Industrial control network security situation visualization level evaluation method

Abstract

The invention is applicable to the technical field of industrial control networks, and provides an industrial control network security situation visualization level evaluation method, which comprises the following steps of: network threat modeling and security situation evaluation: collecting data from an industrial control network, constructing a Bayesian attack graph, integrating possible attack paths in the network, and establishing a security situation model; the success possibility and the potential influence of each path are quantified to evaluate and analyze the security condition of the network, and a visual result is output; deep neural network model construction and intrusion detection: carrying out normalization and feature coding on an NSL-KDD data set; combining chi-square test, an auto-encoder and a principal component analysis feature extraction algorithm to construct a feature extraction model, and identifying and extracting features most critical to a classification task; training a deep neural network model; and classifying and testing. According to the invention, the problem that the core data is protected from being tampered, damaged and leaked is effectively solved, and the visual monitoring and protection of the data in the industrial control network are realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control networks, and in particular relates to a method for visualizing the security level of an industrial control network. Background Art

[0002] As the demand for transformation and upgrading of the manufacturing industry becomes increasingly urgent, the development of the industrial Internet, as a key infrastructure supporting the development of industrial intelligence, has attracted much attention. Among them, the "industrial brain" based on the industrial Internet platform aims to solve the core problems of the manufacturing industry, and its core foundation is the "intelligent industrial security brain" that relies on industrial control network security technology. At present, many key infrastructures closely related to national security and production and life, such as electricity, petrochemicals, metallurgy, transportation, and national defense, have been incorporated into the industrial Internet platform system, especially the interconnection between IT and OT in the industrial control network, the logical isolation between the production control area and the non-control area, message filtering, access control, security incident tracing and analysis, etc., make the network structure more and more complex, and traditional network security can no longer meet the current situation. The problem of industrial control network security, as the core problem of the industrial Internet, needs to be solved urgently.

[0003] Traditional Internet protocols have many security vulnerabilities, making industrial data easy to be stolen and tampered with during transmission, resulting in the leakage and loss of important data, with serious consequences. At the same time, critical network infrastructure is often the primary target of hacker attacks. However, the existing industrial control system lacks security monitoring and auditing functions, and cannot effectively protect the attacked data information, nor can it cope with subsequent disguised attacks. How to ensure the security of core data and prevent it from being tampered with, destroyed or leaked has become an important issue facing industrial enterprises. In addition, most of the current network protection measures can only be used to defend when a virus intrusion or attack is detected, and data files cannot be protected in advance. This leads to an increased risk of data theft and leakage. For general enterprises, the cost of additional data protection is too high, and cheap security protection equipment cannot support complex security monitoring functions, thereby increasing the risk of database attacks and data theft. In addition, some companies' Internet detection equipment has the problem of non-visualization of the system and low convenience of operation. Traditional industrial control systems still use traditional text interfaces and digital displays, and information feedback is not intuitive enough. In industrial control systems, a large amount of real-time data needs to be displayed to users accurately and quickly, but low data visualization and complex or unreasonable chart design will result in the inability to obtain key and accurate information. At the same time, the control system lacks sufficient security monitoring means, and cannot fully obtain and display the system security status, nor can it intuitively display security information. In addition, poor compatibility of software and hardware is also a major difficulty in the operation of industrial control safety systems, making it difficult to update and maintain the overall system.

[0004] In view of the above problems, the present invention proposes a method for visualizing the security level of an industrial control network. Summary of the invention

[0005] The purpose of the present invention is to provide a method for visualizing the security level of an industrial control network, aiming to solve the problems raised in the above-mentioned background technology.

[0006] The purpose of the present invention is achieved through the following technical solutions: The method for visualizing the level of industrial control network security situation assessment includes the following steps: 1. Network threat modeling and security situation assessment, including: Step 11: Data collection; Collect data from industrial control networks; Step 12: Construct a Bayesian attack graph and visual level assessment of security situation; Use the collected data to build a Bayesian attack graph. During the construction process, possible attack paths in the network are integrated and the success probability and potential impact of each path are quantified to evaluate and analyze the security status of the network, and finally output visualization results; 2. Deep neural network model construction and intrusion detection, including: Step 21: Data preprocessing; Normalize and feature encode the NSL-KDD dataset; Step 22: Feature extraction; Combining three feature extraction algorithms, namely chi-square test, autoencoder and principal component analysis, a feature extraction model is constructed to identify and extract the most critical features for the classification task; Step 23: Deep neural network model training; The extracted features are input into the deep neural network model for training; during the training process, the model improves the prediction accuracy by continuously optimizing the weights and biases; Step 24: Classification and testing; The trained deep neural network model is used to perform intrusion detection tasks, classify input features, and distinguish normal from abnormal traffic. The trained deep neural network model is tested using an additional NSL-KDD test dataset.

[0007] Furthermore, the specific process of constructing the Bayesian attack graph and the security situation visualization level assessment step is as follows: Determine host risk level: Determine the risk level of each host based on its role in the network and the software installed; categorize the criticality of hosts as undefined, low risk, medium risk, and high risk; Assess the host vulnerability level: Use the Common Vulnerability Scoring System to assign a base score to each host for known vulnerabilities. The Common Vulnerability Scoring System is defined as follows: ; in, Vulnerability assessment scores for the Common Vulnerability Scoring System; is the kth host of the system, ; For loopholes The Common Vulnerability Scoring System's key base scores; ; in, For loopholes The base score of the Common Vulnerability Scoring System, ; The base score range is [0,10], where [7,10] is defined as critical, meaning the vulnerability has a critical risk; Calculate the attack probability: Based on Bayesian theory, the probability value of the initial attack starting point is set to "1" for each attack step; for other nodes, the transition probability is determined according to the access complexity of the corresponding vulnerability, and the success and failure of the previous node are considered to calculate the local probability distribution; finally, the joint probability distribution is used to determine the unconditional probability of each state, that is, for the state set , ,in For all The paternal set of is the joint probability, Vulnerability dataset i Points, is the vulnerability status set; Assessing the attack impact level: by vector ) to determine the host attack impact, where Defined as confidentiality impact, Defined as integrity impact, Defined as availability impact.

[0008] Furthermore, in the data preprocessing step, all eigenvalues ​​of the NSL-KDD data set are normalized using the standard deviation formula, which is as follows: ; in, is the standard deviation, is the i-th point in the NSL-KDD dataset, is the mean of the NSL-KDD dataset, and n is the total data points in the NSL-KDD dataset.

[0009] Furthermore, in the feature extraction step, the mathematical representation of the chi-square test is as follows: Degrees of Freedom: ; Theoretical frequency: ; ; in, represents the degree of freedom; r represents the total number of attributes; c represents the total number of categories; and represent the actual value and the predicted value respectively; Represents the totals of rows x and y respectively; The autoencoder consists of an encoder and a decoder. The encoder extracts features from the NSL-KDD dataset, and the decoder reconstructs the extracted features. During the training process, the ReLU activation function, Adam optimizer, and binary cross entropy loss function are used to compile the autoencoder model. By minimizing the loss function, the model learns effective feature representation. Coding process: ; Decoding process: ; in, Represents input layer data; Represents the output layer data; represents the mapping function of the encoder; represents the mapping function of the decoder; The loss function is defined as the reconstruction error, including the mean square error: ; Where k represents the dimension of the input data; represents mean square error; A singular value decomposition solver was used to perform principal component analysis and explore different dimensions to determine the effect of varying the input dimensionality and find the optimal number of extracted features; Singular Value Decomposition: ; Covariance matrix: ; Eigenvectors: ; in, represents singular value decomposition; and V denote orthogonal matrices; represents a diagonal matrix; represents the covariance matrix; represents the eigenvalue; represents the rank of a real symmetric array; Represents the mean of the NSL-KDD dataset.

[0010] Furthermore, in the deep neural network model training step, the deep neural network model consists of an input layer, a hidden layer and an output layer, and each hidden layer uses ReLU as an activation function; the training process is as follows: The extracted features are first fed forward through the input layer; before training begins, the model's weights are randomly initialized; during training, the model uses the Adam algorithm to optimize weights and biases to improve the model's output and achieve predictive classification.

[0011] Compared with the prior art, the present invention has the following beneficial effects: The present invention not only comprehensively integrates and quantifies potential attack paths in the network, their success probabilities and potential hazards, maximizes the value of data utilization, but also displays the dynamic status and trends of industrial control security in real time by using the visualization method of Bayesian attack graphs. This method greatly enhances the ability to discover attacks and perceive intrusion data, allowing managers and staff to quickly and accurately grasp the security situation and make more informed security decisions and management. Furthermore, the present invention introduces deep neural network models into intrusion detection, which complements network threat modeling technology. When the deep neural network model successfully marks a potential attack, the network threat modeling technology can provide additional contextual information in real time and deeply analyze why a particular path may be more vulnerable to attack. This innovative combination not only significantly improves the quality and credibility of alarms, but also greatly enhances the ability to predict and prevent unknown threats, laying a solid foundation for building a more intelligent and efficient security protection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 The figure is a flow chart of the method of the present invention.

[0013] Figure 2 This is a structural diagram for outputting visualization results.

[0014] Figure 3 It is a feature extraction model.

[0015] Figure 4 It is the DNN model architecture.

[0016] Figure 5 The performance of different models in terms of accuracy.

[0017] Figure 6 The performance of different models in terms of multi-class detection accuracy with different features. DETAILED DESCRIPTION

[0018] In order to have a clearer understanding of the technical features, purposes and beneficial effects of the present invention, the technical solution of the present invention is now described in detail below, but it should not be construed as limiting the applicable scope of the present invention.

[0019] The specific implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0020] An embodiment of the present invention provides a method for visualizing the level of industrial control network security situation assessment, the flow chart of which is as follows: Figure 1 As shown, the method comprises the following steps: 1. Network threat modeling and security situation assessment, including: Step 11: Data collection; Collect data from industrial control networks for subsequent analysis and processing.

[0021] Step 12: Construct a Bayesian attack graph and visual level assessment of security situation; Using the collected data, we construct a Bayesian attack graph. During the construction process, we not only integrate the possible attack paths in the network, but also quantify the success probability of each path and its potential impact, so that we can evaluate and analyze the security status of the network. Specifically, we achieve this goal through the following steps: 1) Determine the host danger level: The host danger level reflects the impact of host leakage on the normal operation of the network in the event of a successful attack. It is mainly determined by the role of the host in the network (such as router, firewall, mail, web, database server, etc.) and the installed software. The critical level of the host is a nominal parameter with values ​​of {undefined, low danger, medium danger, high danger}.

[0022] 2) Evaluate the host vulnerability level: The host vulnerability level describes the severity of the vulnerability detected on the host. The Common Vulnerability Scoring System is defined as follows: ; in, Vulnerability assessment scores for the Common Vulnerability Scoring System; is the kth host of the system, ; For loopholes The Common Vulnerability Scoring System's key base scores; ; in, For loopholes The base score of the Common Vulnerability Scoring System, ; According to the Common Vulnerability Scoring System, the base score is defined as the [0,10] interval, and the interval [7,10] is defined as critical.

[0023] 3) Calculation of attack probability: The attack probability reflects the probability of a successful attack. There are different static and dynamic methods to calculate this metric. A technique based on the Bayesian attack graph to calculate the probability of exploitation is used. In this case, the attack probability value varies between 0 and 1 and is specified as follows: (1) Consider the preconditions and postconditions of each state and define them as attack graph nodes; (2) Based on Bayesian theory, the probability value of the initial attack starting point is set to "1" for each attack step (as a node in the attack graph), that is, it is assumed that the attacker will always try to launch an attack.

[0024] (3) The probability of transferring from one node to another is determined by the access complexity of the corresponding vulnerability (if there are few vulnerabilities leading to this state, the probability is determined by the minimum access complexity); (4) For each node, the local probability distribution is calculated by the probability of successful transmission from the previous node in both success and failure situations. On this basis, the unconditional probability of the calculated state is defined by the joint probability distribution, that is, for the state set , ,in For all The paternal set of is the joint probability, Vulnerability dataset i Points, is the vulnerability status set; 4) Evaluate the attack impact level: The attack impact level describes the possible impact of an attack on a given host's danger level. ) to determine the host attack impact, where Defined as confidentiality impact, Defined as integrity impact, Defined as availability impact. By combining the host's vulnerability information and its danger level, we can fully understand the damage that may be caused if the attack is successful.

[0025] Final output visualization results: Based on situation perception, the present invention realizes multi-angle, multi-dimensional and multi-level visualization of industrial control network operation. It intuitively displays direct security data, security-related data, security analysis results and security situation, and presents security data, information and processes in the form of graphics, images or animations, so that managers and staff can quickly and accurately understand the real-time status and trends of industrial control security, discover hidden dangers, and optimize security decision-making and management.

[0026] Specifically, the visualization results include the following four parts: Security direct data is the data directly collected in the industrial control network that is converted into a graphic structure through visualization technology; security associated data is the analysis of the mutual correlation between data, the collection of organizational data through corpus technology and then the visualization; the security analysis results are the display of security levels and related parameters in the form of a large screen, thereby providing support for security strategies; the security situation is the real-time transmission of the accurately perceived security situation to the result processing, comprehensively considering the visualization needs of various types of data.

[0027] like Figure 2 As shown, the visualization process includes: Data acquisition: Obtain data from the above four parts to provide a basis for subsequent processing; View selection: Select the appropriate view according to your needs to ensure that the data is presented intuitively.

[0028] Dynamic interaction: Provides interactive functions such as click and drag, allowing users to explore data details in depth.

[0029] Large screen display: Comprehensively display the processed and analyzed data, so that managers and staff can understand the safety status at a glance.

[0030] In addition, the present invention supports multi-dimensional security data analysis, such as time, device type, attack type, etc., to help users fully understand the security status of the industrial control system and discover potential risks.

[0031] 2. Deep neural network model construction and intrusion detection, including: Step 21: Data preprocessing; The NSL-KDD dataset is normalized and feature encoded to optimize the information collection and processing process. Since there is often a significant difference between the maximum and minimum values ​​in the dataset, normalization can reduce the complexity of the algorithm.

[0032] 1) NSL-KDD dataset; Each record in the NSL-KDD dataset contains 43 features, of which 41 features refer to the traffic input itself, and the last two features are the label (normal or attack) and the score (the severity of the traffic input itself). The NSL-KDD dataset contains four different types of attacks: Denial of Service (DoS), Probe, User to Root (U2R), and Remote to Local (R2L). The data distribution of each attack type is shown in Table 1.

[0033] Table 1 NSL-KDD quantity records

[0034] 2) Data standardization; Since the differences between eigenvalues ​​make the features more diverse and contrasting, the data needs to be normalized. The purpose of normalization is to scale all eigenvalues ​​to the same range. The standard deviation formula is used to normalize all eigenvalues ​​of the NSL-KDD dataset. The formula is as follows: ; in, is the standard deviation, is the i-th point in the NSL-KDD dataset, is the mean of the NSL-KDD dataset, and n is the total data points in the NSL-KDD dataset.

[0035] Step 22: Feature extraction; In the feature extraction stage, we combined three feature extraction algorithms: chi-square test, autoencoder and principal component analysis to build an efficient and accurate feature extraction model. The filter-based feature extraction technique sorts the features most relevant to the classification task and uses them for classification. The model prioritizes the most important features that have a greater impact on the output class. The results of these three techniques are combined into a cross subset with multiple thresholds. In the final subset, any repeated feature in the cross subset is used to output the optimal feature subset to improve classification accuracy. Figure 3 The feature extraction model proposed and used in the present invention is demonstrated.

[0036] 1) Chi-square test: The chi-square test is a statistical test used to examine the differences between categorical variables in a random sample to judge the goodness of fit between expected and observed results. It measures the difference between the observed and expected frequencies of the results of a set of events or variables. The size of depends on the size of the difference between the actual value and the observed value, the degrees of freedom, and the sample size. It can be used to test whether two variables are related or independent, and it can also be used to test the goodness of fit between the observed frequency distribution and the theoretical distribution. The mathematical representation of the chi-square test is as follows: Degrees of Freedom: ; Theoretical frequency: ; ; in, represents degrees of freedom, which refers to the number of variables whose values ​​are not restricted when calculating a certain statistic; r represents the total number of attributes; c represents the total number of categories; and represent the actual value and the predicted value respectively; Represents the totals of x and y rows respectively; chi-square value The higher it is, the more important the feature is to the prediction model.

[0037] 2) Autoencoder: An autoencoder is an artificial neural network used in semi-supervised and unsupervised learning to learn and reconstruct feature representations. It consists of two parts: an encoder and a decoder. The encoder extracts a certain number of features from the NSL-KDD dataset, and the decoder reconstructs these features. When the number of neuron nodes in the hidden layer is less than the number of input nodes, the autoencoder will learn a compressed representation of the input data. In this model, 41 features from the NSL-KDD dataset are converged to a set of 20 features. The 20-dimensional output of the hidden layer 1 of the autoencoder is a compressed version of the input. The next autoencoder is trained using these generated feature sets extracted from the training data. To extract features from the training dataset, we first train the autoencoder in an unsupervised manner and then extract features from the trained autoencoder. The feature extraction process continues to the next layer. After training the first autoencoder, the training of the second autoencoder is completed. The number of nodes in the encoder block decreases in the order of 20, 10, and the decoder block increases in the opposite order. The number of nodes in the intermediate layer is set to the required number of output dimensions. During training, the autoencoder model is compiled using the Relu activation function, the Adam optimizer, and the binary cross entropy loss function. The Adam optimizer is used to update the model’s weights to minimize the loss function, which measures the difference between the model’s output and the original input.

[0038] Coding process: ; Decoding process: ; in, Represents input layer data; Represents the output layer data; represents the mapping function of the encoder; represents the mapping function of the decoder, which is usually a parameterized neural network.

[0039] The loss function is usually defined as the reconstruction error, such as the mean square error: ; Where k represents the dimension of the input data; represents mean square error; 3) Principal Component Analysis: PCA is an unsupervised linear transformation algorithm that extracts features based on a statistical process. By extracting the eigenvector with the highest eigenvalue in the covariance matrix, linear algebra is used to project the dataset into a low-dimensional space with a specified number of dimensions (features), maintaining its basic properties and useful features. These extracted features are an uncorrelated set called principal components. PCA is sensitive to outliers and missing values, but aims to reduce the dimensionality without losing too much important or valuable information. We use a singular value decomposition (SVD) solver to perform PCA and explore different dimensions to determine the effect of changing the input dimension and find the optimal number of extracted features.

[0040] Singular Value Decomposition: ; Covariance matrix: ; Eigenvectors: ; in, represents singular value decomposition; and V denote orthogonal matrices; represents a diagonal matrix; represents the covariance matrix; represents the eigenvalue; represents the rank of a real symmetric array; Represents the mean of the NSL-KDD dataset.

[0041] Step 3: Deep neural network (DNN) model training; Deep neural networks are widely used in intrusion and anomaly-based applications. The DNN model is divided into an input layer, a hidden layer, and an output layer. The extracted features are first feed-forwarded through the input layer, and then during the training process, the model improves the output by optimizing parameters to achieve predictive classification. The hidden layer structure of the DNN model is complex and contains multiple levels, which makes the model show higher accuracy and flexibility when processing large data sets. Each layer consists of several nodes that map the high-level features of the input to the desired output through weighted connections. Before the training begins, the weights of the model are randomly initialized. Subsequently, during the learning phase, the weights are optimized using the backpropagation algorithm to minimize the binary cross entropy loss function. Specifically, the DNN model contains 3 hidden layers, each of which uses a rectified linear unit (ReLU) as the activation function. In addition, the model uses the Adam algorithm to optimize the weights and biases. The architecture of the DNN is as follows Figure 4 As shown, it intuitively shows the hierarchical structure of the model and how the nodes are connected.

[0042] Step 24: Classification and testing; The trained DNN model is used for intrusion detection tasks, classifying the input features and distinguishing between normal (Normal) and abnormal (Dos, Probe, U2R and R2L). The model can detect various attacks in the NSL-KDD dataset. In order to evaluate the performance of the model, we use the additional NSL-KDD test dataset to test the trained DNN model. Through this testing process, we can measure and derive the accuracy of the model in attack detection.

[0043] Example 1: Performance verification of the model of the present invention; The performance of the model was evaluated on the training and test datasets of NSL-KDD. The key indicators used for evaluation include: true positive rate (TP, the number of samples correctly classified as attacks), false positive rate (FP, the number of benign samples incorrectly classified as attacks), true negative rate (TN, the number of samples correctly classified as benign), and false negative rate (FN, the number of attack samples incorrectly classified as benign). Based on these basic data, we further calculated the following performance indicators: Recall: ; False Alarm Rate: ; Precision: ; Accuracy: ; Test accuracy metric (F1 score): , defined as the balance between the harmonic mean of precision and recall.

[0044] The area under the receiver operating characteristic curve (AUC) represents the trade-off between recall (R) and false alarm rate (FAR): , where t represents the threshold and n represents the total number of points in the data set; the closer the AUC value is to 1, the stronger the model's ability to distinguish is.

[0045] It should be noted that a model can achieve a high accuracy or F1 value by predicting only the main categories or having a high recall and error rate at the same time, but this may not be the ideal performance. Therefore, a single indicator cannot fully reflect the true performance of the model. In order to more comprehensively evaluate the performance of different models, we use AUC as a comparison indicator, analyze the optimal feature dimension selection method of DNN models and feature extraction (FE) algorithms, and perform statistical tests on each attack type.

[0046] Result analysis: We implemented an intrusion detection system (IDS) based on a DNN model to classify multiple types of attacks, dividing the input data into normal attack classes and four attack categories: DoS, Probe, U2R, and R2L. During the evaluation process, we not only considered all 41 original features, but also used other feature sets in the prior art to demonstrate the superiority of the proposed model in hybrid feature extraction. To this end, three classification models based on different feature extraction techniques were constructed: PCA-DNN, AE-DNN, and Chi-DNN, which used PCA (Principal Component Analysis), Autoencoder (AE), and Chi-square feature extraction for feature extraction, respectively. Table 2 shows the accuracy, precision, recall, and F1 score comparison of different feature extraction techniques on four attack categories. The overall performance comparison of different models is shown in Table 3.

[0047] Table 2 Comparison of accuracy, precision, recall and F1 score of different feature extraction techniques

[0048] It can be seen from the data in Table 2 that the accuracy of the model of the present invention is improved compared with PCA-DNN, AE-DNN and CHI2-DNN under the four types of attacks.

[0049] Table 3 Overall performance comparison of different models

[0050] From the data in Table 3, it can be seen that the model of the present invention has advantages over the comparison model in terms of accuracy, precision, recall rate and F1 score. In particular, compared with other models, the accuracy of the model of the present invention is the highest, which is 97.54%.

[0051] Figure 5 and Figure 6 The evaluation results of the model of the present invention and the existing deep learning and machine learning models are shown respectively. It can be seen that the model of the present invention has improved accuracy, precision, recall rate and F1 score compared with other models.

[0052] The above are only preferred embodiments of the present invention. It should be pointed out that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention. These should also be regarded as the protection scope of the present invention. These will not affect the effect of the implementation of the present invention and the practicality of the patent.

Claims

1. A method for visualizing the level of security assessment of industrial control networks, characterized in that: The following steps are involved:

1. Network threat modeling and security situation assessment, including: Step 11: Data collection; Collect data from industrial control networks; Step 12: Construct a Bayesian attack graph and visual level assessment of security situation; Use the collected data to build a Bayesian attack graph. During the construction process, possible attack paths in the network are integrated and the success probability and potential impact of each path are quantified to evaluate and analyze the security status of the network, and finally output visualization results; 2. Deep neural network model construction and intrusion detection, including: Step 21: Data preprocessing; Normalize and feature encode the NSL-KDD dataset; Step 22: Feature extraction; Combining three feature extraction algorithms, namely chi-square test, autoencoder and principal component analysis, a feature extraction model is constructed to identify and extract the most critical features for the classification task; Step 23: Deep neural network model training; The extracted features are input into the deep neural network model for training; during the training process, the model improves the prediction accuracy by continuously optimizing the weights and biases; Step 24: Classification and testing; The trained deep neural network model is used to perform intrusion detection tasks, classify input features, and distinguish normal from abnormal traffic. The trained deep neural network model is tested using an additional NSL-KDD test dataset.

2. The method for visualizing the level of security assessment of industrial control network according to claim 1 is characterized in that: The specific process of constructing the Bayesian attack graph and the security situation visualization level assessment step is as follows: Determine host risk level: Determine the risk level of each host based on its role in the network and the software installed; categorize the criticality of hosts as undefined, low risk, medium risk, and high risk; Assess the host vulnerability level: Use the Common Vulnerability Scoring System to assign a base score to each host for known vulnerabilities. The Common Vulnerability Scoring System is defined as follows: ； in, Vulnerability assessment scores for the Common Vulnerability Scoring System; is the kth host of the system, ; For loopholes The Common Vulnerability Scoring System's key base scores; ； in, For loopholes The base score of the Common Vulnerability Scoring System, ; The base score range is [0,10], where [7,10] is defined as critical, meaning the vulnerability has a critical risk; Calculate the attack probability: Based on Bayesian theory, set the probability value of the initial attack starting point to "1" for each attack step; for other nodes, determine the transition probability based on the access complexity of the corresponding vulnerability, and consider the success and failure of the previous node to calculate the local probability distribution; finally, use the joint probability distribution to determine the unconditional probability of each state, that is, for the state set , ,in For all The paternal set of is the joint probability, Vulnerability dataset i Points, is the vulnerability status set; Assessing the attack impact level: by vector ) to determine the host attack impact, where Defined as confidentiality impact, Defined as integrity impact, Defined as availability impact.

3. The method for visualizing the level of security assessment of industrial control network according to claim 1 is characterized in that: In the data preprocessing step, all eigenvalues ​​of the NSL-KDD data set are normalized using the standard deviation formula, which is as follows: ； in, is the standard deviation, is the i-th point in the NSL-KDD dataset, is the mean of the NSL-KDD dataset, and n is the total data points in the NSL-KDD dataset.

4. The method for visualizing the level of security assessment of industrial control network according to claim 1, characterized in that: In the feature extraction step, the mathematical representation of the chi-square test is as follows: Degrees of Freedom: ; Theoretical frequency: ; ； in, represents the degree of freedom; r represents the total number of attributes; c represents the total number of categories; and represent the actual value and the predicted value respectively; Represents the totals of rows x and y respectively; The autoencoder consists of an encoder and a decoder. The encoder extracts features from the NSL-KDD dataset, and the decoder reconstructs the extracted features. During the training process, the ReLU activation function, Adam optimizer, and binary cross entropy loss function are used to compile the autoencoder model. By minimizing the loss function, the model learns effective feature representation. Coding process: ; Decoding process: ; in, Represents input layer data; Represents the output layer data; represents the mapping function of the encoder; represents the mapping function of the decoder; The loss function is defined as the reconstruction error, including the mean square error: ； Where k represents the dimension of the input data; represents mean square error; A singular value decomposition solver was used to perform principal component analysis and explore different dimensions to determine the effect of varying the input dimensionality and find the optimal number of extracted features; Singular Value Decomposition: ; Covariance matrix: ; Eigenvectors: ; in, represents singular value decomposition; and V denote orthogonal matrices; represents a diagonal matrix; represents the covariance matrix; represents the eigenvalue; represents the rank of a real symmetric array; Represents the mean of the NSL-KDD dataset.

5. The method for visualizing the level of security assessment of industrial control network according to claim 1, characterized in that: In the deep neural network model training step, the deep neural network model consists of an input layer, a hidden layer and an output layer, and each hidden layer uses ReLU as an activation function; the training process is as follows: The extracted features are first fed forward through the input layer; before training begins, the model's weights are randomly initialized; during training, the model uses the Adam algorithm to optimize weights and biases to improve the model's output and achieve predictive classification.

Images