Full-link industrial asset safety surveying and mapping method based on knowledge graph

Abstract

The invention relates to the technical field of industrial asset safety surveying and mapping, in particular to a full-link industrial asset safety surveying and mapping method based on a knowledge graph, which comprises the following steps: determining a subnet IP address range through network passive surveying and mapping; generating a pre-network knowledge graph used for reflecting detection nodes and detection target IP addresses from the sub-network IP address range through a detection strategy determination model based on minimum spanning tree clustering; according to the pre-network knowledge graph, performing active surveying and mapping on the network to be surveyed and mapped through a query tool to generate a network full-link knowledge graph for reflecting a routing device, a host device and an IP address relationship thereof in the subnet; and determining an industrial asset risk point location according to the network security information and the network full-link knowledge graph through a network vulnerability analysis model based on a graph neural network. According to the method, the industrial asset network topological relation is integrated based on the knowledge graph, so that key nodes, potential risk vulnerabilities and attack paths are visually expressed and detected, and the safety protection level of industrial assets is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial asset security mapping, and in particular to a full-link industrial asset security mapping method based on a knowledge graph. Background Art

[0002] Currently, in the field of asset mapping of cyberspace security technology, various asset discovery, asset scanning, and asset security mapping technologies are used as basic tools for network security. These technologies and systems focus on the IT assets of enterprises, help them understand their assets, and control security risks.

[0003] The current industrial asset security mapping technology has problems such as asset information being out of sync or untimely, inaccurate equipment positioning or missing or incorrect location information, and the existence of false equipment. Therefore, improvements to the industrial asset security mapping system should focus more on development in a direction that is conducive to in-depth mining of industrial asset information, ensuring the security of industrial assets or networks, and providing reliable information support.

[0004] However, the current traditional industrial asset security mapping technologies include: physical inspection and inventory management, configuration management database, equipment management system, network scanning and traffic analysis, industrial protocol parsing, etc.

[0005] Physical inspection and inventory management, specifically: record the model, configuration, location, etc. of industrial assets through on-site physical inspection, and manually track them in combination with the inventory management system. Advantages: Physical information of non-networked devices can be obtained. Confirm the physical existence of key assets, especially in security-sensitive environments. Disadvantages: Manual inspection is inefficient, prone to errors and difficult to scale. Information cannot be dynamically synchronized with other systems.

[0006] Configuration management database, specifically: the hardware and software configurations of all devices are recorded through the configuration management database, usually combined with the IT service management process (ITSM) to ensure data updates. Advantages: The process drives the update and management of configuration data, which can provide a certain degree of traceability. Disadvantages: The characteristics of industrial assets and IT assets are quite different, and the structure of traditional CMDB is difficult to adapt to the industrial environment. The data is highly isolated, and it is difficult to perform global correlation analysis through CMDB.

[0007] Equipment management system, specifically: using the AMS system, manually or semi-automatically enter all industrial equipment, software, network configuration and other information into the system for centralized management. Advantages: Effective for static asset management, it can centrally register assets and manage their lifecycle. AMS can achieve data synchronization through manual configuration or integration of some automatic discovery functions. Disadvantages: Manual updates of asset information may result in untimely or inaccurate information, especially in large and complex networks. Relying on manual maintenance, the degree of automation is low, and it is difficult to cope with dynamically changing industrial environments. The data in AMS is usually isolated and difficult to automatically associate with other security information (such as threat intelligence and vulnerability information).

[0008] Network scanning and traffic analysis, specifically: using network scanning tools (such as Nmap, Zmap) to detect devices, system ports, protocols, etc. in the network, and using network traffic analysis (such as Wireshark) to perform in-depth protocol parsing and data packet monitoring. Advantages: Ability to automatically discover activities in devices and networks. Capture real-time traffic, identify abnormal traffic and potential attack behaviors. Disadvantages: ICS networks with high real-time requirements may have network load effects, affecting normal control operations. Asset identification can only be done based on existing network connections and traffic, and physical assets that are not connected to the network cannot be discovered. Lack of awareness of complex dependencies between assets.

[0009] Industrial protocol analysis, specifically: using professional industrial protocol analysis tools, such as Modbus, OPC, etc., to analyze the communication between industrial equipment and systems, and obtain information such as the status and configuration of the equipment. Advantages: Specialized analysis of industrial protocols can deeply identify the information of industrial equipment. It provides in-depth insights into the operation and configuration of equipment. Disadvantages: Limited by protocol support, it cannot span all types of equipment and systems, especially some customized or undisclosed protocols. It is impossible to perform a global analysis of the dependencies between equipment and systems in a complex network environment.

[0010] Through the analysis of the above-mentioned various industrial asset security mapping technologies, it is found that traditional industrial asset mapping technologies such as physical inspection and inventory management, configuration management database, equipment management system, network scanning and traffic analysis, industrial protocol analysis, etc., all have their own shortcomings and drawbacks, such as insufficient data integration capabilities, data is usually scattered and isolated; dynamic updates and automation are not high, relying on manual or semi-automatic updates; insufficient correlation analysis, simple correlation analysis based on manual or tool, etc. Therefore, it is necessary to conduct industrial asset security mapping through more efficient network topology measurement and network security detection.

[0011] Therefore, how to conduct efficient network topology mapping and security risk identification of industrial assets is a technical problem that needs to be solved. Summary of the invention

[0012] To this end, the present invention provides a full-link industrial asset security mapping method based on knowledge graph, which realizes the complementary advantages and disadvantages of active network mapping and passive network mapping, reduces the number of detection nodes of active network mapping through minimum spanning tree clustering, and improves the detection efficiency. The network vulnerability analysis model based on graph neural network is used to improve the perception ability and effectiveness of risk detection, and jointly realizes the integration of industrial asset network topology relationships based on knowledge graph, so that key nodes, potential security vulnerabilities and attack paths can be intuitively visualized and detected, thereby improving the security protection level of industrial assets.

[0013] To achieve the above objectives, the present invention proposes a full-link industrial asset safety mapping method based on knowledge graph, comprising: Obtain HTTP protocol messages of the industrial asset network to be surveyed through network passive surveying, and determine the subnet IP address range by parsing the HTTP protocol messages; The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and the detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering; Actively mapping the network to be mapped is performed through a query tool according to the pre-network knowledge graph, and a network full-link knowledge graph is generated to reflect the relationship between routing devices, host devices and their IP addresses in the subnet; Acquire network security information of the routing device and the host device through a traffic firmware analysis tool; The network security information and the network full-link knowledge graph are used to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network.

[0014] Furthermore, the process of generating the pre-network knowledge graph includes: Calculate the device distance according to the geographical information of multiple devices corresponding to the subnet IP address range; The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel; According to the connection relationship of the minimum spanning tree structure graph, the subnet IP address range is determined by the detection node submodel to generate the detection node and the pre-detection target IP address; Generate a detection cost value from the detection node to multiple pre-detection target IP addresses through a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and select the detection target IP address from the pre-detection target IP addresses according to the detection cost value; Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address; The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

[0015] Furthermore, the process of generating the detection node and the pre-detection target IP address includes: A cluster set is generated according to the connection relationship of the minimum spanning tree structure diagram and the detection target geographic information set corresponding to the subnet IP address range; the cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node and the pre-detection target IP address is generated.

[0016] Furthermore, the detection cost value is calculated based on the computing power performance value; Among them, computing power performance values ​​include CPU efficiency ratio, throughput and forwarding rate.

[0017] In the above scheme, the topological relationship between the subnet and the routing device, the host, the detection node and the detection target IP address are determined step by step through the greedy algorithm, the k-means clustering algorithm and the detection cost estimation, which realizes the integration of the topological relationship of the industrial asset network based on the knowledge graph and improves the detection efficiency of active network mapping.

[0018] Furthermore, the process of determining the risk points of industrial assets includes: Generate an adjacency matrix of the network vulnerability analysis model from the network security information, and generate a degree matrix of the network vulnerability analysis model from the network full-link knowledge graph; Generate a virus feature fingerprint library through virus simulation software, and use the virus feature fingerprint library and the network full-link knowledge graph to train and test the network vulnerability analysis model; The adjacency matrix and the degree matrix are used to match virus feature fingerprints through the tested network vulnerability analysis model to determine the risk points of the industrial assets.

[0019] Furthermore, the network vulnerability analysis model includes a first graph convolution layer to a fourth graph convolution layer, wherein the first graph convolution layer to the third graph convolution layer respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

[0020] Furthermore, the traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes IP address, MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

[0021] In the above solution, the virus feature fingerprint matching of the knowledge graph integrated with network information is achieved through graph neural network, which enables accurate identification of potential risk points, helps to intuitively identify the locations of vulnerabilities and complex attack chains, and thus better helps enterprises to carry out targeted vulnerability patching and risk control.

[0022] Furthermore, the query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped through the query tool according to the pre-network knowledge graph to generate a network full-link knowledge graph for reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes: Accessing the pre-IP list of the routing device connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining the IP address of the host device connected to the subnet according to the pre-IP list; According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

[0023] Further, the process of actively mapping the pre-IP list through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection node and the detection target IP address of the pre-network knowledge graph includes: Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol; The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

[0024] Further, the process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes: The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

[0025] In the above scheme, by combining the network active mapping method based on the ICMP protocol tool with the network active mapping method based on the SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0026] Compared with the prior art, the present invention has the following beneficial effects: 1. The advantages and disadvantages of active network mapping and passive network mapping are complementary. The number of detection nodes of active network mapping is reduced through minimum spanning tree clustering, which improves the detection efficiency. The network vulnerability analysis model based on graph neural network is used to improve the perception ability and effectiveness of risk detection. Together, the integration of industrial asset network topology relationships based on knowledge graphs is realized, which enables intuitive visualization and detection of key nodes, potential security vulnerabilities and attack paths, thereby improving the security protection level of industrial assets.

[0027] 2. The topological relationship between the subnet, routing devices, and host, as well as the detection nodes and detection target IP addresses, are determined step by step through the greedy algorithm, k-means clustering algorithm, and detection cost estimation. This realizes the integration of the topological relationship of the industrial asset network based on the knowledge graph and improves the detection efficiency of active network mapping.

[0028] 3. Through the graph neural network, the virus feature fingerprint matching of the knowledge graph and network information is integrated to achieve accurate identification of potential risk points, which helps to intuitively identify the points of vulnerabilities and complex attack chains, and thus better help enterprises to carry out targeted vulnerability patching and risk control.

[0029] 4. By combining the active network mapping method based on the ICMP protocol tool with the active network mapping method based on the SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the process of a full-link industrial asset safety mapping method based on a knowledge graph according to an embodiment of the present invention; Figure 2 A flow chart of a detection strategy determination model based on minimum spanning tree clustering of a full-link industrial asset safety mapping method based on a knowledge graph in an embodiment of the present invention; Figure 3 It is a schematic diagram of a minimum spanning tree structure diagram of a full-link industrial asset safety mapping method based on a knowledge graph according to an embodiment of the present invention; Figure 4 A schematic diagram of a pre-network knowledge graph of a full-link industrial asset safety mapping method based on a knowledge graph according to an embodiment of the present invention; Figure 5A schematic diagram of a network full-link knowledge graph of a full-link industrial asset safety mapping method based on a knowledge graph according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a network vulnerability analysis model based on a graph neural network for the full-link industrial asset security mapping method based on a knowledge graph in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0032] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0033] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0034] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0035] like Figures 1 to 6 As shown, the present invention provides a full-link industrial asset security mapping method based on knowledge graph, which realizes the complementary advantages and disadvantages of active network mapping and passive network mapping, reduces the number of detection nodes of active network mapping through minimum spanning tree clustering, and improves the detection efficiency. The network vulnerability analysis model based on graph neural network improves the perception ability and effectiveness of risk detection, and jointly realizes the integration of industrial asset network topology relations based on knowledge graph, so that key nodes, potential security vulnerabilities and attack paths can be intuitively visualized and detected, thereby improving the security protection level of industrial assets.

[0036] like Figures 1 to 6 As shown, this embodiment proposes a full-link industrial asset safety mapping method based on knowledge graph, including: Obtain HTTP protocol messages of the industrial asset network to be surveyed through network passive surveying, and determine the subnet IP address range by parsing the HTTP protocol messages; The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and the detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering; Actively mapping the network to be mapped is performed through a query tool according to the pre-network knowledge graph, and a network full-link knowledge graph is generated to reflect the relationship between routing devices, host devices and their IP addresses in the subnet; Acquire network security information of the routing device and the host device through a traffic firmware analysis tool; The network security information and the network full-link knowledge graph are used to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network.

[0037] It can be understood that passive network mapping is a technology that infers network topology by passively receiving network traffic. Unlike active network mapping, passive network mapping does not send detection packets to the network, but parses the protocol packets containing network traffic to obtain the subnet IP address range.

[0038] Specifically, the request and response messages of the network traffic in the HTTP protocol message are analyzed by packet capture tools such as Wireshark and tcpdump, and the IP address, host name and other information are extracted, so as to infer the IP address range of the subnet. Therefore, the nature of passive network mapping determines that the computing power required for mapping is not high, but it is difficult to map and analyze in depth. Therefore, this embodiment performs more efficient active network mapping by clustering the results of passive network mapping through the minimum spanning tree after passive mapping, thereby achieving more accurate, comprehensive and efficient network mapping, and generating a comprehensive and high-precision network full-link knowledge graph.

[0039] The network mapping process combining the above network passive mapping and network active mapping can be achieved through Figure 3 The knowledge graph generation process shown is visualized, which facilitates the adjustment of personnel by the industrial asset security team and the use of the results of network mapping.

[0040] Furthermore, if Figure 2 , 3 As shown in 4, the process of generating a pre-network knowledge graph reflecting the detection node and the detection target IP address by using the detection strategy determination model based on minimum spanning tree clustering based on the geographic information corresponding to the subnet IP address range includes: Calculate the device distance according to the geographical information of multiple devices corresponding to the subnet IP address range; The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel; According to the connection relationship of the minimum spanning tree structure graph, the subnet IP address range is determined by the detection node submodel to generate the detection node and the pre-detection target IP address; Generate a detection cost value from the detection node to multiple pre-detection target IP addresses through a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and select the detection target IP address from the pre-detection target IP addresses according to the detection cost value; Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address; The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

[0041] It should be noted that if Figure 3 As shown, the nodes in the minimum spanning tree structure diagram described in this embodiment are routing devices and host devices, and the edges are device distances, such as Figure 4 As shown, the nodes of the pre-network knowledge graph are the host devices, routing devices, detection nodes and port tables on the detection target IP addresses in the subnet, such as Figure 5 As shown, the network full-link knowledge graph is preferably a network topology relationship diagram that only displays a large number of device topology relationships after active network mapping and is stored and displayed in a standard knowledge graph relationship. It is constructed by triplets of multiple knowledge graphs. In this embodiment, the triplets are preferably routing device-subnet-IP address segment, bridge-subnet-IP address.

[0042] It can be understood that the detection node refers to a node that is deployed globally, has a fixed position, and can send detection messages to detection objects including landmark nodes and target IPs. Its task is to send detection packets to obtain device information in the network space. The target IP address is the IP address that needs to be located or detected. By detecting the port table on the target IP address, the detection packet can be directly sent to the detection device for specific detection.

[0043] Specifically, the set of geographic information of the detection target used for clustering is determined according to the subnet IP address range. Geographic information such as MaxMind can easily perform clustering operations, while the correlation between IP addresses is weak and cannot be clustered. During the clustering operation, the device distance is calculated using the Euclidean distance formula.

[0044] Specifically, one of the core steps of the minimum spanning tree clustering algorithm (MST Clustering) is to construct a minimum spanning tree structure graph (MST), and the topology generation submodel for constructing the minimum spanning tree structure graph is implemented by the Kruskal algorithm based on the greedy algorithm. More specifically, the process of the topology generation submodel generating the minimum spanning tree structure graph based on the Kruskal algorithm includes: All edges are weighted by distance and sorted from small to large. Each edge is traversed from small to large according to weight. If the two nodes of the current edge are not connected, the sets of these two nodes are merged. Otherwise, the edge is skipped. When the number of edges in the minimum spanning tree structure graph is equal to the number of nodes minus 1, the algorithm terminates.

[0045] Further, the process of generating a detection node and a pre-detection target IP address by determining a sub-model through a detection node for a subnet IP address range according to the connection relationship of the minimum spanning tree structure graph includes: A cluster set is generated according to the connection relationship of the minimum spanning tree structure diagram and the detection target geographic information set corresponding to the subnet IP address range; the cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node and the pre-detection target IP address is generated.

[0046] It is understandable that since the minimum spanning tree structure diagram is generated based on the results of passive network mapping, it is bound to be inaccurate and incomplete. Therefore, by using a clustering algorithm to generate detection nodes and detection target IP addresses for further active network mapping, the passive network mapping results can guide active network mapping and improve the efficiency of active network mapping.

[0047] Specifically, the cluster set is a set of detection target geographic information, which is determined comprehensively based on the geographic distance of the geographic information and whether there is a connection relationship, that is, for the IP address with a connection relationship, it is judged whether the geographic distance exceeds a threshold. If so, it is deleted, thereby avoiding invalid network detection / mapping.

[0048] Specifically, the number of clusters of the k-means clustering algorithm is set according to the number of edges in the minimum spanning tree structure diagram. For example, if the number of edges is 5, the number of clusters k is 5. The Euclidean distance to each centroid is calculated, and each target point is assigned to the category with the nearest centroid. The clustering results are saved in a two-dimensional array data structure. The first dimension of data is the centroid number, that is, the clustering cluster, the detection node, and the second dimension of data is the geographic information, which is converted into the pre-detection target IP address.

[0049] Furthermore, the detection cost value is calculated based on the computing power performance value, wherein the computing power performance value includes CPU efficiency ratio, throughput and forwarding rate, specifically:

[0050] In the formula, is the detection cost of the i-th node, are the distance, CPU performance ratio, throughput, forwarding rate and network traffic respectively, are hyperparameters, preferably 0.1, 0.1, and 0.5, is the number of remaining detection nodes after the last round of detection tasks. It can be understood that the role of the distance and CPU performance ratio is to evaluate the communication overhead of the detection cost. When the distance is large, the detection task requires more resources to cover farther nodes. The throughput (i.e. the amount of data processed per unit time) and forwarding rate (i.e. the efficiency of data forwarding) will have a certain impact on the detection cost, so they are considered through smaller hyperparameters. The network traffic (i.e. the data load in the network) has a greater impact on the detection efficiency, so it is considered through larger hyperparameters. The number of remaining detection nodes It reflects the current load situation and avoids continuing to invest in nodes when the load is too large, so as to achieve the optimal configuration of the detection nodes.

[0051] It can be understood that by calculating the detection cost values ​​of all detection nodes and then selecting the detection target IP address with the smallest detection cost value from the pre-detection target IP addresses, a reliable active network mapping strategy can be formulated, and when a new detection task is added, the above process can be repeated to formulate a new detection strategy and realize dynamic updating of the detection strategy.

[0052] In the above scheme, the topological relationship between the subnet and the routing device, the host, the detection node and the detection target IP address are determined step by step through the greedy algorithm, the k-means clustering algorithm and the detection cost estimation, which realizes the integration of the topological relationship of the industrial asset network based on the knowledge graph and improves the detection efficiency of active network mapping.

[0053] Furthermore, if Figure 4 and 5 As shown in the figure, the process of determining the risk points of industrial assets by using the network security information and the network full-link knowledge graph through the network vulnerability analysis model based on the graph neural network includes: Generate an adjacency matrix of the network vulnerability analysis model from the network security information, and generate a degree matrix of the network vulnerability analysis model from the network full-link knowledge graph; A virus feature fingerprint library is generated through virus simulation software, and the virus feature fingerprint library and the network full-link knowledge graph are used to train and test the network vulnerability analysis model; the adjacency matrix and the degree matrix are matched with virus feature fingerprints by the tested network vulnerability analysis model to determine the risk points of the industrial assets.

[0054] Specifically, the virus feature fingerprint is a time series distribution feature of abnormal traffic.

[0055] Furthermore, if Figure 6 As shown, the network vulnerability analysis model includes the first to fourth graph convolution layers, wherein the first to third graph convolution layers respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

[0056] Specifically, the gradient hidden layer / hidden layer of each layer from the first to the fourth convolutional layer uses a 3×3 convolution kernel with a step size of 1. The nonlinear activation function uses the ReLU activation function, which increases the nonlinear characteristics and allows a certain amount of negative value transmission. The number of output channels of the first convolutional layer is set to 64, and the number of output channels of the second convolutional layer is set to 128, which are set in sequence. Therefore, through four convolutions, the underlying features of the image, including edges, textures, and shapes, are extracted layer by layer, ensuring rich feature information and enhancing the representativeness of the features.

[0057] Furthermore, the traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes IP address, MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

[0058] Specifically, the traffic analysis tool analyzes the traffic data obtained by active and passive adaptive detection, and some traffic analysis tools can be used, such as Wireshark, tcpdump, etc. The information of the devices in the network is automatically extracted, mainly including the source IP information, target IP address, MAC address, AP detection data and other information of the data packet to extract the device information, and perform firmware analysis at the same time. The firmware mentioned in this embodiment is not hardware, but software, generally refers to a binary program stored in a non-volatile memory, which is usually burned directly onto the hardware development board. The first step of firmware analysis is to use the Binwalk tool or other unpacking tools to analyze the network device firmware package, and dig out as much information as possible. Then, using the extracted valuable information, a combination of static analysis and dynamic simulation can be used to mine and analyze network device vulnerabilities to obtain the security status of the devices connected to the network.

[0059] In the above solution, the virus feature fingerprint matching of the knowledge graph integrated with network information is achieved through graph neural network, which enables accurate identification of potential risk points, helps to intuitively identify the locations of vulnerabilities and complex attack chains, and thus better helps enterprises to carry out targeted vulnerability patching and risk control.

[0060] Furthermore, the query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped through the query tool according to the pre-network knowledge graph to generate a network full-link knowledge graph for reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes: Accessing the pre-IP list of the routing device connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining the IP address of the host device connected to the subnet according to the pre-IP list; According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

[0061] Further, the process of actively mapping the pre-IP list through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection node and the detection target IP address of the pre-network knowledge graph includes: Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol; The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

[0062] Further, the process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes: The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

[0063] Specifically, the current status of the host in the subnet is generally detected using the ICMP Ping method. The method of pinging the possible IP addresses in the subnet one by one will be somewhat blind, resulting in an increased network burden. The ICMP-based topology discovery method is combined with the ARP-based topology discovery method. First, the ipNetToMediaTable table in the MIB library of the gateway connected to the subnet is accessed, and the variable ipNetToMediaNetAddress in the table is used to determine the IP address of the host actually connected to the subnet. Then, these actual IP addresses are pinged to determine the host status. This greatly reduces the number of pings, improves the efficiency of the algorithm, and reduces the network burden. In addition, the asynchronous Ping method can be used to shorten the detection time.

[0064] The type of network device can be determined by accessing the ipFowarding and sysServices variables in the MIB library. The ipFowarding variable is used to indicate whether the network device has the function of forwarding IP packets. If it has this function, the value is 1, indicating that the device is a gateway; if it does not have this function, the value is 2.

[0065] The value of sysServices indicates the set of services that a network device can provide, and it can also be used to determine which OSI layer the device is working at. For example, if sysServices=2, it means that it is working at the data link layer and is a bridge.

[0066] For network interfaces, an interface table (ifTable) is used to describe them in the MIB library. The ifType field in the interface table is used to describe the type of the interface, represented by an integer. By accessing the value of the ifType field in the interface table and comparing it with the network interface type table, the network interface of the network device can be determined.

[0067] In the above scheme, by combining the network active mapping method based on the ICMP protocol tool with the network active mapping method based on the SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0068] As a specific implementation of this embodiment, after obtaining the network topology structure in the local area network, it is stored in the data structure of the network topology. The minimum spanning tree algorithm is required to select the mapping node. The data structure storing the network topology is input into the algorithm. When selecting the seed node, the algorithm will select according to the weight and distance. The weight can be used as a criterion based on the number of ports and the number of network connections of the current node. After the algorithm runs, the minimum spanning tree is generated, that is, the network mapping sequence.

[0069] After obtaining several nodes of the current network topology as seed nodes, formal detection begins, mainly using active and passive adaptive detection. As the name implies, active and passive adaptive detection automatically complements the advantages and disadvantages of active detection and passive detection based on the target type and status. Within the mapping range of the seed node, the target node is initially judged by passive means, and then the active detection method is adaptively used to further explore and analyze in depth. In this way, even if there are target nodes that do not actively generate traffic, information can be obtained from them. Moreover, since there are multiple seed nodes in the network topology, which are responsible for different mapping areas, the use of active detection here will not have much impact on the equipment, and can greatly improve the accuracy and effectiveness of network detection. In short, the purpose of active and passive adaptive detection is to obtain network space resource attribute information as comprehensively and accurately as possible without affecting network performance or increasing network load.

[0070] While using active and passive adaptive detection, use traffic analysis and firmware analysis technology to obtain more data from the network. Traffic analysis needs to be analyzed based on the traffic data obtained by active and passive adaptive detection. Some traffic analysis tools can be used, such as Wireshark, tcpdump, etc. Automatically extract the information of devices in the network, mainly the source IP information, target IP address, MAC address and other information of the data packet. Extract device information and perform firmware analysis at the same time. The firmware mentioned in this patent is not hardware, but software, which generally refers to binary programs stored in non-volatile memory, which are usually burned directly onto the hardware development board. The first step of firmware analysis is to use the Binwalk tool or other unpacking tools to analyze the network device firmware package, dig out as much information as possible, and then use the extracted valuable information to combine static analysis with dynamic simulation to conduct network device vulnerability mining and analysis to obtain the security status of devices connected to the network.

[0071] After active and passive adaptive detection, traffic analysis and firmware analysis, the seed node can obtain all device information within its mapping range, including the basic information of the equipment, security information and whether it is authentic and valid, etc. Combined with the network topology information at the seed device, all asset mapping information in the current range can be obtained. The seed node transmits the mapping information to the mapping node. The mapping node integrates the scanning results of the seed node to draw the asset information within the global area network.

[0072] According to the distribution of information assets within the network coverage, combined with the detailed asset information obtained by surveying and mapping, it includes both structured data and semi-structured and unstructured data. First, the structured data is automatically extracted, and the unstructured data needs to extract information such as entities, attributes, and relationships. Finally, the extracted information is converted into triples suitable for graph storage. Each triple is composed of a subject (entity), a predicate (relationship), and an object (entity or attribute). It should be noted that in this embodiment, the triples are routing device-subnet-IP address segment, bridge-subnet-IP address, and the extracted triples are merged according to the original logical relationship. Merger, in the knowledge fusion stage, the main work is error correction and completion of knowledge; in the knowledge processing stage, the focus is on updating and purifying knowledge to form a knowledge graph, which is stored using Neo4j. It has a freely adjacent graph storage structure and better data analysis and processing capabilities. Therefore, the Neo4j graph database is used to store triple data and build a full-link industrial asset surveying and mapping information knowledge graph to facilitate interactive query and correlation analysis, improve the correlation of network asset information, and improve security performance, risk warning, damage assessment and other defense capabilities. Comprehensively control the important networked information in the local area network to refine the asset status and the security risks faced.

[0073] At the same time, the surveying and mapping nodes and seed nodes maintain a continuous detection state. When the network topology changes, the network topology stored in the surveying and mapping system must also change. At the same time, the minimum spanning tree algorithm will be triggered to reselect the seed nodes. At the same time, the seed nodes will also monitor the changes in equipment information within the responsible range. Due to the smaller detection range and the joint execution of active and passive adaptive detection, traffic analysis, and firmware analysis algorithms, it can ensure that all information within the monitoring range can be updated in real time, achieving high-sensitivity monitoring and faster response speed.

[0074] Therefore, this embodiment can better display the complex relationship between industrial assets and support dynamic update and correlation analysis through the intelligent method of mapping based on knowledge graph, combined with graph database, semantic analysis and reasoning technology. Advantages of intelligent data integration and association: The knowledge graph can organically integrate data from different sources (equipment information, network topology, protocol data, vulnerability information, threat intelligence, etc.) to form a graph with context association. By associating the multi-dimensional attributes of industrial assets (such as equipment model, supplier, protocol, vulnerability, etc.), the dependency relationship between assets can be automatically generated, which is helpful for full-link security monitoring and attack path analysis. Advantages of dynamic update and real-time reasoning: The knowledge graph can reflect changes in the industrial environment in real time, and automatically update through dynamic data (such as network logs, traffic monitoring, equipment status) to ensure the timeliness and accuracy of asset mapping. Based on the reasoning ability of the graph, the knowledge graph can automatically detect potential risks and security vulnerabilities, and provide remedial measures or optimization suggestions. Advantages of context perception and complex relationship modeling: The knowledge graph has semantic understanding capabilities and can identify and present complex contextual relationships. For example, not only can you see that a device has vulnerabilities, but you can also see its dependencies with other key devices, so that you can provide more targeted security protection. It can cross the data silos in traditional methods and associate multi-dimensional data such as asset information, threat intelligence, and operation logs, making security decisions more comprehensive and accurate. Advantages of attack path analysis and prediction: Security mapping based on knowledge graphs can automatically analyze possible attack paths of attackers, and by modeling the dependencies between assets, it can discover possible penetration points and vulnerability exploitation paths, and provide early warning of potential security threats. Knowledge graphs also support simulated attacks to help security teams evaluate the effectiveness of security strategies.

[0075] In this embodiment, the advantages and disadvantages of active network mapping and passive network mapping are complemented. The number of detection nodes of active network mapping is reduced through minimum spanning tree clustering, and the detection efficiency is improved. The network vulnerability analysis model based on graph neural network is used to improve the perception ability and effectiveness of risk detection. The integration of industrial asset network topology relationship based on knowledge graph is jointly realized, so that key nodes, potential security vulnerabilities and attack paths are intuitively visualized and detected, and the security protection level of industrial assets is improved. The topological relationship between subnet and routing equipment, host, detection node and detection target IP address are determined step by step through greedy algorithm, k-means clustering algorithm and detection cost estimation, and the integration of industrial asset network topology relationship based on knowledge graph is realized, while the detection efficiency of active network mapping is improved. Through the virus feature fingerprint matching of the knowledge graph integrated with network information by graph neural network, the potential risk points are accurately identified, which helps to intuitively identify the points of vulnerabilities and complex attack chains, and thus better help enterprises to carry out targeted vulnerability patching and risk control. By combining the active network mapping method based on ICMP protocol tools with the active network mapping method based on SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0076] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0077] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A full-link industrial asset safety mapping method based on knowledge graph, characterized in that: include: Obtain HTTP protocol messages of the industrial asset network to be surveyed through network passive surveying, and determine the subnet IP address range by parsing the HTTP protocol messages; The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and the detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering; Actively mapping the network to be mapped is performed through a query tool according to the pre-network knowledge graph, and a network full-link knowledge graph is generated to reflect the relationship between routing devices, host devices and their IP addresses in the subnet; Acquire network security information of the routing device and the host device through a traffic firmware analysis tool; The network security information and the network full-link knowledge graph are used to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network.

2. The full-link industrial asset safety mapping method based on knowledge graph according to claim 1 is characterized in that: The process of generating a pre-network knowledge graph includes: Calculate the device distance according to the geographical information of multiple devices corresponding to the subnet IP address range; The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel; According to the connection relationship of the minimum spanning tree structure graph, the subnet IP address range is determined by the detection node submodel to generate the detection node and the pre-detection target IP address; Generate a detection cost value from the detection node to multiple pre-detection target IP addresses through a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and select the detection target IP address from the pre-detection target IP addresses according to the detection cost value; Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address; The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

3. The full-link industrial asset safety mapping method based on knowledge graph according to claim 2 is characterized in that: The process of generating the detection node and pre-detection target IP address includes: Generate a cluster set according to the connection relationship of the minimum spanning tree structure graph and the detection target geographic information set corresponding to the subnet IP address range; The cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node to generate the pre-detection target IP address.

4. The full-link industrial asset safety mapping method based on knowledge graph according to claim 2 is characterized in that: The detection cost value is calculated based on the computing power performance value; Among them, computing power performance values ​​include CPU efficiency ratio, throughput and forwarding rate.

5. The full-link industrial asset safety mapping method based on knowledge graph according to claim 1 is characterized in that: The process of determining the risk level of industrial assets includes: Generate an adjacency matrix of the network vulnerability analysis model from the network security information, and generate a degree matrix of the network vulnerability analysis model from the network full-link knowledge graph; Generate a virus feature fingerprint library through virus simulation software, and use the virus feature fingerprint library and the network full-link knowledge graph to train and test the network vulnerability analysis model; The adjacency matrix and the degree matrix are used to match virus feature fingerprints through the tested network vulnerability analysis model to determine the risk points of the industrial assets.

6. The full-link industrial asset safety mapping method based on knowledge graph according to claim 1 is characterized in that: The network vulnerability analysis model includes a first graph convolution layer to a fourth graph convolution layer, wherein the first graph convolution layer to the third graph convolution layer respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

7. The full-link industrial asset safety mapping method based on knowledge graph according to claim 1 is characterized in that: The traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes an IP address, a MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

8. The full-link industrial asset safety mapping method based on knowledge graph according to any one of claims 1 to 7 is characterized in that: The query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped through the query tool according to the pre-network knowledge graph to generate a network full-link knowledge graph for reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes: Accessing the pre-IP list of the routing device connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining the IP address of the host device connected to the subnet according to the pre-IP list; According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

9. The full-link industrial asset safety mapping method based on knowledge graph according to claim 8 is characterized in that: The process of actively mapping the pre-IP list through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection node and the detection target IP address of the pre-network knowledge graph includes: Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol; The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

10. The full-link industrial asset safety mapping method based on knowledge graph according to claim 9 is characterized in that: The process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes: The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

Images