP-Growth algorithm is used to find out which devices are always attacked together, thereby calculating their attack correlation. The higher the correlation of the rest of the devices, the higher the possibility of being hacked.

[0041] Calculate the clustering correlation coefficient, the calculation formula is: ;in, is the clustering correlation coefficient, ZC is the support, XG is the correlation, and JL is the minimum distance between the remaining devices and the invaded device. Is a normal number.

[0042] It can be seen from the formula that the larger the cluster correlation coefficient is, the stronger the correlation between the device and the invaded device is, and the more likely the device is to be invaded. When there is an equipment invasion in the factory, the intruder is more likely to invade the device, so it is necessary to give priority to the detection of the device.

[0043] The device importance evaluation coefficient and the cluster correlation coefficient are weighted to generate the intrusion device evaluation coefficient. The calculation formula of the intrusion device evaluation coefficient is: ;in, is the intrusion device assessment coefficient, is the proportional coefficient of the equipment importance assessment coefficient, is the proportional coefficient of the class association coefficient, , Both are greater than 0.

[0044] Set an intrusion device assessment coefficient threshold, obtain the intrusion device assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, and compare the intrusion device assessment coefficients of the remaining devices with the intrusion device assessment coefficient threshold. If the intrusion device assessment coefficients of the remaining devices are greater than the intrusion device assessment coefficient threshold, a warning signal is generated, indicating that the equipment may have a high risk and needs to be checked immediately by staff to ensure the safety of the equipment. If the intrusion device assessment coefficients of the remaining devices are less than the intrusion device assessment coefficient threshold, no warning signal is generated.

[0045] The present invention combines time delay, data transmission changes and correlation between devices to achieve multi-angle quantitative assessment of equipment risks, provide more comprehensive and accurate security situation awareness, use clustering algorithms to narrow the scope of equipment analysis, and apply FP-Growth algorithm in clusters to efficiently mine frequent item sets, thereby quickly capturing intrusion association patterns between devices and improving detection accuracy. Through comprehensive quantification of equipment risks and correlations, it helps security managers to prioritize monitoring and protection of key equipment, achieve efficient use of resources and precise control of risks. The present invention helps to accurately assess and warn of equipment intrusion risks in industrial Internet of Things environments through multi-dimensional data fusion, cluster analysis and association rule mining.

[0046] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0047] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0048] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0049] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0050] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0051] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0052] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network security risk assessment method based on big data, characterized in that: The specific steps include: S1: Determine the invaded device in the IIoT environment. After the device is invaded, determine the transition probability matrix of the data transmission state of the remaining devices through the historical data of the remaining devices, and determine the time delay information of the remaining devices in combination with the transmission data attributes of the remaining devices; S2: determining the data transmission change information of the remaining devices by comparing the amount of data transmission change information of the remaining devices and the risk level of data transmission of the remaining devices; S3: Comprehensively analyze the time delay information and data transmission change information of the remaining devices, determine the importance of the remaining devices, and obtain the key devices with higher importance among the remaining devices; S4: By collecting characteristic data of devices in the industrial Internet of Things environment, the cluster of the hacked device is determined through cluster analysis, and the FP-Growth algorithm is used to mine frequent item sets in the cluster where the hacked device is located to determine the correlation information of the remaining devices. The correlation information and importance of the remaining devices are combined for analysis, and warnings are issued for the remaining devices with a higher possibility of being hacked.

2. According to the big data-based network security risk assessment method of claim 1, it is characterized in that: Time delay information for other devices, including: The time delay information of the remaining devices is represented by the state transition coefficient; The acquisition logic of the state transfer coefficient is: define the device data transmission state, and divide the device data transmission state into a normal transmission state, a delayed transmission state, and a timeout transmission state; Based on the historical records of device operation, determine the transmission results of different types of device data, obtain the state transition times of device data transmission status in the historical records, and construct the transition probability matrix , by solving , we get the long-term state distribution of device data transmission, and mark the long-term state distribution of device data transmission as: ,in, is the steady-state probability of the normal transmission state, is the steady-state probability of the delayed transmission state, is the steady-state probability of the timeout transmission state; For different types of data transmitted by the device, determine the type of data transmitted by the device within the monitoring interval, determine the impact of time delay on different types of data, and calculate the transmission quality score of different types of data of the device within the monitoring interval. The calculation formula of the transmission quality score is: ;in, Rate the quality of the transmission, is the weight coefficient of different types of data in normal transmission state, is the weight coefficient of different types of data in delayed transmission state, is the weight coefficient of different types of data in the timeout transmission state; Taking each device as a node, the communication relationship graph of the devices in the monitoring interval is determined. According to the topological centrality of the devices in the monitoring interval, the normalized betweenness centrality of the devices is obtained, and the state transfer coefficient is calculated. The calculation formula is: ;in, is the state transfer coefficient, is the betweenness centrality of the device.

3. A network security risk assessment method based on big data according to claim 2, characterized in that: Data transmission change information of other devices, including: The data transmission change information of other devices is represented by the entropy value change coefficient and the data type risk assessment coefficient; The logic for obtaining the entropy value change coefficient is as follows: according to the data type transmitted by the device in the monitoring interval, the probability density distribution of different types of data is determined using kernel density estimation, the information entropy of different types of data in the monitoring interval is calculated based on the probability density distribution of different types of data, and the entropy value change coefficient is calculated according to the weight of different types of data in the industrial Internet of Things environment; The calculation formula for the probability density distribution of different types of data is: ;in, is the probability density function of different data types of the device in the monitoring interval, is the total number of samples of different data types within the monitoring interval, n is the sample index, SJ is the specified value of the data, is the data of different data types of the device in the monitoring interval, h is the bandwidth, The calculation formula of the entropy value change coefficient is: ;in, is the entropy change coefficient, The weights of different types of data in the Industrial Internet of Things environment.

4. A network security risk assessment method based on big data according to claim 3, characterized in that: Data type risk assessment factors, including: The acquisition logic of the data type risk assessment coefficient is: according to the data type generated by the device, determine the abnormal events of different types of data of the device, and based on the abnormal events of different types of data of the device, determine the impact score values ​​of different types of data; According to the data type generated by the device within the monitoring interval, a regression model is constructed by combining the impact score values ​​of different types of data within the monitoring interval and the transmission frequency of different types of data within the monitoring interval to generate a data type risk assessment coefficient; The calculation formula for the data type risk assessment coefficient is: ； in, is the data type risk assessment coefficient, 1, 2, 3, ..., i are the numbers of different types of data, , , ……、 The impact scores for different types of data are , , ……、 is the transmission frequency of different types of data, and e is the base.

5. A network security risk assessment method based on big data according to claim 4, characterized in that: Determine the importance of the remaining equipment, including: The time delay information and data transmission change information of the remaining devices are comprehensively analyzed, and weighted calculation is performed through the state transfer coefficient, entropy value change coefficient and data type risk assessment coefficient to build an equipment importance assessment model and generate the equipment importance assessment coefficient. The calculation formula of the equipment importance assessment coefficient is: ;in, is the equipment importance assessment coefficient, , , are the proportional coefficients of the state transition coefficient, entropy value change coefficient and data type risk assessment coefficient, respectively. , , They are both greater than 0; Set the device importance assessment coefficient threshold, obtain the device importance assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, compare the device importance assessment coefficients of the remaining devices with the device importance assessment coefficient threshold, if the device importance assessment coefficient is greater than the device importance assessment coefficient threshold, mark the device as a critical device, if the device importance assessment coefficient is less than the device importance assessment coefficient threshold, do not mark the device.

6. A network security risk assessment method based on big data according to claim 5, characterized in that: Determine the associated information for the remaining devices, including: The correlation information of the remaining devices is represented by the clustering correlation coefficient; The logic for obtaining the clustering correlation coefficient is as follows: obtaining the operating data of each device in the industrial Internet of Things environment, extracting features of the operating data of each device, including time features, communication features, transmission features and location features, fusing the time features, communication features, transmission features and location features to construct a comprehensive feature vector; The features of different units are normalized, the cosine similarity is used to calculate the similarity between devices, and the t-SNE algorithm is used to reduce the dimension, so that the device data is projected into a low-dimensional space, and the K-Means clustering algorithm is used to perform cluster analysis on the devices; Determine the cluster where the invaded device is located, obtain the other devices in the cluster where the invaded device is located, calculate the distance between the invaded device and the other devices in the cluster by Euclidean distance, and obtain the minimum distance between the other devices and the invaded device; Use the FP-Growth algorithm to mine frequent itemsets in the cluster where the hacked device is located, identify the frequent itemsets of the device, and obtain the support and relevance of the remaining devices in the cluster where the hacked device is located; Calculate the clustering correlation coefficient, the calculation formula is: ;in, is the clustering correlation coefficient, ZC is the support, XG is the correlation, and JL is the minimum distance between the remaining devices and the invaded device. Is a normal number.

7. A network security risk assessment method based on big data according to claim 6, characterized in that: Warnings are issued for other devices that are more likely to be hacked, including: The device importance evaluation coefficient and the cluster correlation coefficient are weighted to generate the intrusion device evaluation coefficient. The calculation formula of the intrusion device evaluation coefficient is: ;in, is the intrusion device assessment coefficient, is the proportional coefficient of the equipment importance assessment coefficient, is the proportional coefficient of the class association coefficient, , They are both greater than 0; An intrusion device assessment coefficient threshold is set to obtain the intrusion device assessment coefficients of the remaining devices in the industrial Internet of Things environment except the invaded device, and the intrusion device assessment coefficients of the remaining devices are compared with the intrusion device assessment coefficient threshold. If the intrusion device assessment coefficients of the remaining devices are greater than the intrusion device assessment coefficient threshold, a warning signal is generated; if the intrusion device assessment coefficients of the remaining devices are less than the intrusion device assessment coefficient threshold, no warning signal is generated.

Images