Threat analysis and reduction method based on industrial field environment

Abstract

The invention relates to the technical field of threat analysis, in particular to a threat analysis and reduction method based on an industrial field environment, and the method comprises the following steps: S1, detecting asset equipment in a whole network range to obtain asset equipment information, and obtaining vulnerability scanning data according to the asset equipment information; s2, the AI model determines a network asset attack priority according to the asset equipment information, obtains asset risk data according to the network asset attack priority, and carries out threat analysis through a red team perspective to obtain threat attack coverage data; and S3, establishing a threat model according to the asset risk data and the threat attack coverage data, and outputting a security solution according to the threat model. By detecting the asset equipment and performing vulnerability scanning, the method has the advantages of accurate data and wide data source; through AI model analysis, the analysis surface and the analysis depth of related attacks are greatly enriched; and establishing a threat model and outputting a security solution to prevent omission of security reinforcement points due to incomplete consideration.

Description

Technical Field

[0001] The present invention relates to the field of threat analysis technology, and in particular to a method, system, device and storage medium for threat analysis and mitigation based on an industrial field environment. Background Art

[0002] With the development of the Internet, the network security strength of industrial sites has received attention. In order to reduce external security threats, the existing industrial sites are complex and intricate, so threat analysis was born.

[0003] In the application number 201911179720.8, titled "Threat Analysis Method, Device and Threat Analysis System", S01: Set the initial value and maximum value of the number of iterations to obtain the threat analysis requirements; S02: Obtain the information collection summary required for threat analysis; S03: Analyze the threat analysis requirements according to the information collection summary to obtain the threat analysis results; S04: Determine whether the threat analysis results meet the deep analysis evaluation conditions; if yes, end; if not, execute S02, and execute S05: Analyze the threat analysis requirements again according to the latest information collection summary and the last threat analysis results to obtain the current threat analysis results; at the same time, add 1 to the current number of iterations; then execute S04 until the number of iterations equals the maximum value. However, the disadvantage of this method is that it does not specify in detail what method is used for threat analysis, and it is impossible to show in detail and macroscopically what threats are being received. The technical point of this patent is mainly to reduce the false alarm rate through calculation and improve the demand for threat analysis. It is not suitable for industrial sites with a large number of complex network devices.

[0004] In the application number 202111619198.8 and the name of "Threat Analysis Method, Device, Electronic Device and Storage Medium", the primary clue sending module receives the preset threat analysis clues and sends the preset threat analysis clues to the threat analysis module; the threat analysis module performs a preliminary threat analysis based on the preset threat analysis clues and the acquired first analysis data, obtains a first analysis result and feeds it back to the secondary clue sending module; the secondary clue sending module performs a secondary analysis operation on the first analysis result to obtain a second analysis result, and when it represents that a new clue is detected, the new clue is sent to the threat analysis module, so that the threat analysis module obtains the corresponding second analysis data based on the new clue, performs a preliminary threat analysis based on the second analysis data, and obtains an analysis result; the analysis result feedback module feeds back the threat target based on the target analysis result. However, the disadvantage of this method is that it can only form an effective network device topology in a complex industrial site with a large number of network devices to more intuitively feel what kind of network security threats are currently being faced. It is not comprehensive only through relevant scans, because the scan cannot fully identify all network security issues, so it can support the accuracy of relevant network security threat analysis greatly enhanced by relevant penetration test results, and this design cannot provide effective mitigation methods for the threats faced. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and provide a method for threat analysis and mitigation based on an industrial field environment, comprising the following steps: S1: Detect all asset devices in the network range to obtain asset device information, and obtain vulnerability scanning data based on the asset device information; S2: The AI ​​model determines the network asset attack priority based on the asset device information, obtains asset risk data based on the network asset attack priority, and performs threat analysis from a red team perspective to obtain threat attack coverage data; S3: Establish a threat model according to the asset risk data and the threat attack coverage data, and output a security solution according to the threat model.

[0006] Preferably, in step S1, detecting all asset devices in the network range to obtain asset device information further includes: S11: The triggering device broadcasts to all asset devices within the network range; S12: The asset device responds to the activation payload sent by the broadcast, and the scanner detects the asset device and records it to obtain the asset device information; S13: Perform vulnerability scanning according to the asset device information to obtain the vulnerability scanning data.

[0007] Preferably, in step S13, performing vulnerability scanning according to the asset device information to obtain the vulnerability scanning data further includes: According to the asset equipment information, use the attack payload detection library to perform vulnerability scanning and observe whether it is an attack vector, and determine whether there is a vulnerability based on the response to obtain the vulnerability scanning data; The attack vectors include attack payload, verification program PoC, and attack factors including support for Trojan detection in uploaded files, attack payload case difference detection, and keyword precise retrieval.

[0008] Preferably, in step S2, the AI ​​model determines the network asset attack priority according to the asset device information, and obtains asset risk data according to the network asset attack priority, further comprising: S21: The AI ​​model lists and sorts the asset device information according to attack priority and attack necessity to determine the attack priority of the network asset; S22: determining the relative position of the asset device according to the response time of the scanner, and drawing a network topology map according to the position information; S23: Obtaining the asset risk data according to the network asset attack priority, the vulnerability scanning data and the imported security data.

[0009] Preferably, in step S2, threat analysis is performed from a red team perspective to obtain threat attack coverage data, further comprising: Analyze the vulnerability exploitation method, difficulty, and whether a combined attack can be implemented in combination with the network environment from the red team perspective of the AI ​​model to obtain the first attack coverage data; The AI ​​model obtains second attack coverage data based on the security data through tactical methods including red team attack and bypass, and whether the protection equipment can effectively protect the existing tactics or tactics derived from machine learning; Fill the vulnerability into the network topology map according to the first attack coverage data and the second attack coverage data to obtain the threat attack coverage data.

[0010] Preferably, according to the asset risk data and the threat attack coverage data threat model, the method further comprises: The asset risk data and the threat attack coverage data are combined, and then a spatial rectangular coordinate system is drawn with time as the baseline to establish the threat model.

[0011] Preferably, in step S3, outputting a security solution according to the threat model further comprises: The AI ​​model outputs the blue team's security protection strategy for how to reduce the numerous attack threats faced by industrial sites from the blue team's perspective, and the strategy module outputs security solutions based on the causes of the threats.

[0012] Based on the same concept, the present invention also provides a system for threat analysis and mitigation in an industrial field environment, comprising: A preparation module is used to detect asset devices in the entire network range to obtain asset device information, and obtain vulnerability scanning data based on the asset device information; An AI module, for an AI model to determine the network asset attack priority according to the asset device information, obtain asset risk data according to the network asset attack priority, and obtain threat attack coverage data by performing threat analysis from a red team perspective; A modeling module is used to establish a threat model based on the asset risk data and the threat attack coverage data, and output a security solution based on the threat model.

[0013] Based on the same concept, the present invention also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for threat analysis and mitigation in an industrial field environment as described in any one of the embodiments.

[0014] Based on the same concept, the present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method for threat analysis and mitigation based on an industrial field environment as described in any one of the embodiments.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention obtains asset equipment information by detecting asset equipment in the entire network range, and obtains vulnerability scanning data based on the asset equipment information, thereby preventing insufficient data samples for analyzing threats due to incomplete device detection, which leads to deviations in analysis results.

[0016] The present invention determines the attack priority of network assets according to the asset equipment information through the AI ​​model, obtains the asset risk data according to the attack priority of network assets, and obtains the threat attack coverage data through threat analysis from the perspective of the red team, thereby realizing analysis through AI, which greatly enriches the analysis surface and depth of related attack analysis; The present invention establishes a threat model through asset risk data and threat attack coverage data, and outputs a security solution based on the threat model to prevent the omission of security reinforcement points caused by incomplete consideration by security personnel. Because the data volume of modeling and related detection is comprehensive, the relevant security strategy can achieve the effect of in-depth defense. In addition, through modeling, it is possible to effectively observe and analyze whether the impact of existing network security threats will increase over time, and through the relevant threat analysis results, it is possible to effectively infer which attack threats are more likely to be encountered in the future. At the same time, the threat impact can also show which network security threats are based on the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.

[0018] Figure 1 A flowchart of a method for threat analysis and mitigation based on an industrial field environment according to the present invention; Figure 2 The present invention is a structural diagram of a system for threat analysis and mitigation based on an industrial field environment. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0020] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0021] In order to strengthen the network security strength of the industrial site and reduce external security threats, this embodiment first thoroughly detects all networked devices in the industrial site to form a detailed topology map, performs vulnerability scanning and simulates attack-type security analysis on all deployed software and hardware, and imports security data such as threat analysis data, penetration test results, and vulnerability scanning reports output by the entire device into the data processing and analysis system. The AI ​​analysis module classifies the assets on site and conducts risk analysis based on their importance and related security data, analyzing the attacks that may be suffered and the network attack threats faced. Then, the AI ​​modeling module conducts threat modeling on the entire network security threat analysis of the factory and outputs a macro threat risk situation. The discovered threat risks are targetedly output through the AI ​​strategy module to fit the factory's security strategy and generate vulnerability rectification suggestions for related security vulnerabilities, including whether to install related security equipment on related nodes and network topology. Overall security suggestions. A closed-loop process of detection-discovery-modeling-rectification is achieved to reduce the threat of network security attacks.

[0022] See also Figure 1 As shown, this embodiment provides a method for threat analysis and mitigation based on an industrial field environment, comprising the following steps: S1: Detect all asset devices in the network range to obtain asset device information, and obtain vulnerability scanning data based on the asset device information.

[0023] Preferably, in step S1, detecting all asset devices in the network range to obtain asset device information further includes: S11: The triggering device broadcasts to all asset devices within the network range; S12: The asset device responds to the activation payload sent by the broadcast, and the scanner detects the asset device and records it to obtain the asset device information. Specifically, in this embodiment, the broadcast sends the activation payload to make the devices in the network area actively respond. The scanner including mainstream network scanning, arp scanning, host detection principles such as arp-scan, Nmap, Netdiscover, etc. is used to detect all surviving network devices in the factory area, and all asset devices are recorded to complete detailed asset device detection; S13: Perform vulnerability scanning according to the asset device information to obtain vulnerability scanning data.

[0024] Conventional threat analysis devices can only analyze network security threats suffered by a certain product or server. This embodiment can not only accurately detect network assets in the entire network segment, but also output the on-site network topology. The network detection carried by the device sends activation payloads to each network device asset through different protocol classifications. This payload can make the network asset active and actively respond to the detection data (for example, some devices will give priority to replying to error messages related to error.xml, etc., and the device in the exception processing will restart the entire message receiving queue (middleware) to make the entire queue in working state, and it is also convenient to trigger some inactive hosts and devices). Then, the module-integrated arp, nmap, masscan and other scanners based on TCP\IP, UDP and other protocol scanning principles can conduct a second targeted scan to detect the live / inactive network devices in the entire factory in detail, so as to prevent the lack of data samples for analyzing threats due to the incomplete detection of equipment, resulting in deviations in the analysis results.

[0025] Preferably, in step S13, performing vulnerability scanning according to the asset device information to obtain vulnerability scanning data further includes: Based on the asset equipment information, use the attack payload detection library to perform vulnerability scanning and observe whether it is an attack vector. Based on the response, determine whether there is a vulnerability to obtain vulnerability scanning data. Among them, the attack vector includes the attack payload, the verification program PoC, and attack factors including supporting Trojan detection in uploaded files, attack payload case difference detection, and precise keyword retrieval. Specifically, in this embodiment, vulnerability scanning is performed through the payload detection library, and the attack vector can be understood as the payload (attack payload) and PoC (Proof of Concept verification program) used in penetration testing. Therefore, the payload detection library will integrate the payload and poc libraries (which can be updated in real time) of most current vulnerability scanning software, support Trojan detection in uploaded files, payload case difference detection, and precise keyword retrieval, and cover as many payloads and pocs as possible to improve the detection accuracy and reduce the false alarm rate. The security vulnerabilities of network asset devices can be discovered as much as possible through the payload detection library.

[0026] In this embodiment, the payload detection library is composed of the payload detection library used in various penetration tests and vulnerability scanning software, the payload set of WASP top ten common vulnerability bypass forms, and the payload set used by attackers. It also supports filter symbol retrieval and fuzzy retrieval. The detection library formed in this way has a wide detection range, comprehensive detection, and low false alarm rate.

[0027] S2: The AI ​​model determines the priority of network asset attacks based on the asset equipment information, obtains asset risk data based on the network asset attack priority, and obtains threat attack coverage data through threat analysis from the red team perspective. Specifically, in this embodiment, the AI ​​machine learns and accumulates the red team's attack ideas, and conducts the entire analysis work from the attacker's perspective. The device that appears multiple times in the attacker's common attack ideas is TOP ONE.

[0028] Preferably, in step S2, the AI ​​model determines the network asset attack priority according to the asset device information, and obtains the asset risk data according to the network asset attack priority, further comprising: S21: The AI ​​model lists and ranks asset equipment information according to attack priority and attack necessity to determine the attack priority of network assets; S22: Determine the relative position of the asset device according to the response time of the scanner, and draw a network topology map according to the position information; S23: Obtain asset risk data based on network asset attack priorities, vulnerability scanning data, and imported security data. Specifically, in this embodiment, the security data includes penetration test results and information on currently connected security devices in the factory, making the data source of the analysis module in the AI ​​module more diverse and rich, and broadening the dimension of threat analysis.

[0029] Preferably, in step S2, threat analysis is performed from a red team perspective to obtain threat attack coverage data, further comprising: The first attack coverage data is obtained by analyzing the vulnerability exploitation method, difficulty, and whether a combined attack can be implemented in combination with the network environment from the red team perspective of the AI ​​model. Specifically, in this embodiment, the vulnerability exploitation method analyzes the impact of the vulnerability on system security, including possible consequences such as data leakage and service interruption; the vulnerability exploitation difficulty analyzes the difficulty of attackers to exploit the vulnerability, including technical difficulty and required conditions; whether a combined attack can be implemented in combination with the network environment to evaluate the scope of possible impact of the vulnerability, including a single system, multiple systems in the network, etc., and can also analyze the workload and time required to repair the vulnerability; The AI ​​model obtains the second attack coverage data based on security data through tactical methods including red team attack and bypass, as well as whether the protection equipment can effectively protect the existing tactics or tactics derived from machine learning; According to the first attack coverage data and the second attack coverage data, the vulnerabilities are filled into the network topology map to obtain the threat attack coverage data. Specifically, in this embodiment, through the types of analysis above, the tactical types that are most vulnerable to threat attacks in industrial sites are summarized, which devices (hardware, middleware, web services) have the highest vulnerability ratio, and which vulnerabilities are most affected. The vulnerabilities belonging to each device will be filled into the topology map to clarify the important network attack risks currently faced by the factory.

[0030] Preferably, based on the asset risk data and the threat attack coverage data threat model, it further includes: The asset risk data and threat attack coverage data are combined, and a spatial rectangular coordinate system is drawn with time as the baseline to establish a threat model. Specifically, in this embodiment, the threat model can vividly display the destructive impact of various vulnerabilities and network attack threats on network assets caused by changes over time, and can also analyze through threat modeling what are the current sources of threat amplification and which assets are based on rectification.

[0031] A detailed threat modeling can be established, which is a function that general threat analysis devices do not have. The modeling function can effectively observe and analyze whether the impact of existing network security threats will increase over time, and can effectively infer which attack threats are more likely to be encountered in the future through relevant threat analysis results. At the same time, the threat impact can also show which network security threats are based on solutions.

[0032] S3: Establish a threat model based on asset risk data and threat attack coverage data, and output security solutions based on the threat model.

[0033] Preferably, in step S3, outputting a security solution according to the threat model further includes: The AI ​​model outputs the blue team's security protection strategy for how to reduce the numerous attack threats faced by industrial sites from the blue team's perspective. The strategy module outputs security solutions based on the causes of the threats. Specifically, in this embodiment, targeted vulnerability repairs (hardware, middleware, web services) and the installation of corresponding network security equipment on the topology map play a role in in-depth defense, reducing the network attack threats that industrial sites may suffer from from the inside out.

[0034] In the past, the threat analysis device could only perform relevant network threat analysis through relevant vulnerability data. The invention can perform analysis through AI calculation. The analysis perspective is the red and blue team (the red team is a team-based simulation of real network attackers, and the blue team is a white hat team that prevents relevant network attackers) and combines relevant vulnerability scanning data + penetration test results. It attempts to analyze the network asset nodes that are easily attacked in the entire industrial site from the perspective of real team attack ideas and attack tactics, which tactics are easy to execute (success rate), the severity of damage after the execution of the tactics, and the difficulty of reconstruction after the attack. The above AI analysis is an analysis capability that general threat analysis devices do not have, and AI can perform self-learning, and autonomously optimize and upgrade existing attack tactics through existing attack cases and ATT&CK attack tactics, which greatly enriches the analysis surface and depth of related attack analysis.

[0035] The relevant mitigation methods are obtained by combining AI with the industry's mature in-depth defense system of the Blue Team, and based on the analysis of relevant mature Blue Team cases, a defense method suitable for the industrial site is obtained. It can also be combined with the existing security protection solutions imported by security data to consider whether the existing protection equipment can effectively protect the existing tactics or machine learning-derived tactics, and provide reasonable mitigation methods. In addition, it also includes product vulnerability repair methods and security reinforcement strategies to prevent the omission of security reinforcement points due to incomplete consideration of security personnel. In addition, because the amount of data for modeling and related detection is comprehensive, the relevant security strategies can achieve the effect of in-depth defense.

[0036] Example 2 See also Figure 2 As shown, this embodiment provides a system for threat analysis and mitigation based on an industrial field environment, including: The preparation module is used to detect the asset equipment in the entire network range to obtain the asset equipment information, and obtain the vulnerability scanning data based on the asset equipment information. Specifically, in this embodiment, the preparation module includes an asset identification module, a detection module and a data processing module. The asset identification module is used to detect the asset equipment in the entire network range to obtain the asset equipment information. The detection module is used for the detection library to obtain the vulnerability scanning data based on the asset equipment information. The data processing module is used to import the penetration test results and the security data of the security equipment. After the system is connected to the factory network, the asset identification module will first use the excitation device in the module to broadcast to all devices in the network range.

[0037] The detection library will integrate the payload and cop libraries of most current vulnerability scanning software (which can be updated in real time), support Trojan detection in uploaded files, payload case difference detection, keyword precise retrieval, and cover as many payloads and poc as possible to improve detection accuracy and reduce false alarm rate. It has the advantages of high accuracy and low false alarm rate.

[0038] This system is different from general threat analysis devices. First of all, the accuracy of equipment detection is high. The selected targets of general threat analysis devices are predetermined targets, but there are many devices on industrial sites, and global detection is required, which will result in a large number of targets. Not only is an activation payload added, active / inactive devices can be activated and respond effectively, but scanners based on TCP\IP, UDP and other protocol scanning principles can accurately scan related devices.

[0039] An AI module is used for the AI ​​model to determine the network asset attack priority according to the asset equipment information, obtain asset risk data according to the network asset attack priority, and obtain threat attack coverage data by performing threat analysis from a red team perspective. Specifically, in this embodiment, the AI ​​module includes an analysis module, and threat analysis is performed through the analysis module.

[0040] A modeling module is used to establish a threat model based on the asset risk data and the threat attack coverage data, and output a security solution based on the threat model. Specifically, in this embodiment, the modeling module includes a threat module and a policy module. The risk module is used to establish a threat model based on the asset risk data and the threat attack coverage data, and the policy module is used to output a security solution.

[0041] The data source for threat modeling comes from vulnerability scanning, penetration testing, and asset equipment detection. The validity of the modeling results is based on the accuracy and breadth of the data. In order to prevent incomplete scans (some vulnerability attack threats cannot be obtained through scanning), manual testing is supported to add relevant vulnerability mining information import. In addition, modeling can not only reflect the biggest threat sources and threat types at the industrial site, but also infer which unknown threat attacks the industrial site is most vulnerable to over time. Security layout and security reinforcement can be carried out in advance for relevant threats to achieve the security reinforcement purpose of in-depth defense. This embodiment has the advantages of a wide data source and accurate inference.

[0042] This embodiment combines the AI ​​red team perspective, classifies assets from the attacker's tactical perspective, clarifies the value of related network assets from the attacker's perspective, and combines a complete attack analysis chain to analyze which network asset nodes are vulnerable to attack at the industrial site, which tactics are easy to execute (success rate), the severity of damage after the tactics are executed, and the difficulty of reconstruction after the attack. Combined with the relevant vulnerability scanning and penetration test results, the impact of the relevant attack threats and the degree of harm the threats will affect can be calculated in detail.

[0043] Compared with the previous attack threat analysis device, this embodiment relies on comprehensive security data sources (security vulnerabilities, network topology, device information), and adds a perspective analysis based on the blue team's existing network defense (and can learn autonomously, combined with the industry's mature in-depth defense methods, and can self-iterate new protection methods with the iteration of products / technologies), which can effectively formulate security strategies that meet the industrial site (vulnerability repair methods, repair priorities, deployment of security equipment), improve the security of all network devices on site, and thus achieve the reduction of known network security threats and some unknown network security threats. It can effectively reduce the network security threats suffered by industrial sites, and at the same time has the advantage of strong defense.

[0044] Example 3 In some embodiments of the present application, a computer device is also provided, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for threat analysis and mitigation based on an industrial field environment as described in any one of Example 1.

[0045] The present invention also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, enables the one or more processors to perform the steps of the method for threat analysis and mitigation based on an industrial field environment as described in any one of Example 1.

[0046] It is understandable that, for the aforementioned threat analysis and mitigation methods based on industrial field environments, if they are all implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0047] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program codes contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0048] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for threat analysis and mitigation based on an industrial field environment, characterized in that: The following steps are involved: S1: Detect all asset devices in the network range to obtain asset device information, and obtain vulnerability scanning data based on the asset device information; S2: The AI ​​model determines the network asset attack priority based on the asset device information, obtains asset risk data based on the network asset attack priority, and performs threat analysis from a red team perspective to obtain threat attack coverage data; S3: Establish a threat model according to the asset risk data and the threat attack coverage data, and output a security solution according to the threat model.

2. The method for threat analysis and mitigation based on an industrial field environment according to claim 1, characterized in that: In step S1, detecting all asset devices in the network range to obtain asset device information further includes: S11: The triggering device broadcasts to all asset devices within the network range; S12: The asset device responds to the activation payload sent by the broadcast, and the scanner detects the asset device and records it to obtain the asset device information; S13: Perform vulnerability scanning according to the asset device information to obtain the vulnerability scanning data.

3. The method for threat analysis and mitigation based on an industrial field environment according to claim 2, characterized in that: In step S13, the vulnerability scanning is performed according to the asset device information to obtain the vulnerability scanning data, further comprising: According to the asset equipment information, use the attack payload detection library to perform vulnerability scanning and observe whether it is an attack vector, and determine whether there is a vulnerability based on the response to obtain the vulnerability scanning data; The attack vectors include attack payload, verification program PoC, and attack factors including support for Trojan detection in uploaded files, attack payload case difference detection, and keyword precise retrieval.

4. The method for threat analysis and mitigation based on an industrial field environment according to claim 3 is characterized in that: In step S2, the AI ​​model determines the network asset attack priority according to the asset device information, and obtains asset risk data according to the network asset attack priority, further comprising: S21: The AI ​​model lists and sorts the asset device information according to attack priority and attack necessity to determine the attack priority of the network asset; S22: determining the relative position of the asset device according to the response time of the scanner, and drawing a network topology map according to the position information; S23: Obtaining the asset risk data according to the network asset attack priority, the vulnerability scanning data and the imported security data.

5. The method for threat analysis and mitigation based on an industrial field environment according to claim 4, characterized in that: In step S2, threat analysis is performed from the perspective of the red team to obtain threat attack coverage data, further including: Analyze the vulnerability exploitation method, difficulty, and whether a combined attack can be implemented in combination with the network environment from the red team perspective of the AI ​​model to obtain the first attack coverage data; The AI ​​model obtains second attack coverage data based on the security data through tactical methods including red team attack and bypass, and whether the protection equipment can effectively protect the existing tactics or tactics derived from machine learning; Fill the vulnerability into the network topology map according to the first attack coverage data and the second attack coverage data to obtain the threat attack coverage data.

6. The method for threat analysis and mitigation based on an industrial field environment according to claim 5, characterized in that: According to the asset risk data and the threat attack coverage data threat model, further comprising: The asset risk data and the threat attack coverage data are combined, and then a spatial rectangular coordinate system is drawn with time as the baseline to establish the threat model.

7. The method for threat analysis and mitigation based on an industrial field environment according to claim 6, characterized in that: In step S3, outputting a security solution according to the threat model further includes: The AI ​​model outputs the blue team's security protection strategy for how to reduce the numerous attack threats faced by industrial sites from the blue team's perspective, and the strategy module outputs security solutions based on the causes of the threats.

8. A system for threat analysis and mitigation based on an industrial field environment, characterized in that: include: A preparation module is used to detect asset devices in the entire network range to obtain asset device information, and obtain vulnerability scanning data based on the asset device information; An AI module, for an AI model to determine the network asset attack priority according to the asset device information, obtain asset risk data according to the network asset attack priority, and obtain threat attack coverage data by performing threat analysis from a red team perspective; A modeling module is used to establish a threat model based on the asset risk data and the threat attack coverage data, and output a security solution based on the threat model.

9. A computer device, characterized in that: It comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for threat analysis and mitigation based on an industrial field environment as described in any one of claims 1 to 7.

10. A storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method for threat analysis and mitigation in an industrial field environment according to any one of claims 1 to 7.

Images