Attack and defense simulation drill control and evaluation system for electric power monitoring system

Abstract

The invention belongs to the technical field of network security, and particularly relates to a power monitoring system attack and defense simulation drill control and evaluation system which comprises a drill platform construction module, an attack system configuration module, a defense system configuration module, a data acquisition module and an evaluation module. The drilling platform construction module is used for constructing an attack and defense drilling platform; the attack system configuration module is used for designing an attack strategy; a defense strategy is dynamically adjusted to adapt to an attack strategy, drilling is carried out based on the attack strategy and the defense strategy, a drilling result is finally output, an evaluation result is output according to drilling data collected in the drilling process, and the defects of an attacker and a defender are represented through the evaluation result. Therefore, the attack capability of the attack system configuration module and the defense capability of the defense system configuration module are effectively checked, vulnerabilities and weaknesses of the platform are found, and attack means and defense strategies are improved based on the vulnerabilities and weaknesses, so that the network security defense capability is improved, and the network security is guaranteed.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular is an attack and defense simulation exercise control and evaluation system for an electric power monitoring system. Background Art

[0002] The basic framework of network security attack and defense involves a constant contest between attackers and defenders, forming a dynamic and complex game model. In this model, attackers use different means to find system vulnerabilities and try to break through the defense line, while defenders need to identify, prevent and respond to these attacks. Through the analysis of the results of the game, the attackers and defenders can be evaluated and analyzed at a deeper level, providing a basis for the formulation of network security strategies based on the game between attackers and defenders;

[0003] Based on the above, relevant institutions have established a relatively complete network security training system at this stage, covering aspects such as network topology construction, attack and defense practice; the platform can simulate and detect various attacks in the network, and provide real-time defense strategies, simulate multiple network attacks, simulate scenario-based network attacks, and provide corresponding defense strategies. However, there are still problems such as insufficient training resources and lack of practicality, which require more in-depth and broad research to solve; at the same time, the simulation results cannot digitize the deficiencies of both the attack and defense ends.

[0004] To this end, the present invention provides an attack and defense simulation exercise control and evaluation system for an electric power monitoring system. Summary of the invention

[0005] In order to make up for the deficiencies of the prior art, at least one technical problem raised in the background technology is solved.

[0006] The technical solution adopted by the present invention to solve the technical problem is: a power monitoring system attack and defense simulation exercise control and evaluation system described in the present invention comprises:

[0007] The drill platform construction module is used to build an attack and defense drill platform;

[0008] Attack system configuration module, used to design attack strategies;

[0009] Defense system configuration module, used to automatically adjust defense strategies;

[0010] Data collection module, used to collect exercise data of the attack and defense exercise platform;

[0011] The evaluation module outputs the evaluation results based on the exercise data.

[0012] Preferably, the method for the exercise platform construction module to construct the attack and defense exercise platform is:

[0013] Technology selection: select simulation technology suitable for the network environment based on research;

[0014] Platform structure design, based on research and technical options, determine the design parameters that make up the platform;

[0015] Platform construction: design and build a platform that meets the simulated business needs, and set up typical vulnerabilities based on historical data;

[0016] Business simulation, design simulated business based on the built platform.

[0017] Preferably, the method for the attack system configuration module to design an attack strategy is:

[0018] Obtain typical attack methods from historical data;

[0019] Form attack strategies based on typical attack methods;

[0020] The attack means include malware propagation, network intrusion and social engineering attack, and the attack strategy is one or more combinations of malware propagation, network intrusion and social engineering attack.

[0021] Preferably, the defense system configuration module includes a resource allocation model, and the resource allocation model is used to calculate the optimal defense strategy;

[0022] The resource allocation model is constructed as follows:

[0023] Get the vulnerability level of the attack and defense drill platform. The vulnerability level represents the risk level of the i-th subsystem, represented by v i express;

[0024] The decision variable is the safety investment for each subsystem, expressed as x i express;

[0025] x i ≥0

[0026] As the security investment in each subsystem increases, the resource benefit function gradually saturates, that is:

[0027]

[0028] Resource constraints ensure that the total investment does not exceed the resources that the enterprise can afford, that is,

[0029]

[0030] Among them, B is the total resource constraint;

[0031] The optimization goal is to maximize overall security under given resources. By solving the optimization, resources are allocated to subsystems under given resources to achieve maximum overall security, which can be expressed as follows:

[0032]

[0033] Based on the above formula, the optimal defense strategy is calculated.

[0034] Preferably, the method for constructing the resource allocation model further includes:

[0035] Build resource allocation models for different needs based on actual conditions;

[0036] Based on the dependency relationship between subsystems, the association matrix A is introduced. ij , where A ij It represents the impact of investing in the ith subsystem on the security of the jth subsystem. The updated model is:

[0037]

[0038] Among them, x i 、x j The correlation matrix A is ij The rows and columns in ;

[0039] Based on the different repair costs of different vulnerabilities, the weight of the repair cost w is introduced i , and further update the model as:

[0040]

[0041] Based on the fact that safety benefits will change over time, the introduction of time variable t affects safety investment x. i The time series changes, further update the model as follows:

[0042]

[0043] According to the criticality of the subsystem to the core business, the criticality weight K is introduced. i , where K i represents the critical weight of the i-th subsystem, and the model is further updated as follows:

[0044]

[0045] Based on resource allocation models with different requirements, the optimal defense strategy is solved using any resource allocation model.

[0046] Preferably, the drill data of the attack and defense drill platform collected by the data collection module includes a defense success index ACI, a vulnerability repair efficiency index VRE, a system recovery time index SRTI, and a resource allocation rationality index RARI;

[0047] The calculation method of the defense success index ACI is:

[0048] Get the number of successful attacks S a And the total number of attacks S All ;

[0049] The defense success index ACI is calculated according to the formula:

[0050] ACI=(1-S a / S All )

[0051] The calculation method of the vulnerability repair efficiency index VRE is:

[0052] Get the cost of fixing a single vulnerability C i ;

[0053] Calculate the average repair cost C based on the repair cost of a single vulnerability avg ;

[0054] The vulnerability repair efficiency index VRE is calculated according to the formula:

[0055] VRE=∑(1-C i / C avg )

[0056] The calculation method of the system recovery time index SRTI is:

[0057] Get the system recovery time T after each successful attack i ;

[0058] Calculate the average recovery time T based on each recovery time avg ;

[0059] The system recovery time index SRTI is calculated according to the formula:

[0060] SRTI=1 / (1+T avg )

[0061] The calculation method of the resource allocation rationality index RARI is:

[0062] Get the actual ratio P of resource allocation between each subsystem i With ideal ratio I i ;

[0063] The resource allocation rationality index RARI is calculated according to the formula:

[0064]

[0065] Based on the formula, the defense success index ACI, vulnerability repair efficiency index VRE, system recovery time index SRTI, and resource allocation rationality index RARI are calculated respectively.

[0066] Preferably, the method by which the evaluation module outputs the evaluation result according to the exercise data is:

[0067] Obtain drill data and pre-process the drill data;

[0068] Assign weights to each indicator; the indicators are used to characterize various parameters in the exercise data, including the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI;

[0069] A comprehensive score is calculated based on each indicator and its corresponding weight to obtain a comprehensive score, which is then output as the evaluation result.

[0070] Preferably, the method for calculating the comprehensive score according to each indicator and the corresponding weight is:

[0071] Get the preset weight of each indicator;

[0072] According to the formula:

[0073] Q=ACI×α+VRE×β+SRTI×γ+RARI×δ

[0074] Among them, Q is the comprehensive score, α, β, γ and δ are the weights of the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI, respectively, and the value range of α, β, γ and δ is 0 to 1, and α+β+γ+δ=1.

[0075] Preferably, the evaluation module further includes a feedback unit, and the feedback unit is used to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results.

[0076] Preferably, the method for the feedback unit to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results is:

[0077] Obtain a comprehensive score and make a balance judgment based on the comprehensive score;

[0078] When the comprehensive score is lower than the preset threshold, it means that the defense strategy output based on the resource allocation model is not effective, and an instruction to modify the resource allocation model parameters is output;

[0079] When the comprehensive score is not lower than the preset threshold, it means that the attack strategy is not effective, and an instruction to modify the attack strategy is output.

[0080] The beneficial effects of the present invention are as follows:

[0081] The attack and defense simulation drill control and evaluation system of the power monitoring system described in the present invention dynamically adjusts the defense strategy to adapt to the attack strategy, conducts drills based on the attack strategy and the defense strategy, and finally outputs the drill results. It also outputs the evaluation results based on the drill data collected during the drill, and characterizes the deficiencies of the attacker and the defender through the evaluation results, thereby effectively testing the attack capability of the attack system configuration module and the defense capability of the defense system configuration module, and discovering the loopholes and weaknesses of the platform, based on which the attack means and defense strategies are improved, thereby improving the network security defense capability and ensuring network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] The present invention will be further described below in conjunction with the accompanying drawings.

[0083] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0084] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0085] like Figure 1 As shown, an attack and defense simulation drill control and evaluation system for an electric power monitoring system described in an embodiment of the present invention includes an exercise platform construction module, an attack system configuration module, a defense system configuration module, a data acquisition module and an evaluation module; the exercise platform construction module is used to construct an attack and defense drill platform; the attack system configuration module is used to design attack strategies; the defense system configuration module is used to automatically adjust defense strategies; the data acquisition module is used to collect exercise data of the attack and defense drill platform; and the evaluation module is used to output evaluation results based on the exercise data.

[0086] Based on the above, in one embodiment of the present invention, based on the construction of the drill platform, it can provide a basis for the formulation of network security strategies. The attacker and defender can conduct game drills of attackers and defenders in the virtual drill platform, so as to output corresponding evaluation results according to the final game results, so as to achieve the improvement of network security. Specifically, after the drill platform is built, the attacker and defender respectively formulate corresponding attack strategies and defense strategies based on the attack system configuration module and the defense system configuration module. It is worth noting that each time the simulation drill is carried out, the defense strategy can be automatically adjusted according to the attack strategy. Specifically, the defense strategy is dynamically adjusted to adapt to the attack strategy, and drills are carried out based on the attack strategy and the defense strategy. Finally, the drill results are output, and the evaluation results are output according to the drill data collected during the drill. The deficiencies of the attacker and the defender are characterized by the evaluation results, so as to effectively test the attack capability of the attack system configuration module and the defense capability of the defense system configuration module, and discover the loopholes and weaknesses of the platform, based on which the attack means and defense strategies are improved, thereby improving the network security defense capability and ensuring network security.

[0087] In one embodiment, the method for the exercise platform construction module to construct the attack and defense exercise platform is:

[0088] Technology selection: select simulation technology suitable for the network environment based on research;

[0089] Platform structure design, based on research and technical options, determine the design parameters that make up the platform;

[0090] Platform construction: design and build a platform that meets the simulated business needs, and set up typical vulnerabilities based on historical data;

[0091] Business simulation, design simulated business based on the built platform.

[0092] In one embodiment, the method for designing the attack strategy by the attack system configuration module is:

[0093] Obtain typical attack methods from historical data;

[0094] Form attack strategies based on typical attack methods;

[0095] The attack means include malware propagation, network intrusion and social engineering attack, and the attack strategy is one or more combinations of malware propagation, network intrusion and social engineering attack.

[0096] In one embodiment, the defense system configuration module includes a resource allocation model, and the resource allocation model is used to calculate the optimal defense strategy;

[0097] The resource allocation model is constructed as follows:

[0098] Get the vulnerability level of the attack and defense drill platform. The vulnerability level represents the risk level of the i-th subsystem, represented by v i express;

[0099] The decision variable is the safety investment for each subsystem, expressed as x i express;

[0100] x i ≥0

[0101] As the security investment in each subsystem increases, the resource benefit function gradually saturates, that is:

[0102]

[0103] Resource constraints ensure that the total investment does not exceed the resources that the enterprise can afford, that is,

[0104]

[0105] Among them, B is the total resource constraint;

[0106] The optimization goal is to maximize overall security under given resources. By solving the optimization, resources are allocated to subsystems under given resources to achieve maximum overall security, which can be expressed as follows:

[0107]

[0108] Based on the above formula, the optimal defense strategy is calculated.

[0109] Based on the above, the defense system configuration module can automatically adjust the defense strategy according to the attack strategy. It can be understood that in the platform, an initial defense strategy is set. When an attack behavior is detected, the defense strategy can be automatically adjusted according to the occurrence of the attack behavior, the typical vulnerabilities set when the platform is built, and the pre-set security investment for each subsystem; specifically, according to the pre-set vulnerability level and the pre-set security investment for each subsystem, when an attack behavior is detected, resources are automatically allocated to each subsystem to ensure that the attack behavior will not cause substantial damage to the subsystem. For example:

[0110] Suppose we have a power monitoring system consisting of three subsystems:

[0111] SCADA system (subsystem 1): responsible for data collection and monitoring.

[0112] EMS system (subsystem 2): responsible for the energy management system.

[0113] DMS system (subsystem 3): responsible for the power distribution management system.

[0114] Each subsystem has different vulnerabilities, and the vulnerability levels are:

[0115] SCADA system: High (v1=3)

[0116] EMS system: Medium (v2=2)

[0117] DMS system: low (v3=1)

[0118] A total of 1 million yuan is available for safe investment, that is, B=100.

[0119] First, we use the most basic resource allocation model, which does not consider the dependencies between subsystems, repair costs, time factors, and criticality.

[0120] The objective function is expressed as:

[0121]

[0122] Constraints:

[0123] x1+x2+x3≤100

[0124] By solving this model, we can obtain the optimal safety investment amount allocated to each subsystem and the corresponding safety benefit.

[0125] In one embodiment, the method for constructing the resource allocation model further includes:

[0126] Build resource allocation models for different needs based on actual conditions;

[0127] Based on the dependency relationship between subsystems, the association matrix A is introduced. ij , where A ij It represents the impact of investing in the ith subsystem on the security of the jth subsystem. The updated model is:

[0128]

[0129] Among them, x i 、x j The correlation matrix A is ij The rows and columns in ;

[0130] Based on the different repair costs of different vulnerabilities, the weight of the repair cost w is introduced i , and further update the model as:

[0131]

[0132] Based on the fact that safety benefits will change over time, the introduction of time variable t affects safety investment x. i The time series changes, further update the model as follows:

[0133]

[0134] According to the criticality of the subsystem to the core business, the criticality weight K is introduced. i , where K i represents the critical weight of the i-th subsystem, and the model is further updated as follows:

[0135]

[0136] Based on resource allocation models with different requirements, the optimal defense strategy is solved using any resource allocation model.

[0137] Based on the above, after determining the resource allocation model, in addition to setting security investment for each subsystem and calculating the defense strategy according to the vulnerability level, it is also necessary to consider many factors that may cause loopholes in the defense strategy, for example:

[0138] Assuming that there is a dependency relationship between the SCADA system and the EMS system, the vulnerability repair of the SCADA system will affect the security of the EMS system. We can introduce the correlation matrix A ij :

[0139]

[0140] In this association matrix, the first row indicates that subsystem 1 does not depend on any other subsystem (0 in the first column), but subsystem 2 depends on subsystem 1 (1 in the second column), and subsystem 3 has no direct dependency on subsystem 1 (0 in the third column).

[0141] The second and third rows are all zeros, indicating that subsystems 2 and 3 have no dependencies on each other or on other subsystems.

[0142] The objective function is updated as:

[0143]

[0144] By solving this model, we can obtain the optimal resource allocation solution after considering the dependencies;

[0145] Assuming that different vulnerabilities have different repair costs, we can introduce the weight w of the repair cost i , including w1, w2 and w3;

[0146] The objective function is updated as:

[0147]

[0148] By solving this model, we can obtain the optimal resource allocation solution after considering the repair cost.

[0149] Assuming that the safety benefit decays over time, we can introduce a time variable t:

[0150] The objective function is updated as:

[0151]

[0152] By solving this model, we can obtain the optimal resource allocation solution after considering the time factor.

[0153] Assuming that different subsystems have different criticalities to the core business, we can introduce the criticality weight K i , including K1, K2 and K3;

[0154] The objective function is updated as:

[0155]

[0156] By solving this model, we can obtain the optimal resource allocation solution after considering the criticality.

[0157] In one embodiment, the drill data of the attack and defense drill platform collected by the data collection module includes a defense success index ACI, a vulnerability repair efficiency index VRE, a system recovery time index SRTI, and a resource allocation rationality index RARI;

[0158] The calculation method of the defense success index ACI is:

[0159] Get the number of successful attacks S a And the total number of attacks S All ;

[0160] The defense success index ACI is calculated according to the formula:

[0161] ACI=(1-S a / S All )

[0162] The calculation method of the vulnerability repair efficiency index VRE is:

[0163] Get the cost of fixing a single vulnerability C i ;

[0164] Calculate the average repair cost C based on the repair cost of a single vulnerability avg ;

[0165] The vulnerability repair efficiency index VRE is calculated according to the formula:

[0166] VRE=∑(1-C i / C avg )

[0167] The calculation method of the system recovery time index SRTI is:

[0168] Get the system recovery time T after each successful attack i ;

[0169] Calculate the average recovery time T based on each recovery time avg ;

[0170] The system recovery time index SRTI is calculated according to the formula:

[0171] SRTI=1 / (1+T avg )

[0172] The calculation method of the resource allocation rationality index RARI is:

[0173] Get the actual ratio P of resource allocation between each subsystem i With ideal ratio I i ;

[0174] The resource allocation rationality index RARI is calculated according to the formula:

[0175]

[0176] Based on the formula, the defense success index ACI, vulnerability repair efficiency index VRE, system recovery time index SRTI, and resource allocation rationality index RARI are calculated respectively.

[0177] Based on the above, in one embodiment of the present invention, in addition to building a drill platform, and then setting the attack strategy and the defense strategy for drill respectively through the attack system configuration module and the defense system configuration module, it is also necessary to collect the drill data during the drill, specifically including the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI, wherein the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI are all calculated according to the corresponding parameters; by obtaining the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI, it is possible to quantify whether the attack strategy and defense strategy output by the attack system configuration module and the defense system configuration module have defects during the drill, and lay the foundation for the formulation of network security strategies; exemplary:

[0178] For the defense success index ACI, assume that the exercise process includes 100 attack and defense exercises, that is, the total number of attacks S All =100, and the number of successful attacks counted is S a =20;

[0179] According to the formula: ACI = (1-S a / S All )=(1-20 / 100)=0.8

[0180] For the vulnerability repair efficiency index VRE, it is assumed that the cost of repairing the vulnerability corresponding to the number of successful attacks is:

[0181] C i ={1000, 1500, 800}

[0182] The average repair cost C avg for:

[0183]

[0184] According to the formula:

[0185] VRE=(1-1000 / 1100)+(1-1500 / 1100)+(1-800 / 1100)≈0

[0186] For the system recovery time index SRTI, assuming the average recovery time T avg =2;

[0187] According to the formula:

[0188] SRTI = 1 / (1+2) = 0.333

[0189] For the resource allocation rationality index RARI, assuming the ideal ratio of the three subsystems I i They are I1=0.3, I2=0.35, I3=0.35 respectively; and the actual proportion P i They are P1=0.25, P2=0.4, P3=0.35 respectively;

[0190] According to the formula:

[0191]

[0192] Based on the above, we calculate the defense success index ACI, vulnerability repair efficiency index VRE, system recovery time index SRTI, and resource allocation rationality index SRTI to obtain the corresponding quantitative data;

[0193] From the perspective of the defense success index ACI, ACI = 0.8, which means that the defense strategy adjustment made by the defense system configuration module based on the monitored attack behavior is relatively effective. The parameters calculated based on the formula include the number of successful defenses and the total number of attacks, and the maximum value is 1. From the data representation, the closer the data is to 1, the higher the defense effectiveness. Based on this, when the value of 0.8 is calculated, it can be understood that the defense is effective. And from the feedback of quantitative data alone, it can be obtained that the defense strategy can resist almost all attack modes. For a small number of successful attacks, the corresponding vulnerability level can be adjusted to make resource allocation more reasonable.

[0194] From the perspective of the vulnerability repair efficiency index VRE, VRE≈0 means that the repair cost of at least one vulnerability is much higher than the average cost. The VRE value can reflect the efficiency of repairing different vulnerabilities relative to the average cost. If the VRE value is close to 1, it means that the repair cost of most vulnerabilities is lower than the average cost, otherwise it means that the repair cost of at least one vulnerability is higher than the average cost. In addition, the vulnerability repair efficiency index VRE can also help the defense system configuration module to allocate resources, such as introducing the weight of the repair cost and updating the resource allocation model;

[0195] From the perspective of the system recovery time index SRTI, SRTI=0.333, indicating that the average time for the platform to recover from an attack is relatively long. The closer the SRTI value is to 1, the shorter the average time for the platform to recover from an attack, that is, the more perfect the defense strategy made by the defense system configuration module.

[0196] From the resource allocation rationality index RARI, RARI = 0.69, indicating that there is a certain difference between the ideal ratio and the actual ratio allocated by the resource allocation model in the defense system configuration module for multiple subsystems. Among them, the closer RARI is to 1, the closer the actual ratio is to the ideal ratio, and the resource allocation is relatively reasonable. RARI far from 1 indicates that there is a large deviation between the actual ratio and the ideal ratio.

[0197] In one embodiment, the method in which the evaluation module outputs the evaluation result according to the exercise data is:

[0198] Obtain drill data and pre-process the drill data;

[0199] Assign weights to each indicator; the indicators are used to characterize various parameters in the exercise data, including the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI;

[0200] A comprehensive score is calculated based on each indicator and its corresponding weight to obtain a comprehensive score, which is then output as the evaluation result.

[0201] In one embodiment, the method for calculating the comprehensive score based on various indicators and corresponding weights is:

[0202] Get the preset weight of each indicator;

[0203] According to the formula:

[0204] Q=ACI×α+VRE×β+SRTI×γ+RARI×δ

[0205] Among them, Q is the comprehensive score, α, β, γ and δ are the weights of the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI, respectively, and the value range of α, β, γ and δ is 0 to 1, and α+β+γ+δ=1.

[0206] Based on the above, according to the obtained defense success index ACI, vulnerability repair efficiency index VRE, system recovery time index SRTI, and resource allocation rationality index RARI, a comprehensive score can be calculated according to the pre-set weights for them, as shown in the following example:

[0207] ACI=0.8, VRE≈0, SRTI=0.333, RARI=0.69;

[0208] Q=0.8×0.403+0×0.301+0.333×0.199+0.69×0.097=0.4556

[0209] Based on this, the comprehensive score Q calculated based on 100 attack and defense drills is 0.4556; based on this data, it can be understood that in the process of 100 attack and defense drills, some indicators of the defense system configuration module need to be improved. Since the parameters of each indicator are normalized data less than 1, the maximum value of Q here is 1. From the representation of the final calculation result of Q, the goal is to help the defender evaluate the effectiveness of the defense strategy in the defense system, so Q should be as close to 1 as possible. Based on the final calculation result of Q, it can be understood that the defense system configuration module considered here needs to be improved; in addition, the comprehensive score Q can not only help the defender evaluate the effectiveness of the defense strategy adjusted by the defense system configuration module, but also help the attacker understand the attack effect of the attack strategy designed during the drill, and can find defense weaknesses and determine the attacker in turn;

[0210] Among them, the hierarchical analysis method is used to obtain the initial weights of each indicator. The specific method is as follows:

[0211] Break down the evaluation metrics into multiple levels, for example:

[0212] Target level: Comprehensive score

[0213] Criteria layer: Defense Success Index (ACI), Vulnerability Remediation Efficiency Index (VRE), System Recovery Time Index (SRTI), Resource Allocation Rationality Index (RARI);

[0214] Through the pairwise comparison method, the relative importance of each indicator is determined, and the judgment matrix C is constructed; for example, the importance of each indicator in the comparison criterion layer is:

[0215]

[0216] Among them, the value of "defense effect" to "repair efficiency" in matrix C is 3, indicating that "defense effect" is more important than "repair efficiency".

[0217] The value of "repair efficiency" to "defense effect" in matrix C is 1 / 3, which means that "repair efficiency" is less important than "defense effect" and its importance is only 1 / 3; the values ​​in matrix C are initial values, which are obtained based on the influence of various parameters in historical data on the calculation of comprehensive scores;

[0218] Calculate the eigenvectors of the judgment matrix, and

[0219] Normalize the feature vector to obtain the weight vector;

[0220] Multiply the weight of each indicator at the indicator layer by the weight at the criterion layer to obtain the comprehensive weight;

[0221] For example, suppose that after calculation and consistency check, the following weight vector is obtained:

[0222] Using computing software or manual calculation, the eigenvectors were approximately [0.403, 0.301, 0.199, 0.097];

[0223] Normalize the feature vector to get the criterion layer weight vector:

[0224] Criteria layer weight vector = [0.403, 0.301, 0.199, 0.097];

[0225] Then the weight of the defense success index ACI is 0.403;

[0226] The weight of the vulnerability repair efficiency index VRE is 0.301;

[0227] The weight of the system recovery time index SRTI is 0.199;

[0228] The weight of resource allocation rationality index RARI is 0.097.

[0229] In one embodiment, the evaluation module further includes a feedback unit, and the feedback unit is used to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results.

[0230] In one embodiment, the method for the feedback unit to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results is:

[0231] Obtain a comprehensive score and make a balance judgment based on the comprehensive score;

[0232] When the comprehensive score is lower than the preset threshold, it means that the defense strategy output based on the resource allocation model is not effective, and an instruction to modify the resource allocation model parameters is output;

[0233] When the comprehensive score is not lower than the preset threshold, it means that the attack strategy is not effective, and an instruction to modify the attack strategy is output.

[0234] Based on the above, the significance of building a platform is to simulate the constant contest between attackers and defenders to form a dynamic and complex game process. Therefore, if the comprehensive score is too high, it means that the defense strategy made by the defender according to the defense system configuration module is too perfect compared with the designed attack means, which is not conducive to discovering the problems of the platform and optimizing the defense strategy. It can also be understood that the attack means designed by the attack system configuration module are single and cannot break through the defense strategy. On the contrary, if the comprehensive score is too low, it means that the defense strategy automatically adjusted by the defender according to the attack behavior lacks the grasp of the actual situation and does not fully consider other influencing parameters, such as the dependency between subsystems, the cost of repairing vulnerabilities, and the criticality of subsystems to business systems. In addition, it may be a constant parameter in the resource allocation model, which makes the resource allocation model unable to achieve closed-loop control, thereby providing the attacker with a basis for attack and weakening the effect of the defense strategy output by the resource allocation model. It is worth noting that the preset threshold for comparison with the comprehensive score is set manually. Considering that the construction of the exercise platform is mainly used to improve network security, there are higher requirements for the defense system configuration module, so the value is taken as 0.8 here.

[0235] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A power monitoring system attack and defense simulation exercise control and evaluation system, characterized in that: include: The drill platform construction module is used to build an attack and defense drill platform; Attack system configuration module, used to design attack strategies; Defense system configuration module, used to automatically adjust defense strategies; Data collection module, used to collect exercise data of the attack and defense exercise platform; The evaluation module outputs the evaluation results based on the exercise data.

2. The power monitoring system attack and defense simulation exercise control and evaluation system according to claim 1 is characterized in that: The method for constructing the attack and defense drill platform by the drill platform construction module is: Technology selection: select simulation technology suitable for the network environment based on research; Platform structure design, based on research and technical options, determine the design parameters that make up the platform; Platform construction: design and build a platform that meets the simulated business needs, and set up typical vulnerabilities based on historical data; Business simulation, design simulated business based on the built platform.

3. The attack and defense simulation exercise control and evaluation system for a power monitoring system according to claim 1 is characterized in that: The method for designing the attack strategy by the attack system configuration module is: Obtain typical attack methods from historical data; Form attack strategies based on typical attack methods; The attack means include malware propagation, network intrusion and social engineering attack, and the attack strategy is one or more combinations of malware propagation, network intrusion and social engineering attack.

4. The attack and defense simulation exercise control and evaluation system for a power monitoring system according to claim 1 is characterized in that: The defense system configuration module includes a resource allocation model, and the resource allocation model is used to calculate the optimal defense strategy; The resource allocation model is constructed as follows: Get the vulnerability level of the attack and defense drill platform. The vulnerability level represents the risk level of the i-th subsystem, represented by v i express; The decision variable is the safety investment for each subsystem, expressed as x i express; x i ≥0 As the security investment in each subsystem increases, the resource benefit function gradually saturates, that is: Resource constraints ensure that the total investment does not exceed the resources that the enterprise can afford, that is, Among them, B is the total resource constraint; The optimization goal is to maximize overall security under given resources. By solving the optimization, resources are allocated to subsystems under given resources to achieve maximum overall security, which can be expressed as follows: Based on the above formula, the optimal defense strategy is calculated.

5. The attack and defense simulation exercise control and evaluation system for a power monitoring system according to claim 4 is characterized in that: The method for constructing the resource allocation model also includes: Build resource allocation models for different needs based on actual conditions; Based on the dependency relationship between subsystems, the association matrix A is introduced. ij , where A ij It represents the impact of investing in the ith subsystem on the security of the jth subsystem. The updated model is: Among them, x i 、x j The correlation matrix A is ij The rows and columns in ; Based on the different repair costs of different vulnerabilities, the weight of the repair cost w is introduced i , and further update the model as: Based on the fact that safety benefits will change over time, the introduction of time variable t affects safety investment x. i The time series changes, further update the model as follows: According to the criticality of the subsystem to the core business, the criticality weight K is introduced. i , where K i represents the critical weight of the i-th subsystem, and the model is further updated as follows: Based on resource allocation models with different requirements, the optimal defense strategy is solved using any resource allocation model.

6. The attack and defense simulation exercise control and evaluation system of a power monitoring system according to claim 1 is characterized by: The attack and defense drill platform drill data collected by the data collection module includes the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI; The calculation method of the defense success index ACI is: Get the number of successful attacks S a And the total number of attacks S All ; The defense success index ACI is calculated according to the formula: ACI=(1-S a / S All ) The calculation method of the vulnerability repair efficiency index VRE is: Get the cost of fixing a single vulnerability C i ; Calculate the average repair cost C based on the repair cost of a single vulnerability avg ; The vulnerability repair efficiency index VRE is calculated according to the formula: VRE=∑(1-C i / C avg ) The calculation method of the system recovery time index SRTI is: Get the system recovery time T after each successful attack i ; Calculate the average recovery time T based on each recovery time avg ; The system recovery time index SRTI is calculated according to the formula: SRTI=1 / (1+T avg ) The calculation method of the resource allocation rationality index RARI is: Get the actual ratio P of resource allocation between each subsystem i With ideal ratio I i ; The resource allocation rationality index RARI is calculated according to the formula: Based on the formula, the defense success index ACI, vulnerability repair efficiency index VRE, system recovery time index SRTI, and resource allocation rationality index RARI are calculated respectively.

7. The attack and defense simulation exercise control and evaluation system for a power monitoring system according to claim 1 is characterized in that: The method in which the evaluation module outputs the evaluation result according to the exercise data is: Obtain drill data and pre-process the drill data; Assign weights to each indicator; the indicators are used to characterize various parameters in the exercise data, including the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI; A comprehensive score is calculated based on each indicator and its corresponding weight to obtain a comprehensive score, which is then output as the evaluation result.

8. The attack and defense simulation exercise control and evaluation system for a power monitoring system according to claim 7, characterized in that: The method for calculating the comprehensive score based on each indicator and the corresponding weight is: Get the preset weight of each indicator; According to the formula: Q=ACI×α+VRE×β+SRTI×γ+RARI×δ Among them, Q is the comprehensive score, α, β, γ and δ are the weights of the defense success index ACI, the vulnerability repair efficiency index VRE, the system recovery time index SRTI, and the resource allocation rationality index RARI, respectively, and the value range of α, β, γ and δ is 0 to 1, and α+β+γ+δ=1.

9. The attack and defense simulation exercise control and evaluation system of a power monitoring system according to claim 1, characterized in that: The evaluation module also includes a feedback unit, which is used to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results.

10. The power monitoring system attack and defense simulation exercise control and evaluation system according to claim 9, characterized in that: The method for the feedback unit to dynamically adjust the attack strategy and modify the parameters of the resource allocation model according to the evaluation results is: Obtain a comprehensive score and make a balance judgment based on the comprehensive score; When the comprehensive score is lower than the preset threshold, it means that the defense strategy output based on the resource allocation model is not effective, and an instruction to modify the resource allocation model parameters is output; When the comprehensive score is not lower than the preset threshold, it means that the attack strategy is not effective, and an instruction to modify the attack strategy is output.

Images