Industrial control network security risk assessment method based on data analysis

Abstract

The invention discloses an industrial control network security risk assessment method based on data analysis, and relates to the technical field of network security risk assessment, a risk trend coefficient Rte is calculated through multiple regression analysis, the coefficient can reflect the trend change of a potential security event, and risks possibly occurring in the future are recognized in advance. In combination with a dynamic risk assessment mechanism, by setting a dynamic threshold value Td, when the risk trend coefficient Rte exceeds the dynamic threshold value Td, the system can automatically generate an alarm and a protection measure suggestion. According to the dynamic evaluation mode, the system can automatically adjust an early warning mechanism according to real-time changes of the network, the flexibility and the response speed of dealing with sudden network attacks are enhanced, and managers can take measures in time to carry out safety protection. Through big data analysis and dynamic risk assessment, the method can timely identify potential risks and carry out real-time early warning, so that the occurrence probability of security incidents is remarkably reduced, and the dependence on manual operation is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security risk assessment, and in particular to an industrial control network security risk assessment method based on data analysis. Background Art

[0002] Industrial control network security is the core guarantee for the operation of modern industrial systems and belongs to the intersection of network security and industrial automation. With the development of industrial Internet and Internet of Things technologies, industrial control systems (ICS) have been widely used in power, manufacturing, petrochemical, transportation and other fields, realizing remote monitoring and automated operation of equipment through network communication. Specifically for industrial control networks, they usually rely on a multi-level security protection architecture to defend against potential network threats. However, with the increasing complexity of network threats, traditional protection methods have become difficult to cope with increasingly frequent and covert attacks, especially the potential risks in historical security incidents are often ignored, and cannot provide strong early warning support for future security protection.

[0003] In industrial control networks, the accumulation of historical security events provides an important data source for network security, but existing risk assessment methods generally have several defects: First, most traditional methods rely on static rules or expert experience to identify risks, ignoring the dynamic changes of historical security events and future trend predictions; second, the accuracy of risk assessment depends on human analysis, which makes it difficult to respond to sudden security issues in the network in real time.

[0004] These current situations and defects are mainly due to the high complexity of industrial control networks and the lack of big data processing capabilities. Due to the huge amount of data and the wide variety of data in industrial control networks, security events in the network are often hidden in noise and normal activities, making it difficult for simple rule matching or static analysis to detect risks in a timely manner. When existing risk assessment methods cannot promptly warn of potential threats, security vulnerabilities in the network may be exploited by attackers, resulting in serious consequences such as equipment failure, data leakage, and production interruption. This will not only affect the normal operation of the factory, but may also cause huge economic losses and further cause safety hazards in the industrial environment. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an industrial control network security risk assessment method based on data analysis, which solves the problems mentioned in the background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for industrial control network security risk assessment based on data analysis, comprising the following steps:

[0007] Step 1: Collect historical security data and real-time data through various sensors, log systems and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay and device failure trigger frequency Efail, to form a data set W;

[0008] Step 2: Preprocess the collected data set W, including removing outliers, reducing data noise, filling missing data and standardizing, to obtain the standard data set WB;

[0009] Step 3: Extract risk indicators from the standard data set WB by using feature extraction algorithms, including the frequency of historical security events Fev, the impact of events Iev, and the time interval , get the risk characteristic value F risk ;

[0010] Step 4: By using big data analysis methods, the risk feature value F risk Conduct trend analysis to identify the risk trend of security incidents and calculate the risk trend coefficient Rte by using multiple regression analysis;

[0011] Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the acquired risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm.

[0012] Step 6: When the system generates an alert, the system will generate a security alert and automatically generate a report, which includes changes in risk trends, risk feature analysis results, and recommended protective measures.

[0013] Preferably, various sensors, log systems and security devices in the network are identified and connected, and data including device communication error rate Perr, flow fluctuation coefficient Ffluc, network delay peak Ndelay and device failure trigger frequency Efail are obtained from the devices through SNMP network protocol;

[0014] The sensors include communication error sensors, network flow sensors, network delay sensors and equipment failure sensors. The communication error sensors collect the equipment communication error rate Perr, the network flow sensors collect the flow fluctuation coefficient Ffluc, the network delay sensors collect the network delay peak value Ndelay, and the equipment failure sensors collect the equipment failure trigger frequency Efail.

[0015] The real-time and historical data obtained from each device are transmitted to the central processing system, and the data from different sources are converted into a unified format to form a data set W.

[0016] Preferably, outliers are detected and deleted by using machine learning algorithms, noise interference is reduced and noise is removed by using filtering and smoothing algorithms;

[0017] The missing data is filled by using the mean interpolation method. The mean interpolation formula is as follows:

[0018] ;

[0019] In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data;

[0020] The data set W is standardized by using the Z-score standardization method to unify the value ranges of different features and obtain the standard data set WB.

[0021] Preferably, extract timestamps related to security events from the standard data set WB, count the number of security events that occur in a certain time window, and obtain the frequency Fev of security events;

[0022] The frequency of occurrence of the security event Fev is obtained by the following formula:

[0023] ;

[0024] In the formula, Indicates the total number of security events that occurred within the time window; Indicates the length of the time window. The length setting includes setting the time to one month;

[0025] Calculate the time interval between consecutive security events , the time interval Obtained by the following formula;

[0026] ;

[0027] In the formula, represents the time interval between the i-th event and the i+1-th event, represents the timestamp of the i-th event, Indicates the timestamp of the i+1th event;

[0028] Based on the scope of each incident, including the number of devices affected , Data loss and downtime , comprehensively assess the impact of the incident Iev;

[0029] The event impact level Iev is obtained by the following formula:

[0030] ;

[0031] In the formula, Indicates the number of devices affected, Indicates the amount of data loss. Indicates the downtime caused by the event, Respectively represents the number of affected devices , Data loss and downtime The preset weight value of

[0032] By analyzing the frequency Fev and time interval of historical security events , identify high-frequency and intensive events, and provide a basis for prioritizing high-risk events based on the multi-dimensional factors of event impact and the event impact level Iev, and obtain the risk characteristic value F risk ;

[0033] The risk characteristic value F risk Obtained by the following formula:

[0034] ;

[0035] In the formula, Fev represents the frequency of security incidents. represents the time interval, Iev represents the impact of the event, They represent the frequency of security events Fev and the time interval And the weight coefficient of the event impact degree Iev.

[0036] Preferably, the risk characteristic value F risk Split the time series according to one month as the time unit to form data subsets Xsub in different time windows;

[0037] The data subset Xsub is obtained by the following formula:

[0038] ;

[0039] Where Xsub represents the period t1, t2, …, t n The subset within contains the risk characteristic value F in each time period risk ; Represents the risk characteristic value in the i-th time period.

[0040] Preferably, multiple influencing factors are used as independent variables to determine the risk characteristic value F. risk Perform multiple regression analysis and calculate the risk characteristic value F of each independent variable riskThe influencing factors include the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the network delay peak Ndelay and the device failure trigger frequency Efail;

[0041] The multiple regression formula is:

[0042] ;

[0043] In the formula, F risk (t) represents the risk characteristic value at time t, represents the constant term in the regression equation, represents the error term, They represent the regression coefficients of device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay, and device failure trigger frequency Efail respectively;

[0044] Based on the risk characteristic value F at time t risk (t), extract the regression coefficient corresponding to the influencing factor and obtain the risk trend coefficient Rte; use the risk trend coefficient Rte to predict the changing trend of risk in the future;

[0045] The risk trend coefficient Rte is obtained by the following formula:

[0046] ;

[0047] In the formula, represents the derivative of the risk characteristic value with respect to time, Indicates that in the time window The total number of security incidents that occurred within represents the length of the time window, represents the frequency of the i-th type of event, represents the time decay factor, Represents the indicator function.

[0048] Preferably, a dynamic risk assessment is performed through the dynamic threshold Td and the obtained risk trend coefficient Rte to obtain the risk characteristic analysis result. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to the change of the risk environment;

[0049] The dynamic threshold Td is obtained by the following formula:

[0050] ;

[0051] in Represents the historical average of the risk trend coefficient Rte, It represents the historical standard deviation of the risk trend coefficient Rte, and L represents the adjustable safety factor.

[0052] Preferably, the obtained risk trend coefficient Rte is compared with the dynamic threshold Td: the risk characteristic analysis result is obtained;

[0053] When the risk trend coefficient Rte>dynamic threshold Td, the risk characteristic analysis result is abnormal;

[0054] When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified;

[0055] When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is qualified.

[0056] Preferably, when the risk feature analysis result is abnormal and unqualified, a safety alarm is automatically generated, and the current status and alarm information BJ are recorded;

[0057] The alarm information BJ is obtained by the following formula:

[0058] ;

[0059] Where, time is the specific time when the alarm is generated, and the status information includes the traffic fluctuation coefficient Ffluc and the network delay peak Ndelay, F risk Represents the risk characteristic value.

[0060] Preferably, a report is generated based on the alarm information BJ by integrating risk trend changes, risk characteristic analysis results and recommended protective measures, wherein the risk trend changes include describing the changes in the risk trend coefficient Rte relative to historical data, the risk characteristic analysis includes displaying the comparison between the risk trend coefficient Rte and the dynamic threshold Td, and the protective measures include specific protective measures proposed based on the current risk status.

[0061] The present invention provides an industrial control network security risk assessment method based on data analysis, which has the following beneficial effects:

[0062] (1) This method uses feature extraction algorithms to extract key risk indicators from standard data sets, including the frequency Fev, impact level Iev, and time interval of historical security events. . The risk trend coefficient Rte is calculated through multivariate regression analysis. This coefficient can reflect the trend changes of potential security incidents and identify possible risks in the future in advance. Combined with the dynamic risk assessment mechanism, by setting the dynamic threshold Td, when the risk trend coefficient Rte exceeds the threshold, the system can automatically generate alarms and protective measures. This dynamic assessment method enables the system to automatically adjust the early warning mechanism according to the real-time changes of the network, enhances the flexibility and response speed to sudden network attacks, and helps managers take timely measures for security protection.

[0063] Through big data analysis and dynamic risk assessment, this method can timely identify potential risks and provide real-time warnings, significantly reducing the probability of security incidents. The entire process from data collection to warning and report generation is automated, reducing reliance on manual operations while improving processing speed and accuracy. By calculating the dynamic threshold Td in real time and generating alarms, the system can flexibly adjust according to network changes, improving the ability to respond to sudden security incidents and ensuring the stability and security of industrial control systems.

[0064] (2) Machine learning algorithms are used to detect and delete outliers to ensure data accuracy; filtering and smoothing algorithms effectively reduce noise interference and make the data more stable. Missing data are filled by the mean interpolation method to ensure the integrity of the data set and avoid the impact of insufficient data on the analysis results. The Z-score standardization method is used to unify the value range of the data, eliminate the scale differences between different features, and make subsequent analysis more accurate. The standard data set WB obtained after standardization achieves uniformity in the value range of different feature values, ensuring the adaptability of subsequent machine learning algorithms and analysis models to the data. This not only improves the reliability of data analysis, but also further improves the accuracy of prediction and trend analysis.

[0065] The real-time data collection of multiple sensors ensures comprehensive monitoring of the status of industrial control networks and improves the ability to identify potential problems. The real-time transmission and unified format of multi-source data solve the problems of traditional data loss and format inconsistency and ensure the integrity of data. From outlier detection to missing data filling, and then to data standardization, the accuracy and consistency of data are ensured, laying a solid foundation for subsequent analysis.

[0066] (3) By extracting the frequency Fev and time interval of security events The high frequency and density of security incidents are comprehensively analyzed based on the impact of the incidents, including the number of devices, data loss, and downtime. Compared with the traditional single-dimensional evaluation method, this method can reflect the risk of security incidents from multiple angles, effectively improve the accuracy of risk assessment, and provide a reliable basis for identifying high-risk incidents. risk According to the time series segmentation, F risk Conduct trend analysis to effectively identify risk trends of security incidents. This dynamic assessment method can track risk changes in different time periods. Compared with static analysis methods, this method can timely capture the changing trends of security risks, especially in the case of frequent high-risk incidents, which helps to warn of potential risks in the future in advance and improve the sensitivity and timeliness of risk warning.

[0067] (4) Based on the risk trend coefficient Rte, the risk characteristic value F risk The dynamic risk trend forecast can identify the potential risk trends in advance, helping managers take timely measures and improving the initiative and foresight of safety management.

[0068] The calculation method of the dynamic threshold Td combines the historical mean, standard deviation and safety factor L of the risk trend coefficient Rte, and can be adaptively adjusted according to actual risk changes. The dynamic threshold Td can adapt to risk fluctuations in different environments, dynamically adjust the risk warning standard, and avoid the problem of excessive or missed warnings caused by fixed thresholds. The introduction of adaptive thresholds improves the flexibility and responsiveness of the system to risk control, and can adjust protective measures in a timely manner when the risk level changes significantly. Through the multivariate regression analysis method, the impact of each factor on the risk is quantitatively calculated, which improves the scientific nature of risk assessment. Based on the risk trend coefficient Rte, the future risk change trend can be predicted, which improves the foresight of safety management. Through the adaptive adjustment of the dynamic threshold Td, the flexibility of the system to deal with different risk scenarios is enhanced, ensuring the efficiency and accuracy of the early warning mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 The present invention is a schematic diagram of the steps of an industrial control network security risk assessment method based on data analysis. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0071] Example 1: The present invention provides an industrial control network security risk assessment method based on data analysis. Figure 1 , including the following steps:

[0072] Step 1: Collect historical security data and real-time data through various sensors, log systems and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay and device failure trigger frequency Efail, to form a data set W;

[0073] Step 2: Preprocess the collected data set W, including removing outliers, reducing data noise, filling missing data and standardizing, to obtain the standard data set WB;

[0074] Step 3: Extract risk indicators from the standard data set WB by using feature extraction algorithms, including the frequency of historical security events Fev, the impact of events Iev, and the time interval , get the risk characteristic value F risk ;

[0075] Step 4: By using big data analysis methods, the risk feature value F risk Conduct trend analysis to identify the risk trend of security incidents and calculate the risk trend coefficient Rte by using multiple regression analysis;

[0076] Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the acquired risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm.

[0077] Step 6: When the system generates an alert, the system will generate a security alert and automatically generate a report, which includes changes in risk trends, risk feature analysis results, and recommended protective measures.

[0078] In this embodiment, the method collects parameters such as the device communication error rate Perr, the flow fluctuation coefficient Ffluc, the network delay peak Ndelay, and the device failure trigger frequency Efail through multiple data sources such as sensors, log systems, and security devices to ensure the comprehensiveness and accuracy of the data. This multi-dimensional data collection method breaks through the limitation of traditional methods that rely only on single-dimensional data for analysis, and can more comprehensively capture potential risk factors in the network.

[0079] The data preprocessing steps ensure the high quality of the input data, including removing outliers, filling missing data and standardization, which can eliminate the influence of noise and errors and make subsequent analysis more reliable. By standardizing the data set WB, the complexity of processing different types of data is avoided, effectively improving the consistency of the data and the accuracy of the analysis.

[0080] This method uses feature extraction algorithms to extract key risk indicators from standard data sets, such as the frequency of historical security events Fev, the impact level Iev and the time interval The risk trend coefficient Rte is calculated through multiple regression analysis, which can reflect the trend changes of potential security incidents and identify possible risks in the future in advance.

[0081] Combined with the dynamic risk assessment mechanism, by setting the dynamic threshold Td, when the risk trend coefficient Rte exceeds the threshold, the system can automatically generate alarms and protective measures. This dynamic assessment method allows the system to automatically adjust the early warning mechanism according to the real-time changes of the network, enhances the flexibility and response speed to sudden network attacks, and helps managers take timely measures for security protection.

[0082] After a security risk is detected and exceeds the threshold, the system can automatically generate a report containing detailed risk trends, analysis results, and protective measures. This automated report generation mechanism greatly reduces the time for manual analysis, improves the efficiency of risk response, and provides managers with timely and accurate decision support, helping them to more effectively protect network security.

[0083] Through big data analysis and dynamic risk assessment, this method can timely identify potential risks and provide real-time warnings, significantly reducing the probability of security incidents. The entire process from data collection to warning and report generation is automated, reducing reliance on manual operations while improving processing speed and accuracy. By calculating the dynamic threshold Td in real time and generating alarms, the system can flexibly adjust according to network changes, improving the ability to respond to sudden security incidents and ensuring the stability and security of industrial control systems.

[0084] Example 2: This example is an explanation of Example 1. Figure 1 ,Specifically: Identify and connect various sensors, log systems and security devices in the network, and obtain data from the devices through the SNMP network protocol, including the device communication error rate Perr, the flow fluctuation coefficient Ffluc, the network delay peak Ndelay and the device fault trigger frequency Efail;

[0085] The sensors include communication error sensors, network flow sensors, network delay sensors and equipment failure sensors. The communication error sensors collect the equipment communication error rate Perr, the network flow sensors collect the flow fluctuation coefficient Ffluc, the network delay sensors collect the network delay peak value Ndelay, and the equipment failure sensors collect the equipment failure trigger frequency Efail.

[0086] The real-time and historical data obtained from each device are transmitted to the central processing system, and the data from different sources are converted into a unified format to form a data set W.

[0087] Detect and remove outliers by using machine learning algorithms, reduce noise interference and remove noise by using filtering and smoothing algorithms;

[0088] The missing data is filled by using the mean interpolation method. The mean interpolation formula is as follows:

[0089] ;

[0090] In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data;

[0091] The data set W is standardized by using the Z-score standardization method to unify the value ranges of different features and obtain the standard data set WB.

[0092] In this embodiment, multiple key parameters are collected from different devices in real time by using the SNMP network protocol, including the device communication error rate Perr, the flow fluctuation coefficient Ffluc, the network delay peak Ndelay, and the device failure trigger frequency Efail. These parameters are monitored by special sensors to ensure the accuracy and comprehensiveness of the collected data.

[0093] In the process of transmitting data from various devices to the central processing system, strict transmission protection measures are adopted to avoid data loss and deformation. At the same time, by converting data from different sources into a unified format to form a data set W, the integration problem caused by inconsistent multi-source data is solved. This can ensure data consistency and standardized processing effects in subsequent processing links, making analysis more reliable.

[0094] This method performs systematic preprocessing operations on the data, including outlier detection and deletion, noise removal and data smoothing, missing data filling, and data standardization. Machine learning algorithms are used to detect and delete outliers to ensure the accuracy of the data; filtering and smoothing algorithms effectively reduce noise interference and make the data more stable. Missing data are filled by the mean interpolation method to ensure the integrity of the data set and avoid the impact of insufficient data on the analysis results. The Z-score standardization method is used to unify the value range of the data, eliminate the scale differences between different features, and make subsequent analysis more accurate. The standard data set WB obtained after standardization has achieved unification in the value range of different feature values, ensuring the adaptability of subsequent machine learning algorithms and analysis models to the data. This not only improves the reliability of data analysis, but also further improves the accuracy of prediction and trend analysis.

[0095] Example 3: This example is an explanation of Example 2. Figure 1 ,Specifically: extract the timestamp related to the security events from the ,standard data set WB, count the number of security events that occur in a certain time window, and ,obtain the frequency of security events Fev;

[0096] The frequency of occurrence of the security event Fev is obtained by the following formula:

[0097] ;

[0098] In the formula, Indicates the total number of security events that occurred within the time window; Indicates the length of the time window. The length setting includes setting the time to one month;

[0099] Calculate the time interval between consecutive security events , the time interval Obtained by the following formula;

[0100] ;

[0101] In the formula, represents the time interval between the i-th event and the i+1-th event, represents the timestamp of the i-th event, Indicates the timestamp of the i+1th event;

[0102] Based on the scope of each incident, including the number of devices affected , Data loss and downtime , comprehensively assess the impact of the incident Iev;

[0103] The event impact level Iev is obtained by the following formula:

[0104] ;

[0105] In the formula, Indicates the number of devices affected, Indicates the amount of data loss. Indicates the downtime caused by the event, Respectively represents the number of affected devices , Data loss and downtime The preset weight value of

[0106] By analyzing the frequency Fev and time interval of historical security events , identify high-frequency and intensive events, and provide a basis for prioritizing high-risk events based on the multi-dimensional factors of event impact and the event impact level Iev, and obtain the risk characteristic value F risk ;

[0107] The risk characteristic value F risk Obtained by the following formula:

[0108] ;

[0109] In the formula, Fev represents the frequency of security incidents. represents the time interval, Iev represents the impact of the event, They represent the frequency of security events Fev and the time interval And the weight coefficient of the event impact degree Iev.

[0110] The risk characteristic value F risk Split the time series according to one month as the time unit to form data subsets Xsub in different time windows;

[0111] The data subset Xsub is obtained by the following formula:

[0112] ;

[0113] Where Xsub represents the period t1, t2, …, t n The subset within contains the risk characteristic value F in each time period risk ; Represents the risk characteristic value in the i-th time period.

[0114] In this embodiment, by extracting the frequency Fev and time interval of the security event The high frequency and density of security incidents are comprehensively analyzed based on the impact of the incidents, including the number of devices, data loss, and downtime. Compared with the traditional single-dimensional evaluation method, this method can reflect the risk of security incidents from multiple angles, effectively improve the accuracy of risk assessment, and provide a reliable basis for identifying high-risk incidents. risk According to the time series segmentation, F risk Conduct trend analysis to effectively identify risk trends of security incidents. This dynamic assessment method can track risk changes in different time periods. Compared with static analysis methods, this method can timely capture the changing trends of security risks, especially in the case of frequent high-risk incidents, which helps to warn of potential risks in the future in advance and improve the sensitivity and timeliness of risk warning.

[0115] Based on the frequency of security events Fev, the impact of events Iev and the time interval The system can automatically identify high-frequency and intensive events and classify them according to the risk characteristic value F risk This priority management method effectively reduces the misjudgment and delays caused by traditional manual judgment, improves the efficiency of managers in handling high-risk events, ensures the rational allocation of resources, helps to formulate protective measures in advance, and reduces safety hazards.

[0116] The multiple characteristic values ​​of security events are extracted, including the frequency of security events Fev, the impact of events Iev and the time interval. , quantitatively evaluate security incidents from multiple dimensions, and improve the accuracy of risk analysis. Identify risk trends through time series analysis, monitor potential risk changes in a timely manner, and provide more timely early warning information. The priority processing mechanism based on risk characteristics automatically identifies and classifies high-risk incidents, reduces manual judgment errors, and improves the efficiency of responding to sudden security incidents.

[0117] Example 4: This example is an explanation of Example 3. Figure 1 Specifically: Use multiple influencing factors as independent variables to evaluate the risk characteristic value F risk Perform multiple regression analysis and calculate the risk characteristic value F of each independent variable risk The influencing factors include the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the network delay peak Ndelay and the device failure trigger frequency Efail;

[0118] The multiple regression formula is:

[0119] ;

[0120] In the formula, F risk (t) represents the risk characteristic value at time t, represents the constant term in the regression equation, represents the error term, They represent the regression coefficients of device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay, and device failure trigger frequency Efail respectively;

[0121] Based on the risk characteristic value F at time t risk (t), extract the regression coefficient corresponding to the influencing factor and obtain the risk trend coefficient Rte; use the risk trend coefficient Rte to predict the changing trend of risk in the future;

[0122] The risk trend coefficient Rte is obtained by the following formula:

[0123] ;

[0124] In the formula, represents the derivative of the risk characteristic value with respect to time, Indicates that in the time window The total number of security incidents that occurred within represents the length of the time window, represents the frequency of the i-th type of event, represents the time decay factor, Represents the indicator function.

[0125] Dynamic risk assessment is performed through the dynamic threshold Td and the obtained risk trend coefficient Rte to obtain the risk characteristic analysis results. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to changes in the risk environment;

[0126] The dynamic threshold Td is obtained by the following formula:

[0127] ;

[0128] in Represents the historical average of the risk trend coefficient Rte, It represents the historical standard deviation of the risk trend coefficient Rte, and L represents the adjustable safety factor.

[0129] In this embodiment, by taking the device communication error rate Perr, the flow fluctuation coefficient Ffluc, the network delay peak Ndelay and the device failure trigger frequency Efail as independent variables, a multivariate regression analysis can be performed to quantify the impact of these key factors on the risk characteristic value F risk The contribution of this paper is to improve the accuracy and reliability of risk assessment and better reflect the superimposed impact of various factors on risks in complex network environments.

[0130] Based on the risk trend coefficient Rte, the risk characteristic value F risk The dynamic risk trend forecast can identify the potential risk trends in advance, helping managers take timely measures and improving the initiative and foresight of safety management.

[0131] The calculation method of the dynamic threshold Td combines the historical mean, standard deviation and safety factor L of the risk trend coefficient Rte, and can be adaptively adjusted according to actual risk changes. The dynamic threshold Td can adapt to risk fluctuations in different environments, dynamically adjust the risk warning standard, and avoid the problem of excessive or missed warnings caused by fixed thresholds. The introduction of adaptive thresholds improves the flexibility and responsiveness of the system to risk control, and can adjust protective measures in a timely manner when the risk level changes significantly.

[0132] Example 5: This example is an explanation of Example 4. Please refer to Figure 1 , specifically: compare the obtained risk trend coefficient Rte with the dynamic threshold Td: obtain the risk characteristic analysis result;

[0133] When the risk trend coefficient Rte>dynamic threshold Td, the risk characteristic analysis result is abnormal;

[0134] When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified;

[0135] When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is qualified.

[0136] When the risk feature analysis results are abnormal and unqualified, a safety alarm is automatically generated, recording the current status and alarm information BJ;

[0137] The alarm information BJ is obtained by the following formula:

[0138] ;

[0139] Where, time is the specific time when the alarm is generated, and the status information includes the traffic fluctuation coefficient Ffluc and the network delay peak Ndelay, F risk Represents the risk characteristic value.

[0140] Based on the alarm information BJ, the risk trend changes, risk characteristic analysis results and recommended protective measures are integrated to generate a report, in which the risk trend changes include describing the changes in the risk trend coefficient Rte relative to historical data, the risk characteristic analysis includes showing the comparison between the risk trend coefficient Rte and the dynamic threshold Td, and the protective measures include specific protective measures proposed based on the current risk status.

[0141] Risk trend changes: The report will describe in detail the changes in the risk trend coefficient Rte over the past period of time, including: Time period: a set analysis period, such as the past month or a quarter.

[0142] List the specific values ​​of Rte at each time point, draw a change curve, and visualize the rise or fall of risk trends; calculate the rate of change of Rte to help identify the trend of risk acceleration or slowdown.

[0143] Compare the current Rte with past historical data to indicate whether the current risk trend is within the normal range or whether there are abnormal fluctuations.

[0144] Risk characteristic analysis: The report will analyze the relationship between the risk trend coefficient Rte and the dynamic threshold Td: Comparison of the risk trend coefficient Rte and the dynamic threshold Td: Clearly list the current values ​​of the risk trend coefficient Rte and the dynamic threshold Td, as well as the gap between the two.

[0145] Risk level determination: Based on the comparison results, determine the current risk status: High risk status: If the risk trend coefficient Rte > dynamic threshold Td, it means that the risk is rising and exceeds the warning line, and immediate measures must be taken.

[0146] Alert status: If the risk trend coefficient Rte = dynamic threshold Td, it means that the risk is close to the threshold and monitoring needs to be strengthened.

[0147] Controllable state: If the risk trend coefficient Rte < dynamic threshold Td, it indicates that the risk is within the controllable range and you can continue to monitor.

[0148] Recommended protective measures: Based on the analysis of the current risk status, provide practical protective measures: High risk status: Immediate response: Initiate the emergency response plan and organize relevant technical teams to investigate and handle the situation.

[0149] Enhanced monitoring: Increase the monitoring frequency of the system and deploy additional security detection tools.

[0150] Restrict Access: Temporarily restrict access to critical systems to prevent potential security incidents from spreading.

[0151] Alert status: Continuous monitoring: Maintain high-frequency monitoring, record relevant network activities, and update risk status in a timely manner.

[0152] Regular assessment: Develop regular risk assessment plans to ensure dynamic tracking of risk levels.

[0153] Optimization strategy: Based on historical data analysis, gradually optimize the protection strategy to reduce potential risks in the future.

[0154] Regular inspection: Regularly check the security status of the system to ensure that no new hidden dangers arise.

[0155] In this embodiment, by comparing the risk trend coefficient Rte with the dynamic threshold Td in real time, it is possible to accurately determine whether the current network risk exceeds the warning line. This mechanism can immediately trigger an alarm when the risk growth rate exceeds the set threshold, ensuring that managers can quickly respond to potential security threats, enhancing the agility and response speed of the system, and avoiding the problem of delayed warning in traditional risk assessment methods. This method sets three different risk states, including "exceeding the threshold", "approaching the threshold" and "below the threshold", and provides corresponding response measures for different risk levels. Managers can choose different protection strategies based on the current risk status, such as taking immediate measures or strengthening monitoring. This multi-level monitoring mechanism ensures the refined management of the system, so that security measures can be gradually upgraded according to the severity of the risk.

[0156] When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system can automatically generate a security alert and record the current network status, device health status and risk characteristic value F risk , forming a detailed alarm information BJ. This information records key security parameters, facilitates subsequent analysis and event tracing, and helps managers quickly understand the current security situation and make corresponding decisions. On the basis of generating alarm information BJ, the system further integrates risk trend changes, historical data analysis and protective measures, and automatically generates a detailed security risk report. The report not only describes the current risk changes, but also provides in-depth analysis based on the data of historical events, and gives targeted protective measures. Through these reports, managers can obtain a more comprehensive picture of risks, improve the scientificity and pertinence of decision-making, and optimize resource allocation and the formulation of protection strategies.

[0157] Through the real-time comparison of the risk trend coefficient Rte and the dynamic threshold Td, a more accurate risk warning is achieved, which improves the response efficiency of security incidents. The hierarchical processing mechanism under different risk states ensures that the system can take corresponding measures when the risk gradually increases, reducing the incidence of security accidents. Automatically generate alarm information BJ and record it in detail, which is convenient for post-analysis and improvement, and improves the automation level of security management. The automatically generated reports of risk trends, historical analysis and protection suggestions provide managers with comprehensive decision-making support, helping them to deal with complex network security risks more effectively.

[0158] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for industrial control network security risk assessment based on data analysis, characterized in that: The following steps are involved: Step 1: Collect historical security data and real-time data through various sensors, log systems and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay and device failure trigger frequency Efail, to form a data set W; Step 2: Preprocess the collected data set W, including removing outliers, reducing data noise, filling missing data and standardizing, to obtain the standard data set WB; Step 3: Extract risk indicators from the standard data set WB by using feature extraction algorithms, including the frequency of historical security events Fev, the impact of events Iev, and the time interval , get the risk characteristic value F risk ; Step 4: By using big data analysis methods, the risk feature value F risk Conduct trend analysis to identify the risk trend of security incidents and calculate the risk trend coefficient Rte by using multiple regression analysis; Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the acquired risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm. Step 6: When the system generates an alert, the system will generate a security alert and automatically generate a report, which includes changes in risk trends, risk feature analysis results, and recommended protective measures.

2. The industrial control network security risk assessment method based on data analysis according to claim 1 is characterized by: Identify and connect various sensors, log systems and security devices in the network, and obtain data from the devices through the SNMP network protocol, including the device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay and device fault trigger frequency Efail; The sensors include communication error sensors, network flow sensors, network delay sensors and equipment failure sensors. The communication error sensors collect the equipment communication error rate Perr, the network flow sensors collect the flow fluctuation coefficient Ffluc, the network delay sensors collect the network delay peak value Ndelay, and the equipment failure sensors collect the equipment failure trigger frequency Efail. The real-time and historical data obtained from each device are transmitted to the central processing system, and the data from different sources are converted into a unified format to form a data set W.

3. The industrial control network security risk assessment method based on data analysis according to claim 1 is characterized by: Detect and remove outliers by using machine learning algorithms, reduce noise interference and remove noise by using filtering and smoothing algorithms; The missing data is filled by using the mean interpolation method. The mean interpolation formula is as follows: ； In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data; The data set W is standardized by using the Z-score standardization method to unify the value ranges of different features and obtain the standard data set WB.

4. The industrial control network security risk assessment method based on data analysis according to claim 1 is characterized by: Extract timestamps related to security events from the standard data set WB, count the number of security events that occur in a certain time window, and obtain the frequency of security events Fev; The frequency of occurrence of the security event Fev is obtained by the following formula: ； In the formula, Indicates the total number of security events that occurred within the time window; Indicates the length of the time window; Calculate the time interval between consecutive security events , the time interval Obtained by the following formula; ； In the formula, represents the time interval between the i-th event and the i+1-th event, represents the timestamp of the i-th event, Indicates the timestamp of the i+1th event; Based on the scope of each incident, including the number of devices affected , Data loss and downtime , comprehensively assess the impact of the incident Iev; The event impact level Iev is obtained by the following formula: ； In the formula, Indicates the number of devices affected, Indicates the amount of data loss, Indicates the downtime caused by the event, Respectively represents the number of affected devices , Data loss and downtime The preset weight value of By analyzing the frequency Fev and time interval of historical security events , identify high-frequency and intensive events, and provide a basis for prioritizing high-risk events based on the multi-dimensional factors of event impact and the degree of event impact Iev, and obtain risk characteristic values ; The risk characteristic value Obtained by the following formula: ； In the formula, Fev represents the frequency of security incidents. represents the time interval, Iev represents the impact of the event, They represent the frequency of security events Fev and the time interval And the weight coefficient of the event impact degree Iev.

5. The industrial control network security risk assessment method based on data analysis according to claim 4 is characterized by: The risk characteristic value obtained Split the time series according to one month as the time unit to form data subsets Xsub in different time windows; The data subset Xsub is obtained by the following formula: ； Where Xsub represents the period t1, t2, …, t n The subset within contains the risk characteristic value F in each time period risk ; Represents the risk characteristic value in the i-th time period.

6. The industrial control network security risk assessment method based on data analysis according to claim 5 is characterized by: Using multiple influencing factors as independent variables to predict the risk eigenvalue F risk Perform multiple regression analysis and calculate the risk characteristic value F of each independent variable risk The influencing factors include the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the network delay peak Ndelay and the device failure trigger frequency Efail; The multiple regression formula is: ； In the formula, F risk (t) represents the risk characteristic value at time t, represents the constant term in the regression equation, represents the error term, They represent the regression coefficients of device communication error rate Perr, traffic fluctuation coefficient Ffluc, network delay peak Ndelay, and device failure trigger frequency Efail respectively; Based on the risk characteristic value F at time t risk (t), extract the regression coefficient corresponding to the influencing factor and obtain the risk trend coefficient Rte; use the risk trend coefficient Rte to predict the changing trend of risk in the future; The risk trend coefficient Rte is obtained by the following formula: ； In the formula, represents the derivative of the risk characteristic value with respect to time, Indicates that in the time window The total number of security incidents that occurred within represents the length of the time window, represents the frequency of the i-th type of event, represents the time decay factor, Represents the indicator function.

7. The industrial control network security risk assessment method based on data analysis according to claim 1 is characterized by: Dynamic risk assessment is performed through the dynamic threshold Td and the obtained risk trend coefficient Rte to obtain the risk characteristic analysis results. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to changes in the risk environment; The dynamic threshold Td is obtained by the following formula: ； in Represents the historical average of the risk trend coefficient Rte, It represents the historical standard deviation of the risk trend coefficient Rte, and L represents the adjustable safety factor.

8. The method for industrial control network security risk assessment based on data analysis according to claim 7 is characterized in that: Compare the obtained risk trend coefficient Rte with the dynamic threshold Td: obtain the risk characteristic analysis result; When the risk trend coefficient Rte>dynamic threshold Td, the risk characteristic analysis result is abnormal; When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified; When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is qualified.

9. The industrial control network security risk assessment method based on data analysis according to claim 8 is characterized by: When the risk feature analysis result is abnormal and unqualified, a safety alarm is automatically generated, recording the current status and alarm information BJ; The alarm information BJ is obtained by the following formula: ； Where, time is the specific time when the alarm is generated, and the status information includes the traffic fluctuation coefficient Ffluc and the network delay peak Ndelay, F risk Represents the risk characteristic value.

10. The method for industrial control network security risk assessment based on data analysis according to claim 9 is characterized in that: Based on the alarm information BJ, the risk trend changes, risk characteristic analysis results and recommended protective measures are integrated to generate a report, in which the risk trend changes include describing the changes in the risk trend coefficient Rte relative to historical data, the risk characteristic analysis includes showing the comparison between the risk trend coefficient Rte and the dynamic threshold Td, and the protective measures include specific protective measures proposed based on the current risk status.

Images