An industrial control network security risk assessment method based on data analysis

Abstract

This invention discloses a data analysis-based method for assessing cybersecurity risks in industrial control systems, belonging to the field of cybersecurity risk assessment technology. It calculates a risk trend coefficient Rte through multiple regression analysis, which reflects the trend changes of potential security events and identifies potential future risks in advance. Combined with a dynamic risk assessment mechanism, by setting a dynamic threshold Td, the system can automatically generate alarms and protective measure suggestions when the risk trend coefficient Rte exceeds the dynamic threshold Td. This dynamic assessment method allows the system to automatically adjust the early warning mechanism according to real-time network changes, enhancing the flexibility and response speed to sudden cyberattacks and helping managers take timely security measures. Through big data analysis and dynamic risk assessment, this method can identify potential risks in a timely manner and provide real-time warnings, significantly reducing the probability of security incidents and decreasing reliance on manual operation.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity risk assessment technology, specifically to a data analysis-based method for assessing cybersecurity risks in industrial control systems. Background Technology

[0002] Industrial control network security is a core safeguard for the operation of modern industrial systems, falling at the intersection of cybersecurity and industrial automation. With the development of Industrial Internet and Internet of Things (IoT) technologies, Industrial Control Systems (ICS) have been widely applied in power, manufacturing, petrochemical, and transportation industries, enabling remote monitoring and automated operation of equipment through network communication. Specifically, industrial control networks typically rely on multi-layered security architectures to defend against potential cyber threats. However, as the complexity of cyber threats increases, traditional protection methods are struggling to cope with increasingly frequent and covert attacks. In particular, potential risks from historical security incidents are often overlooked, failing to provide strong early warning support for future security protection.

[0003] In industrial control networks, while the accumulation of historical security incidents provides an important data source for network security, existing risk assessment methods generally have several shortcomings: First, most traditional methods rely on static rules or expert experience to identify risks, ignoring the dynamic changes of historical security incidents and the prediction of future trends; second, the accuracy of risk assessment depends on human analysis, making it difficult to respond to sudden security problems in the network in real time.

[0004] These current conditions and shortcomings primarily stem from the high complexity of industrial control networks and insufficient big data processing capabilities. Due to the massive volume and diverse types of data in industrial control networks, security incidents often remain hidden within noise and normal activity, making it difficult for simple rule matching or static analysis to detect risks in a timely manner. When existing risk assessment methods fail to provide timely warnings of potential threats, security vulnerabilities in the network may be exploited by attackers, leading to serious consequences such as equipment malfunctions, data breaches, and production interruptions. This not only affects the normal operation of the factory but can also cause significant economic losses and further exacerbate security risks in the industrial environment. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a data analysis-based method for assessing cybersecurity risks in industrial control systems, thus resolving the problems mentioned in the background section.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a data analysis-based method for assessing network security risks in industrial control systems, comprising the following steps:

[0007] Step 1: Collect historical and real-time security data through various sensors, logging systems, and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network latency peak Ndelay, and device failure trigger frequency Efail, to form a dataset W;

[0008] Step 2: Preprocess the collected dataset W, including removing outliers, denoising the data, imputing missing data, and standardizing the data to obtain the standard dataset WB;

[0009] Step 3: Extract risk indicators from the standard dataset WB using feature extraction algorithms, including the frequency of historical security incidents (Fev), the impact of the incidents (Iev), and the time interval. Obtain the risk characteristic value F risk ;

[0010] Step 4: Using big data analytics methods, analyze the extracted risk characteristic value F. risk Trend analysis is conducted to identify risk trends in security incidents, and the risk trend coefficient Rte is calculated using multiple regression analysis.

[0011] Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the obtained risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm.

[0012] Step Six: When the system generates an alarm, it will generate a security alert and automatically generate a report, which includes changes in risk trends, risk characteristic analysis results, and recommended protective measures.

[0013] Preferably, it identifies and connects various sensors, logging systems and security devices in the network, and obtains data from the devices via the SNMP network protocol, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network latency peak Ndelay and device failure trigger frequency Efail;

[0014] The various sensors include communication error sensors, network traffic sensors, network latency sensors, and equipment fault sensors. The communication error sensor collects the equipment communication error rate Perr, the network traffic sensor collects the traffic fluctuation coefficient Ffluc, the network latency sensor collects the network latency peak Ndelay, and the equipment fault sensor collects the equipment fault trigger frequency Efail.

[0015] Real-time and historical data acquired from various devices are transmitted to a central processing system, which converts the data from different sources into a unified format to form dataset W.

[0016] Preferably, outliers are detected and removed by using machine learning algorithms, and noise interference is reduced and removed by using filtering and smoothing algorithms;

[0017] Missing data can be filled using mean interpolation. The formula for mean interpolation is as follows:

[0018] ;

[0019] In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data points;

[0020] The dataset W is standardized by using the Z-score standardization method to unify the value range of different features and obtain the standard dataset WB.

[0021] Preferably, timestamps related to security events are extracted from the standard dataset WB, the number of security events occurring within a certain time window is counted, and the frequency of occurrence of security events Fev is obtained;

[0022] The frequency of occurrence of the security event, Fev, is obtained using the following formula:

[0023] ;

[0024] In the formula, This represents the total number of security events that occurred within the time window; This indicates the length of the time window, with the length setting including a one-month period.

[0025] Calculate the time interval between consecutive security events The time interval Obtain it using the following formula;

[0026] ;

[0027] In the formula, This represents the time interval between the i-th event and the (i+1)-th event. This represents the timestamp of the i-th event. This represents the timestamp of the (i+1)th event;

[0028] Based on the scope of impact of each event, including the number of affected devices. Data loss and downtime A comprehensive assessment of the impact of the event (Iev);

[0029] The impact level Iev of the event is obtained using the following formula:

[0030] ;

[0031] In the formula, Indicates the number of affected devices. Indicates the amount of data lost. Indicates the downtime caused by the event. These represent the number of affected devices. Data loss and downtime The preset weight value;

[0032] By analyzing the frequency (Fev) and time intervals of historical security incidents... It identifies high-frequency and intensive events, and based on multidimensional factors of event impact, provides a basis for prioritizing the handling of high-risk events according to the degree of event impact (Iev), and obtains risk characteristic values ​​(F). risk ;

[0033] The risk characteristic value F risk Obtain it using the following formula:

[0034] ;

[0035] In the formula, Fev represents the frequency of security events. Iev represents the time interval, and Iev represents the degree of impact of the event. These represent the frequency of security events (Fev) and the time interval, respectively. The weighting coefficients for the degree of impact of the event (Iev).

[0036] Preferably, the obtained risk characteristic value F risk The time series is divided into data subsets Xsub with different time windows, using one month as the time unit.

[0037] The data subset Xsub is obtained using the following formula:

[0038] ;

[0039] In the formula, Xsub represents the time interval t1, t2, ..., t n A subset within, containing the risk characteristic value F for each time period. risk ; This represents the risk characteristic value within the i-th time period.

[0040] Preferably, multiple influencing factors are used as independent variables to evaluate the risk characteristic value F. risk Perform multiple regression analysis to calculate the F-value of each independent variable on the risk eigenvalue. riskThe impact of these factors includes the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the peak network latency Ndelay, and the device failure trigger frequency Efail.

[0041] The formula for multiple regression is:

[0042] ;

[0043] In the formula, F risk (t) represents the risk characteristic value at time t. This represents the constant term in the regression equation. Indicates the error term. These represent the regression coefficients for device communication error rate Perr, traffic volatility coefficient Ffluc, peak network latency Ndelay, and device failure trigger frequency Efail, respectively.

[0044] Risk characteristic value F based on time t risk (t), extract the regression coefficients corresponding to the influencing factors, and obtain the risk trend coefficient Rte; use the risk trend coefficient Rte to predict the trend of risk changes in the future.

[0045] The risk trend coefficient Rte is obtained using the following formula:

[0046] ;

[0047] In the formula, This represents the derivative of the risk characteristic value with respect to time. Indicates within the time window The total number of security incidents that occurred within the premises Indicates the length of the time window. Represents the frequency of the i-th type of event. Indicates the time decay factor. Indicates an indicator function.

[0048] Preferably, dynamic risk assessment is performed using a dynamic threshold Td and the obtained risk trend coefficient Rte to obtain risk characteristic analysis results. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to changes in the risk environment.

[0049] The dynamic threshold Td is obtained using the following formula:

[0050] ;

[0051] in This represents the historical mean of the risk trend coefficient Rte. Rte represents the historical standard deviation of the risk trend coefficient, and L represents the adjustable safety factor.

[0052] Preferably, the obtained risk trend coefficient Rte is compared with the dynamic threshold Td to obtain the risk characteristic analysis results;

[0053] When the risk trend coefficient Rte > the dynamic threshold Td, the risk characteristic analysis result is considered abnormal.

[0054] When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified;

[0055] When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is considered qualified.

[0056] Preferably, when the risk characteristic analysis result is abnormal or unqualified, a safety alarm is automatically generated, and the current status and alarm information are recorded.

[0057] The alarm information BJ is obtained through the following formula:

[0058] ;

[0059] In the formula, time represents the specific time the alarm was generated, and the status information includes the traffic volatility coefficient Ffluc and the peak network latency Ndelay. risk This represents the risk characteristic value.

[0060] Preferably, based on the alarm information BJ, a report is generated by integrating risk trend changes, risk characteristic analysis results, and suggested protective measures. The risk trend changes include a description of the changes in the risk trend coefficient Rte relative to historical data. The risk characteristic analysis includes a comparison of the risk trend coefficient Rte with the dynamic threshold Td. The protective measures include specific protective measures proposed based on the current risk status.

[0061] This invention provides a data analysis-based method for assessing cybersecurity risks in industrial control systems, which has the following beneficial effects:

[0062] (1) This method uses a feature extraction algorithm to extract key risk indicators from a standard dataset, including the frequency of occurrence (Fev), the degree of impact (Iev), and the time interval of historical security events. The risk trend coefficient Rte is calculated through multiple regression analysis. This coefficient reflects the trend changes of potential security events, allowing for early identification of possible future risks. Combined with a dynamic risk assessment mechanism, a dynamic threshold Td is set. When the risk trend coefficient Rte exceeds this threshold, the system can automatically generate alerts and protective measure recommendations. This dynamic assessment method enables the system to automatically adjust its early warning mechanism based on real-time network changes, enhancing the flexibility and response speed to sudden network attacks and helping administrators take timely security measures.

[0063] Through big data analytics and dynamic risk assessment, this method can promptly identify potential risks and provide real-time warnings, significantly reducing the probability of security incidents. The entire process, from data acquisition to warning and report generation, is automated, reducing reliance on manual operation while improving processing speed and accuracy. By calculating the dynamic threshold Td in real time and generating alarms, the system can flexibly adjust to network changes, enhancing its ability to respond to sudden security incidents and ensuring the stability and security of the industrial control system.

[0064] (2) Machine learning algorithms were used to detect and remove outliers, ensuring data accuracy. Filtering and smoothing algorithms effectively reduced noise interference, making the data more stable. Missing data were filled using mean interpolation, ensuring the integrity of the dataset and avoiding the impact of insufficient data on the analysis results. Z-score standardization was used to unify the range of data values, eliminating scale differences between different features and making subsequent analysis more accurate. The standard dataset WB obtained after standardization achieved uniformity in the range of different feature values, ensuring the adaptability of subsequent machine learning algorithms and analysis models to the data. This not only improved the reliability of data analysis but also further enhanced the accuracy of prediction and trend analysis.

[0065] By combining real-time data acquisition from multiple sensors, comprehensive monitoring of the industrial control network's status is ensured, enhancing the ability to identify potential problems. Real-time transmission and standardized formatting of multi-source data resolve traditional issues of data loss and format inconsistencies, guaranteeing data integrity. From outlier detection and missing data imputation to data standardization, data accuracy and consistency are ensured, laying a solid foundation for subsequent analysis.

[0066] (3) By extracting the frequency of security events Fev and the time interval The method comprehensively analyzes the high frequency and density of security incidents, considering both the incident impact level (Iev) and the severity of the incident, and conducts a detailed assessment based on multidimensional factors affecting incident impact, including the number of devices, data loss, and downtime. Compared to traditional single-dimensional assessment methods, this method can reflect the risk of security incidents from multiple perspectives, effectively improving the accuracy of risk assessment and providing a reliable basis for identifying high-risk incidents. The risk characteristic value F... risk Segmenting according to the time series and applying the moving average method to F risk Trend analysis effectively identifies risk trends in security incidents. This dynamic assessment method tracks risk changes over different time periods. Compared to static analysis methods, this method can capture changes in security risks in a timely manner, especially in situations where high-risk events occur frequently. It helps to provide early warnings of potential future risks, improving the sensitivity and timeliness of risk warnings.

[0067] (4) Based on the risk trend coefficient Rte, by analyzing the risk characteristic value F risk Analyzing the changing trends of risks allows for the early identification of future risk shifts. This method considers not only current risks but also the frequency of events within a time window and time decay factors to ensure more accurate predictions. Compared to static risk analysis, dynamic risk trend prediction can identify potential risk trends in advance, helping managers take timely measures and improving the initiative and foresight of safety management.

[0068] The dynamic threshold Td is calculated by combining the historical mean, standard deviation, and safety factor L of the risk trend coefficient Rte, enabling adaptive adjustment based on actual risk changes. This dynamic threshold Td can adapt to risk fluctuations under different environments, dynamically adjusting risk warning standards and avoiding the problems of excessive or missed warnings caused by fixed thresholds. The introduction of adaptive thresholds improves the system's flexibility and responsiveness to risk control, allowing for timely adjustments to protective measures when risk levels change significantly. Through multiple regression analysis, the impact of each factor on risk is quantitatively calculated, improving the scientific rigor of risk assessment. Based on the risk trend coefficient Rte, future risk trends can be predicted, enhancing the forward-looking nature of safety management. The adaptive adjustment of the dynamic threshold Td enhances the system's flexibility in responding to different risk scenarios, ensuring the efficiency and accuracy of the early warning mechanism. Attached Figure Description

[0069] Figure 1 This is a schematic diagram illustrating the steps of a data analysis-based industrial control network security risk assessment method according to the present invention. Detailed Implementation

[0070] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0071] Example 1: This invention provides a data analysis-based method for assessing cybersecurity risks in industrial control systems. Please refer to [link / reference]. Figure 1 This includes the following steps:

[0072] Step 1: Collect historical and real-time security data through various sensors, logging systems, and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network latency peak Ndelay, and device failure trigger frequency Efail, to form a dataset W;

[0073] Step 2: Preprocess the collected dataset W, including removing outliers, denoising the data, imputing missing data, and standardizing the data to obtain the standard dataset WB;

[0074] Step 3: Extract risk indicators from the standard dataset WB using feature extraction algorithms, including the frequency of historical security incidents (Fev), the impact of the incidents (Iev), and the time interval. Obtain the risk characteristic value F risk ;

[0075] Step 4: Using big data analytics methods, analyze the extracted risk characteristic value F. risk Trend analysis is conducted to identify risk trends in security incidents, and the risk trend coefficient Rte is calculated using multiple regression analysis.

[0076] Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the obtained risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm.

[0077] Step Six: When the system generates an alarm, it will generate a security alert and automatically generate a report, which includes changes in risk trends, risk characteristic analysis results, and recommended protective measures.

[0078] In this embodiment, the method collects parameters such as device communication error rate (Perr), traffic fluctuation coefficient (Ffluc), peak network latency (Ndelay), and device failure trigger frequency (Efail) from multiple data sources including sensors, logging systems, and security devices, ensuring the comprehensiveness and accuracy of the data. This multi-dimensional data collection approach overcomes the limitations of traditional methods that rely solely on single-dimensional data for analysis, enabling a more comprehensive capture of potential risk factors in the network.

[0079] Data preprocessing steps ensure high-quality input data, including outlier removal, missing data imputation, and standardization. This eliminates the influence of noise and errors, making subsequent analysis more reliable. Standardizing the WB dataset avoids the processing complexities between different data types, effectively improving data consistency and analytical accuracy.

[0080] This method utilizes feature extraction algorithms to extract key risk indicators from standard datasets, such as the frequency (Fev), impact (Iev), and time interval of historical security incidents. The risk trend coefficient Rte is calculated through multiple regression analysis. This coefficient can reflect the trend changes of potential safety events and identify possible future risks in advance.

[0081] By combining a dynamic risk assessment mechanism and setting a dynamic threshold Td, the system can automatically generate alerts and protective measures recommendations when the risk trend coefficient Rte exceeds this threshold. This dynamic assessment method allows the system to automatically adjust the early warning mechanism based on real-time network changes, enhancing the flexibility and response speed to sudden network attacks and helping administrators to take timely measures for security protection.

[0082] Once a security risk is detected and exceeds a threshold, the system can automatically generate a report containing detailed risk trends, analysis results, and protective measures. This automated report generation mechanism significantly reduces the time required for manual analysis, improves the efficiency of risk response, and provides managers with timely and accurate decision support, helping them to more effectively protect cybersecurity.

[0083] Through big data analytics and dynamic risk assessment, this method can promptly identify potential risks and provide real-time warnings, significantly reducing the probability of security incidents. The entire process, from data acquisition to warning and report generation, is automated, reducing reliance on manual operation while improving processing speed and accuracy. By calculating the dynamic threshold Td in real time and generating alarms, the system can flexibly adjust to network changes, enhancing its ability to respond to sudden security incidents and ensuring the stability and security of the industrial control system.

[0084] Example 2 is an explanation of Example 1. Please refer to the example provided. Figure 1 Specifically: Identify and connect various sensors, logging systems and security devices in the network, and obtain data from the devices via the SNMP network protocol, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network latency peak Ndelay and device failure trigger frequency Efail;

[0085] The various sensors include communication error sensors, network traffic sensors, network latency sensors, and equipment fault sensors. The communication error sensor collects the equipment communication error rate Perr, the network traffic sensor collects the traffic fluctuation coefficient Ffluc, the network latency sensor collects the network latency peak Ndelay, and the equipment fault sensor collects the equipment fault trigger frequency Efail.

[0086] Real-time and historical data acquired from various devices are transmitted to a central processing system, which converts the data from different sources into a unified format to form dataset W.

[0087] Outliers are detected and removed by using machine learning algorithms, and noise is reduced and removed by using filtering and smoothing algorithms.

[0088] Missing data can be filled using mean interpolation. The formula for mean interpolation is as follows:

[0089] ;

[0090] In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data points;

[0091] The dataset W is standardized by using the Z-score standardization method to unify the value range of different features and obtain the standard dataset WB.

[0092] In this embodiment, multiple key parameters are collected in real time from different devices using the SNMP network protocol, including the device communication error rate (Perr), traffic fluctuation coefficient (Ffluc), peak network latency (Ndelay), and device failure trigger frequency (Efail). These parameters are monitored by dedicated sensors, ensuring the accuracy and comprehensiveness of the collected data.

[0093] Strict transmission safeguards were implemented during the data transfer from various devices to the central processing system to prevent data loss and distortion. Simultaneously, by converting data from different sources into a unified format to form dataset W, the integration challenges arising from inconsistencies among multi-source data were resolved. This ensures data consistency and standardized processing in subsequent stages, making the analysis more reliable.

[0094] This method employs a systematic preprocessing approach for the data, including outlier detection and removal, noise removal and smoothing, missing data imputation, and data standardization. Machine learning algorithms are used to detect and remove outliers, ensuring data accuracy. Filtering and smoothing algorithms effectively reduce noise interference, making the data more stable. Missing data is imputed using mean interpolation, ensuring dataset integrity and preventing the impact of insufficient data on the analysis results. Z-score standardization is used to unify the range of data values, eliminating scale differences between different features and making subsequent analysis more accurate. The standard dataset WB obtained after standardization achieves uniformity across the range of different feature values, ensuring the adaptability of subsequent machine learning algorithms and analysis models to the data. This not only improves the reliability of data analysis but also further enhances the accuracy of prediction and trend analysis.

[0095] Example 3 is an explanation of Example 2. Please refer to the example provided. Figure 1 Specifically: extract timestamps related to security events from the standard dataset WB, count the number of security events that occur within a certain time window, and obtain the frequency of occurrence of security events Fev;

[0096] The frequency of occurrence of the security event, Fev, is obtained using the following formula:

[0097] ;

[0098] In the formula, This represents the total number of security events that occurred within the time window; This indicates the length of the time window, with the length setting including a one-month period.

[0099] Calculate the time interval between consecutive security events The time interval Obtain it using the following formula;

[0100] ;

[0101] In the formula, This represents the time interval between the i-th event and the (i+1)-th event. This represents the timestamp of the i-th event. This represents the timestamp of the (i+1)th event;

[0102] Based on the scope of impact of each event, including the number of affected devices. Data loss and downtime A comprehensive assessment of the impact of the event (Iev);

[0103] The impact level Iev of the event is obtained using the following formula:

[0104] ;

[0105] In the formula, Indicates the number of affected devices. Indicates the amount of data lost. Indicates the downtime caused by the event. These represent the number of affected devices. Data loss and downtime The preset weight value;

[0106] By analyzing the frequency (Fev) and time intervals of historical security incidents... It identifies high-frequency and intensive events, and based on multidimensional factors of event impact, provides a basis for prioritizing the handling of high-risk events according to the degree of event impact (Iev), and obtains risk characteristic values ​​(F). risk ;

[0107] The risk characteristic value F risk Obtain it using the following formula:

[0108] ;

[0109] In the formula, Fev represents the frequency of security events. Iev represents the time interval, and Iev represents the degree of impact of the event. These represent the frequency of security events (Fev) and the time interval, respectively. The weighting coefficients for the degree of impact of the event (Iev).

[0110] The obtained risk characteristic value F risk The time series is divided into data subsets Xsub with different time windows, using one month as the time unit.

[0111] The data subset Xsub is obtained using the following formula:

[0112] ;

[0113] In the formula, Xsub represents the time interval t1, t2, ..., t n A subset within, containing the risk characteristic value F for each time period. risk ; This represents the risk characteristic value within the i-th time period.

[0114] In this embodiment, the occurrence frequency Fev and time interval of security events are extracted. The method comprehensively analyzes the high frequency and density of security incidents, considering both the incident impact level (Iev) and the severity of the incident, and conducts a detailed assessment based on multidimensional factors affecting incident impact, including the number of devices, data loss, and downtime. Compared to traditional single-dimensional assessment methods, this method can reflect the risk of security incidents from multiple perspectives, effectively improving the accuracy of risk assessment and providing a reliable basis for identifying high-risk incidents. The risk characteristic value F... risk Segmenting according to the time series and applying the moving average method to F risk Trend analysis effectively identifies risk trends in security incidents. This dynamic assessment method tracks risk changes over different time periods. Compared to static analysis methods, this method can capture changes in security risks in a timely manner, especially in situations where high-risk events occur frequently. It helps to provide early warnings of potential future risks, improving the sensitivity and timeliness of risk warnings.

[0115] Based on the frequency of security incidents (Fev), the degree of impact of the incidents (Iev), and the time interval. The system can automatically identify high-frequency, intensive events and categorize them according to the risk characteristic value F. risk This prioritization process provides a basis for prioritizing tasks. This method effectively reduces misjudgments and delays caused by traditional reliance on manual judgment, improves the efficiency of managers in handling high-risk events, ensures the rational allocation of resources, helps in the early development of protective measures, and reduces safety hazards.

[0116] Multiple features of security events were extracted, including the frequency of occurrence (Fev), the degree of impact (Iev), and the time interval. This system quantifies security incidents from multiple dimensions, improving the accuracy of risk analysis. By identifying risk trends through time-series analysis, it can monitor changes in potential risks in a timely manner, providing more timely early warning information. A risk-characteristic-based priority processing mechanism automatically identifies and classifies high-risk events, reducing human judgment errors and improving the efficiency of responding to sudden security incidents.

[0117] Example 4 is an explanation of Example 3. Please refer to the example provided. Figure 1 Specifically: using multiple influencing factors as independent variables to evaluate the risk characteristic value F. risk Perform multiple regression analysis to calculate the F-value of each independent variable on the risk eigenvalue. risk The impact of these factors includes the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the peak network latency Ndelay, and the device failure trigger frequency Efail.

[0118] The formula for multiple regression is:

[0119] ;

[0120] In the formula, F risk (t) represents the risk characteristic value at time t. This represents the constant term in the regression equation. Indicates the error term. These represent the regression coefficients for device communication error rate Perr, traffic volatility coefficient Ffluc, peak network latency Ndelay, and device failure trigger frequency Efail, respectively.

[0121] Risk characteristic value F based on time t risk (t), extract the regression coefficients corresponding to the influencing factors, and obtain the risk trend coefficient Rte; use the risk trend coefficient Rte to predict the trend of risk changes in the future.

[0122] The risk trend coefficient Rte is obtained using the following formula:

[0123] ;

[0124] In the formula, This represents the derivative of the risk characteristic value with respect to time. Indicates within the time window The total number of security incidents that occurred within the premises Indicates the length of the time window. Represents the frequency of the i-th type of event. Indicates the time decay factor. Indicates an indicator function.

[0125] Dynamic risk assessment is performed by using a dynamic threshold Td and the obtained risk trend coefficient Rte to obtain risk characteristic analysis results. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to changes in the risk environment.

[0126] The dynamic threshold Td is obtained using the following formula:

[0127] ;

[0128] in This represents the historical mean of the risk trend coefficient Rte. Rte represents the historical standard deviation of the risk trend coefficient, and L represents the adjustable safety factor.

[0129] In this embodiment, by using the device communication error rate Perr, traffic volatility coefficient Ffluc, network latency peak Ndelay, and device failure trigger frequency Efail as independent variables, a multiple regression analysis can be performed to quantify the impact of these key factors on the risk characteristic value F. risk This has contributed to improving the accuracy and reliability of risk assessment, enabling it to better reflect the cumulative impact of various factors on risks in complex network environments.

[0130] Based on the risk trend coefficient Rte, the risk characteristic value F is analyzed. risk Analyzing the changing trends of risks allows for the early identification of future risk shifts. This method considers not only current risks but also the frequency of events within a time window and time decay factors to ensure more accurate predictions. Compared to static risk analysis, dynamic risk trend prediction can identify potential risk trends in advance, helping managers take timely measures and improving the initiative and foresight of safety management.

[0131] The dynamic threshold Td is calculated by combining the historical mean and standard deviation of the risk trend coefficient Rte with the safety factor L, enabling adaptive adjustment based on actual risk changes. This dynamic threshold Td can adapt to risk fluctuations under different environments, dynamically adjusting risk warning standards and avoiding the problems of excessive or missed warnings caused by fixed thresholds. The introduction of adaptive thresholds improves the system's flexibility and responsiveness to risk control, allowing for timely adjustments to protective measures when risk levels change significantly.

[0132] Example 5 is an explanation of Example 4. Please refer to the example provided. Figure 1 Specifically: compare the obtained risk trend coefficient Rte with the dynamic threshold Td to obtain the risk characteristic analysis results;

[0133] When the risk trend coefficient Rte > the dynamic threshold Td, the risk characteristic analysis result is considered abnormal.

[0134] When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified;

[0135] When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is considered qualified.

[0136] When the risk characteristic analysis results are abnormal or unqualified, a safety alarm is automatically generated, and the current status and alarm information are recorded.

[0137] The alarm information BJ is obtained through the following formula:

[0138] ;

[0139] In the formula, time represents the specific time the alarm was generated, and the status information includes the traffic volatility coefficient Ffluc and the peak network latency Ndelay. risk This represents the risk characteristic value.

[0140] Based on the alert information BJ, integrate the risk trend changes, risk characteristic analysis results, and recommended protective measures to generate a report. The risk trend changes include a description of the changes in the risk trend coefficient Rte relative to historical data. The risk characteristic analysis includes a comparison of the risk trend coefficient Rte with the dynamic threshold Td. The protective measures include specific protective measures proposed based on the current risk status.

[0141] Risk Trend Changes: The report will describe in detail how the risk trend coefficient Rte has changed over a period of time, including: Time Period: The set analysis period, such as the past month or a quarter.

[0142] List the specific values ​​of Rte at each time point, draw a curve to visualize the rise or fall of risk trends; calculate the rate of change of Rte to help identify trends of accelerating or slowing risk.

[0143] By comparing the current RTE with historical data, it can be determined whether the current risk trend is within the normal range or whether abnormal fluctuations have occurred.

[0144] Risk Characteristic Analysis: The report will analyze the relationship between the risk trend coefficient Rte and the dynamic threshold Td: Comparison of risk trend coefficient Rte and dynamic threshold Td: The current values ​​of risk trend coefficient Rte and dynamic threshold Td are clearly listed, as well as the difference between the two.

[0145] Risk level determination: Based on the comparison results, the current risk status is determined: High risk status: If the risk trend coefficient Rte > dynamic threshold Td, it means that the risk is rising and exceeds the warning line, and measures must be taken immediately.

[0146] Alert status: If the risk trend coefficient Rte = dynamic threshold Td, it means that the risk is close to the threshold and monitoring needs to be strengthened.

[0147] Controllable status: If the risk trend coefficient Rte < dynamic threshold Td, it indicates that the risk is within a controllable range, and monitoring can continue.

[0148] Recommended protective measures: Based on the analysis of the current risk status, provide practical and feasible protective measures: High-risk status: Immediate response: Activate the emergency response plan and organize relevant technical teams to investigate and handle the situation.

[0149] Enhance monitoring: Increase the frequency of system monitoring and deploy additional security detection tools.

[0150] Restrict access: Temporarily restrict access to critical systems to prevent the spread of potential security incidents.

[0151] Alert Status: Continuous Monitoring: Maintain high-frequency monitoring, record relevant network activities, and update risk status in a timely manner.

[0152] Regular assessment: Develop a regular risk assessment plan to ensure dynamic tracking of risk levels.

[0153] Optimization Strategy: Based on historical data analysis, gradually optimize the protection strategy to reduce potential future risks.

[0154] Regular checks: Regularly check the security status of the system to ensure that no new hidden dangers arise.

[0155] In this embodiment, by comparing the risk trend coefficient Rte with the dynamic threshold Td in real time, it is possible to accurately determine whether the current network risk exceeds the warning line. This mechanism can immediately trigger an alarm when the risk growth rate exceeds the set threshold, ensuring that managers can quickly respond to potential security threats, enhancing the system's agility and response speed, and avoiding the problem of delayed early warning in traditional risk assessment methods. This method sets three different risk states: "exceeding the threshold," "approaching the threshold," and "below the threshold," providing corresponding countermeasures for different risk levels. Managers can choose different protection strategies based on the current risk state, such as taking immediate action or strengthening monitoring. This multi-level monitoring mechanism ensures refined system management, enabling security measures to be progressively escalated according to the severity of the risk.

[0156] When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system can automatically generate a security alert and record the current network status, device health status, and risk characteristic value F. risk This generates detailed alarm information (BJ). This information records key security parameters, facilitating subsequent analysis and event tracing, and helping managers quickly understand the current security situation and make appropriate decisions. Based on the generated alarm information (BJ), the system further integrates risk trend changes, historical data analysis, and protective measures to automatically generate detailed security risk reports. These reports not only describe current risk changes but also provide in-depth analysis based on historical event data and offer targeted protective measure recommendations. Through these reports, managers can obtain a more comprehensive overview of the risks, improving the scientific and targeted nature of their decisions and optimizing resource allocation and the formulation of protection strategies.

[0157] By comparing the risk trend coefficient Rte with the dynamic threshold Td in real time, more accurate risk warnings are achieved, improving the response efficiency of security incidents. The tiered processing mechanism under different risk states ensures that the system can take appropriate measures as risks gradually increase, reducing the incidence of security incidents. Automatic generation and detailed recording of alarm information BJ facilitates post-incident analysis and improvement, enhancing the automation level of security management. The automatic generation of reports on risk trends, historical analysis, and protection recommendations provides managers with comprehensive decision support, helping them to more effectively address complex cybersecurity risks.

[0158] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data analysis-based method for assessing cybersecurity risks in industrial control systems, characterized in that: Includes the following steps: Step 1: Collect historical and real-time security data through various sensors, logging systems, and security devices in the network, including device communication error rate Perr, traffic fluctuation coefficient Ffluc, network latency peak Ndelay, and device failure trigger frequency Efail, to form a dataset W; Step 2: Preprocess the collected dataset W, including removing outliers, denoising the data, imputing missing data, and standardizing the data to obtain the standard dataset WB; Step 3: Extract risk indicators from the standard dataset WB using feature extraction algorithms, including the frequency of historical security incidents (Fev), the impact of the incidents (Iev), and the time interval. Obtain risk characteristic values ; Extract timestamps related to security events from the standard dataset WB, count the number of security events that occur within a certain time window, and obtain the frequency of security events Fev; The frequency of occurrence of the security event, Fev, is obtained using the following formula: In the formula This represents the total number of security events that occurred within the time window; Indicates the length of the time window; Calculate the time interval between consecutive security events The time interval Obtain it using the following formula; ； In the formula, This represents the time interval between the i-th event and the (i+1)-th event. This represents the timestamp of the i-th event. This represents the timestamp of the (i+1)th event; Based on the scope of impact of each event, including the number of affected devices. Data loss and downtime The overall impact level of the event, Iev, is assessed using the following formula: ； In the formula, Indicates the number of affected devices. Indicates the amount of data lost. Indicates the downtime caused by the event. , and , representing the number of affected devices respectively. Data loss and downtime The preset weight value; By analyzing the frequency (Fev) and time intervals of historical security incidents... It identifies high-frequency and intensive events, and based on multidimensional factors of event impact, provides a basis for prioritizing the handling of high-risk events according to the degree of event impact (Iev), and obtains risk characteristic values. The risk characteristic value Obtain it using the following formula: ; In the formula, Fev represents the frequency of security events. Iev represents the time interval, and Iev represents the degree of impact of the event. , and These represent the frequency of security events (Fev) and the time interval, respectively. ; The weighting coefficients for the degree of impact of the event (Iev); Step 4: Using big data analytics methods, analyze the extracted risk characteristic values. Trend analysis is conducted to identify risk trends in security incidents, and risk trend coefficients are calculated using multiple regression analysis. Multiple regression analysis was performed using multiple influencing factors as independent variables on the risk eigenvalue Fak, and the risk eigenvalue for each independent variable was calculated. The impact of these factors includes the device communication error rate Perr, the traffic fluctuation coefficient Ffluc, the peak network latency Ndelay, and the device failure trigger frequency Efail. The formula for multiple regression is: ； In the formula, This represents the risk characteristic value at time t. G represents the constant term in the regression equation, and G represents the error term. , , and These represent the regression coefficients for device communication error rate Perr, traffic volatility coefficient Ffluc, peak network latency Ndelay, and device failure trigger frequency Efail, respectively; and the risk characteristic value based on time t. The regression coefficients corresponding to the influencing factors are extracted to obtain the risk trend coefficient Rte; the risk trend coefficient Rte is used to predict the risk trend over a future period; the risk trend coefficient Rte is obtained by the following formula: ; In the formula, This represents the derivative of the risk characteristic value with respect to time. Indicates within the time window The total number of security incidents that occurred within the premises Indicates the length of the time window. Let λ represent the frequency of the i-th type of event, and λ represent the time decay factor. Indicates an indicator function; Step 5: Perform dynamic risk assessment using the dynamic threshold Td and the obtained risk trend coefficient Rte. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm. Dynamic risk assessment is performed using a dynamic threshold Td and the acquired risk trend coefficient Rte to obtain risk characteristic analysis results. When the risk trend coefficient Rte exceeds the dynamic threshold Td, the system generates an alarm to adapt to changes in the risk environment. The dynamic threshold Td is obtained using the following formula: ; in, This represents the historical mean of the risk trend coefficient Rte. Rte represents the historical standard deviation of the risk trend coefficient, and L represents the adjustable safety factor. Step Six: When the system generates an alarm, it will generate a security alert and automatically generate a report, which includes changes in risk trends, risk characteristic analysis results, and recommended protective measures. The system identifies and connects various sensors, logging systems, and security devices in the network. It acquires data from these devices via the SNMP network protocol, including device communication error rate (Perr), traffic fluctuation coefficient (Ffluc), peak network latency (Ndelay), and device fault trigger frequency (Efail). These sensors include communication error sensors, network traffic sensors, network latency sensors, and device fault sensors. The communication error sensor collects the device communication error rate (Perr), the network traffic sensor collects the traffic fluctuation coefficient (Ffluc), the network latency sensor collects the peak network latency (Ndelay), and the device fault sensor collects the device fault trigger frequency (Efail). Real-time and historical data acquired from each device are transmitted to a central processing system, where data from different sources is converted into a unified format to form a dataset W. Outliers are detected and removed using machine learning algorithms; noise is reduced and removed using filtering and smoothing algorithms; and missing data is filled using mean interpolation, the formula for which is as follows: ; In the formula, Wi represents missing data points, Wj represents non-missing data points, and n represents the number of non-missing data points; The dataset w was standardized by using the Z-score standardization method to unify the value range of different features and obtain the standard dataset WB. The acquired risk characteristic values The time series is divided into data subsets Xsub with different time windows, using one month as the time unit; the data subset Xsub is obtained using the following formula: ; In the formula, Indicates the time period , ,…, A subset within, containing risk characteristic values ​​for each time period. ; This represents the risk characteristic value within the i-th time period.

2. The industrial control network security risk assessment method based on data analysis according to claim 1, characterized in that: Compare the obtained risk trend coefficient Rte with the dynamic threshold Td to obtain the risk characteristic analysis results; When the risk trend coefficient Rte > the dynamic threshold Td, the risk characteristic analysis result is considered abnormal. When the risk trend coefficient Rte = dynamic threshold Td, the risk characteristic analysis result is unqualified. When the risk trend coefficient Rte is less than the dynamic threshold Td, the risk characteristic analysis result is considered qualified.

3. The method for assessing industrial control network security risks based on data analysis according to claim 2, characterized in that: When the risk characteristic analysis result is abnormal or unqualified, a safety alarm is automatically generated, and the current status and alarm information BJ are recorded; the alarm information BJ is obtained through the following formula: ; In the formula, time represents the specific time the alarm was generated, and the status information includes the traffic volatility coefficient Ffuc and the peak network latency Ndelay. This represents the risk characteristic value.

4. The industrial control network security risk assessment method based on data analysis according to claim 3, characterized in that: Based on the alert information BJ, integrate the risk trend changes, risk characteristic analysis results, and recommended protective measures to generate a report. The risk trend changes include a description of the changes in the risk trend coefficient Rte relative to historical data. The risk characteristic analysis includes a comparison of the risk trend coefficient Rte with the dynamic threshold Td. The protective measures include specific protective measures proposed based on the current risk status.

Images