A full-link industrial asset security mapping method based on knowledge graph

Abstract

The present invention relates to the technical field of industrial asset security mapping, and in particular to a full-link industrial asset security mapping method based on a knowledge graph, comprising: determining a subnet IP address range through passive network mapping; generating a pre-network knowledge graph for reflecting the IP addresses of detection nodes and detection targets using a detection strategy determination model based on minimum spanning tree clustering for the subnet IP address range; actively mapping the network to be mapped using a query tool based on the pre-network knowledge graph to generate a full-link network knowledge graph for reflecting the relationship between routing devices, host devices, and their IP addresses in the subnet; and determining industrial asset risk points using a network vulnerability analysis model based on a graph neural network using network security information and the full-link network knowledge graph. The present invention integrates the topological relationship of the industrial asset network based on the knowledge graph, enables the visualization and detection of key nodes, potential risk vulnerabilities, and attack paths, and improves the security protection level of industrial assets.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial asset security mapping, and in particular to a full-link industrial asset security mapping method based on a knowledge graph. Background Art

[0002] Currently, in the field of cybersecurity asset mapping, various asset discovery, asset scanning, and asset security mapping technologies are used as foundational tools for cybersecurity. These technologies and systems focus on an enterprise's IT assets, helping to understand their assets and manage security risks.

[0003] The current industrial asset security mapping technology has problems such as asset information being out of sync or untimely, inaccurate equipment positioning or missing or incorrect location information, and the existence of false equipment. Therefore, improvements to the industrial asset security mapping system should focus more on developing in a direction that is conducive to in-depth mining of industrial asset information, ensuring the security of industrial assets or networks, and providing reliable information support.

[0004] However, current traditional industrial asset security mapping technologies include: physical inspection and inventory management, configuration management database, equipment management system, network scanning and traffic analysis, industrial protocol parsing, etc.

[0005] Physical inspection and inventory management involves on-site physical inspections to record the model, configuration, and location of industrial assets, and then manually tracking them in conjunction with inventory management systems. Advantages: Physical information can be obtained for offline devices. This confirms the physical presence of critical assets, especially in security-sensitive environments. Disadvantages: Manual inspections are inefficient, error-prone, and difficult to scale. Information cannot be dynamically synchronized with other systems.

[0006] A configuration management database (CMDB) records the hardware and software configurations of all devices, typically integrating IT service management (ITSM) processes to ensure data updates. Advantages: This process-driven update and management of configuration data provides a certain level of traceability. Disadvantages: The characteristics of industrial assets differ significantly from those of IT assets, making the traditional CMDB structure difficult to adapt to industrial environments. Data is often isolated, making it difficult to conduct global correlation analysis within the CMDB.

[0007] Equipment management system, specifically: using the AMS system, manually or semi-automatically enter all industrial equipment, software, network configuration and other information into the system for centralized management. Advantages: Effective for static asset management, it can perform centralized asset registration and lifecycle management. AMS can achieve data synchronization through manual configuration or integration of some automatic discovery functions. Disadvantages: Manual updates of asset information may result in untimely or inaccurate information, especially in large and complex networks. Relying on manual maintenance, the degree of automation is low, and it is difficult to cope with dynamically changing industrial environments. The data in AMS is usually isolated and difficult to automatically associate with other security information (such as threat intelligence and vulnerability information).

[0008] Network scanning and traffic analysis, specifically: using network scanning tools (such as Nmap and Zmap) to detect devices, system ports, protocols, etc. on the network, and using network traffic analysis tools (such as Wireshark) for in-depth protocol parsing and packet monitoring. Advantages: Automatically discovers activities on devices and networks. Captures real-time traffic, identifying abnormal traffic and potential attack behaviors. Disadvantages: ICS networks with high real-time requirements may impose network load, affecting normal control operations. Asset identification can only be based on existing network connections and traffic, and cannot detect physical assets that are not connected to the network. Lacks understanding of the complex dependencies between assets.

[0009] Industrial protocol parsing involves using specialized industrial protocol parsing tools, such as Modbus and OPC, to analyze communications between industrial devices and systems, obtaining information such as device status and configuration. Advantages: This analysis specifically targets industrial protocols, enabling in-depth identification of industrial device information. It provides deep insight into device operation and configuration. Disadvantages: Limited by protocol support, it cannot span all types of devices and systems, particularly for customized or non-public protocols. It also cannot provide a global analysis of device and system dependencies in complex network environments.

[0010] An analysis of the various industrial asset security mapping technologies mentioned above reveals that traditional industrial asset security mapping technologies, such as physical inspection and inventory management, configuration management databases, equipment management systems, network scanning and traffic analysis, and industrial protocol parsing, all have their own shortcomings and drawbacks. These include insufficient data integration capabilities, resulting in fragmented and isolated data; low levels of dynamic updates and automation, relying on manual or semi-automatic updates; and insufficient correlation analysis, relying on simple manual or tool-based correlation analysis. Therefore, industrial asset security mapping requires more efficient network topology measurement and network security testing.

[0011] Therefore, how to efficiently map the network topology relationships of industrial assets and identify security risks is a technical problem that needs to be solved. Summary of the Invention

[0012] To this end, the present invention provides a full-link industrial asset security mapping method based on knowledge graph, which realizes the complementary advantages and disadvantages of active network mapping and passive network mapping, reduces the number of detection nodes of active network mapping through minimum spanning tree clustering, improves the detection efficiency, and improves the perception ability and effectiveness of risk detection through the network vulnerability analysis model based on graph neural network. Together, it realizes the integration of industrial asset network topology relationships based on knowledge graph, enables intuitive visualization and detection of key nodes, potential security vulnerabilities and attack paths, and improves the security protection level of industrial assets.

[0013] To achieve the above objectives, the present invention proposes a full-link industrial asset security mapping method based on knowledge graph, comprising:

[0014] Obtain HTTP protocol messages of the industrial asset network to be mapped through network passive mapping, and determine the subnet IP address range by parsing the HTTP protocol messages;

[0015] The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering;

[0016] Actively mapping the network to be mapped using a query tool based on the pre-network knowledge graph to generate a full-link network knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet;

[0017] Obtaining network security information of the routing device and the host device through a traffic firmware analysis tool;

[0018] The network security information and the network full-link knowledge graph are used to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network.

[0019] Furthermore, the process of generating the pre-network knowledge graph includes:

[0020] Calculate the device distance based on the geographical information of multiple devices corresponding to the subnet IP address range;

[0021] The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel;

[0022] Determine the sub-model for the subnet IP address range by detecting nodes according to the connection relationship of the minimum spanning tree structure graph to generate the detection node and the pre-detection target IP address;

[0023] generating a detection cost value from the detection node to multiple pre-detection target IP addresses using a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and selecting the detection target IP address from the pre-detection target IP addresses based on the detection cost value;

[0024] Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address;

[0025] The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

[0026] Furthermore, the process of generating the detection node and the pre-detection target IP address includes:

[0027] A cluster set is generated based on the connection relationship of the minimum spanning tree structure diagram and the detection target geographic information set corresponding to the subnet IP address range; the cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node and the pre-detection target IP address is generated.

[0028] Furthermore, the detection cost value is calculated based on the computing power performance value;

[0029] Among them, computing power performance values ​​include CPU efficiency ratio, throughput and forwarding rate.

[0030] In the above scheme, the topological relationship between the subnet and the routing device, the host, as well as the detection node and the detection target IP address are determined step by step through the greedy algorithm, the k-means clustering algorithm and the detection cost estimation. This realizes the integration of the industrial asset network topology relationship based on the knowledge graph and improves the detection efficiency of active network mapping.

[0031] Furthermore, the process of determining the risk points of industrial assets includes:

[0032] Generate an adjacency matrix of the network vulnerability analysis model using the network security information, and generate a degree matrix of the network vulnerability analysis model using the network full-link knowledge graph;

[0033] Generate a virus feature fingerprint library through virus simulation software, and use the virus feature fingerprint library and the network full-link knowledge graph to train and test the network vulnerability analysis model;

[0034] The adjacency matrix and the degree matrix are used to perform virus feature fingerprint matching on the tested network vulnerability analysis model to determine the risk points of the industrial assets.

[0035] Furthermore, the network vulnerability analysis model includes a first graph convolution layer to a fourth graph convolution layer, wherein the first graph convolution layer to the third graph convolution layer respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

[0036] Furthermore, the traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes IP address, MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

[0037] In the above solution, the virus feature fingerprint matching of the knowledge graph integrated with network information is achieved through graph neural network, which enables accurate identification of potential risk points, helps to intuitively identify the locations of vulnerabilities and complex attack chains, and thus better helps enterprises to carry out targeted vulnerability patching and risk control.

[0038] Furthermore, the query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped by using the query tool according to the pre-network knowledge graph to generate a network full-link knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes:

[0039] Accessing a pre-IP list of routing devices connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining an IP address of a host device connected to the subnet according to the pre-IP list;

[0040] According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

[0041] Furthermore, the process of actively mapping the pre-IP list through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection node and the detection target IP address of the pre-network knowledge graph includes:

[0042] Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol;

[0043] The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

[0044] Furthermore, the process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes:

[0045] The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

[0046] In the above scheme, by combining the network active mapping method based on ICMP protocol tools with the network active mapping method based on SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0047] Compared with the prior art, the present invention has the following advantages:

[0048] 1. The advantages and disadvantages of active network mapping and passive network mapping are complementary. The number of detection nodes of active network mapping is reduced through minimum spanning tree clustering, which improves the detection efficiency. The network vulnerability analysis model based on graph neural network is used to improve the perception ability and effectiveness of risk detection. Together, the topological relationship of industrial asset networks is integrated based on knowledge graphs, which enables intuitive visualization and detection of key nodes, potential security vulnerabilities and attack paths, thereby improving the security protection level of industrial assets.

[0049] 2. Through the greedy algorithm, k-means clustering algorithm and detection cost estimation, the topological relationship between the subnet and the routing device, the host, as well as the detection node and the detection target IP address are determined step by step. While integrating the topological relationship of the industrial asset network based on the knowledge graph, the detection efficiency of active network mapping is improved.

[0050] 3. By integrating virus feature fingerprints of network information into knowledge graphs through graph neural networks, accurate identification of potential risk points is achieved, which helps to intuitively identify vulnerability points and complex attack chains, and thus better help enterprises to carry out targeted vulnerability patching and risk control.

[0051] 4. By combining the network active mapping method based on ICMP protocol tools with the network active mapping method based on SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a flow chart of a full-link industrial asset security mapping method based on a knowledge graph according to an embodiment of the present invention;

[0053] Figure 2This is a flow chart of a detection strategy determination model based on minimum spanning tree clustering in a full-link industrial asset security mapping method based on a knowledge graph according to an embodiment of the present invention;

[0054] Figure 3 Schematic diagram of the minimum spanning tree structure of the full-link industrial asset security mapping method based on the knowledge graph according to an embodiment of the present invention;

[0055] Figure 4 A schematic diagram of a pre-network knowledge graph of a full-link industrial asset security mapping method based on a knowledge graph according to an embodiment of the present invention;

[0056] Figure 5 A schematic diagram of a network full-link knowledge graph of a full-link industrial asset safety mapping method based on a knowledge graph according to an embodiment of the present invention;

[0057] Figure 6 This is a schematic diagram of the network vulnerability analysis model structure based on graph neural network of the full-link industrial asset security mapping method based on knowledge graph in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0059] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0060] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside", and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0061] Furthermore, it should be noted that, in the description of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0062] like Figures 1 to 6As shown, the present invention provides a full-link industrial asset security mapping method based on knowledge graph, which realizes the complementary advantages and disadvantages of active network mapping and passive network mapping, reduces the number of detection nodes of active network mapping through minimum spanning tree clustering, improves the detection efficiency, and improves the perception ability and effectiveness of risk detection through the network vulnerability analysis model based on graph neural network, and jointly realizes the integration of industrial asset network topology relationship based on knowledge graph, so that key nodes, potential security vulnerabilities and attack paths can be intuitively visualized and detected, thereby improving the security protection level of industrial assets.

[0063] like Figures 1 to 6 As shown, this embodiment proposes a full-link industrial asset security mapping method based on knowledge graph, including:

[0064] Obtain HTTP protocol messages of the industrial asset network to be mapped through network passive mapping, and determine the subnet IP address range by parsing the HTTP protocol messages;

[0065] The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering;

[0066] Actively mapping the network to be mapped using a query tool based on the pre-network knowledge graph to generate a full-link network knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet;

[0067] Obtaining network security information of the routing device and the host device through a traffic firmware analysis tool;

[0068] The network security information and the network full-link knowledge graph are used to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network.

[0069] Passive Network Topology Discovery (PND) is a technique for inferring network topology by passively receiving network traffic. Unlike active network mapping, PND does not send probe packets to the network. Instead, it parses the protocol packets contained in network traffic to determine the subnet IP address range.

[0070] Specifically, by analyzing the request and response packets of network traffic in HTTP protocol packets using packet capture tools such as Wireshark and tcpdump, information such as IP addresses and host names is extracted, thereby inferring the IP address range of the subnet. Therefore, the nature of passive network mapping dictates that the computing power required for mapping is low, but in-depth mapping and analysis are difficult. Therefore, this embodiment performs more efficient active network mapping by performing minimum spanning tree clustering analysis on the results of passive network mapping after passive mapping, thereby achieving more accurate, comprehensive, and efficient network mapping and generating a comprehensive, high-precision network full-link knowledge graph.

[0071] The network mapping process combining the above network passive mapping and network active mapping can be achieved through Figure 3 The knowledge graph generation process shown is visualized, which facilitates personnel adjustments and the use of network mapping results by the industrial asset security team.

[0072] Further, if Figure 2 、 3 As shown in 4, the process of generating a pre-network knowledge graph reflecting the detection nodes and detection target IP addresses by using the detection strategy determination model based on minimum spanning tree clustering based on the geographic information corresponding to the subnet IP address range includes:

[0073] Calculate the device distance based on the geographical information of multiple devices corresponding to the subnet IP address range;

[0074] The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel;

[0075] Determine the sub-model for the subnet IP address range by detecting nodes according to the connection relationship of the minimum spanning tree structure graph to generate the detection node and the pre-detection target IP address;

[0076] generating a detection cost value from the detection node to multiple pre-detection target IP addresses using a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and selecting the detection target IP address from the pre-detection target IP addresses based on the detection cost value;

[0077] Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address;

[0078] The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

[0079] It should be noted that if Figure 3As shown, the nodes in the minimum spanning tree structure diagram described in this embodiment are routing devices and host devices, and the edges are device distances, such as Figure 4 As shown, the nodes of the pre-network knowledge graph are the host devices, routing devices, detection nodes and port tables on the detection target IP addresses in the subnet, such as Figure 5 As shown, the network full-link knowledge graph is preferably a network topology relationship diagram that only displays a large number of device topology relationships after active network mapping and is stored and displayed in a standard knowledge graph relationship. It is constructed by triplets of multiple knowledge graphs. In this embodiment, the triplets are preferably routing device-subnet-IP address segment and bridge-subnet-IP address.

[0080] It is understood that the detection node refers to a node deployed globally, fixed in position, and capable of sending detection packets to detection targets, including landmark nodes and target IP addresses. Its task is to send detection packets to obtain device information in cyberspace. The target IP address is the IP address that needs to be located or detected. By detecting the port table on the target IP address, the detection packet can be sent directly to the detection device for specific detection.

[0081] Specifically, the set of detection target geographic information used for clustering is determined based on the subnet IP address range. Geographic information, such as MaxMind, can easily perform clustering operations, while the correlation between IP addresses is weak and cannot be clustered. During the clustering operation, the device distance is calculated using the Euclidean distance formula.

[0082] Specifically, one of the core steps of the Minimum Spanning Tree Clustering algorithm (MST Clustering) is to construct a Minimum Spanning Tree (MST) structure graph. The topology generation submodel for constructing the MST structure graph is implemented using the Kruskal algorithm based on a greedy algorithm. More specifically, the process of generating the MST structure graph based on the Kruskal algorithm includes the following:

[0083] All edges are weighted by distance and sorted from small to large. Each edge is traversed from small to large by weight. If the two nodes of the current edge are not connected, the sets of these two nodes are merged. Otherwise, the edge is skipped. When the number of edges in the minimum spanning tree structure graph is equal to the number of nodes minus 1, the algorithm terminates.

[0084] Furthermore, the process of generating a detection node and a pre-detection target IP address by determining a sub-model through a detection node for a subnet IP address range according to the connection relationship of the minimum spanning tree structure graph includes:

[0085] A cluster set is generated based on the connection relationship of the minimum spanning tree structure diagram and the detection target geographic information set corresponding to the subnet IP address range; the cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node and the pre-detection target IP address is generated.

[0086] It is understandable that since the minimum spanning tree structure diagram is generated based on the results of passive network mapping, it is bound to be inaccurate and incomplete. Therefore, by using a clustering algorithm to generate detection nodes and detection target IP addresses for further active network mapping, the passive network mapping results can guide active network mapping and improve the efficiency of active network mapping.

[0087] Specifically, the cluster set is a set of detection target geographic information, which is determined comprehensively based on the geographic distance of the geographic information and whether there is a connection relationship. That is, the geographic distance of the IP address with a connection relationship is judged to be greater than the threshold. If it exceeds, it is deleted, thereby avoiding invalid network detection / mapping.

[0088] Specifically, the number of clusters of the k-means clustering algorithm is set according to the number of edges in the minimum spanning tree structure graph. For example, if the number of edges is 5, the number of clusters k is 5. The Euclidean distance to each centroid is calculated, and each target point is assigned to the category with the nearest centroid. The clustering results are saved in a two-dimensional array data structure. The first dimension data is the centroid number, that is, the cluster cluster, the detection node, and the second dimension data is the geographic information, which is converted into the pre-detection target IP address.

[0089] Furthermore, the detection cost is calculated based on the computing power performance value, wherein the computing power performance value includes CPU efficiency ratio, throughput and forwarding rate, specifically:

[0090]

[0091] Where, is the detection cost of the i-th node, are the distance, CPU efficiency, throughput, forwarding rate and network traffic respectively, are hyperparameters, preferably 0.1, 0.1, and 0.5, It is the number of remaining detection nodes after the execution of the previous round of detection tasks. It can be understood that the role of distance and CPU efficiency ratio is to evaluate the communication overhead of the detection cost. When the distance is large, the detection task requires more resources to cover farther nodes. The throughput (that is, the amount of data processed per unit time) and forwarding rate (that is, the efficiency of data forwarding) will have a certain impact on the detection cost, so they are taken into account by smaller hyperparameters. Network traffic (that is, the data load in the network) has a greater impact on the detection efficiency, so it is taken into account by larger hyperparameters. The number of remaining detection nodes It reflects the current load situation and avoids continuing to invest in nodes when the load is too large, so as to achieve optimal configuration of detection nodes.

[0092] It can be understood that by calculating the detection cost values ​​of all detection nodes and then selecting the detection target IP address with the smallest detection cost value from the pre-detection target IP addresses, a reliable active network mapping strategy can be formulated, and when a new detection task is added, the above process can be repeated to formulate a new detection strategy and realize dynamic updating of the detection strategy.

[0093] In the above scheme, the topological relationship between the subnet and the routing device, the host, as well as the detection node and the detection target IP address are determined step by step through the greedy algorithm, the k-means clustering algorithm and the detection cost estimation. This realizes the integration of the industrial asset network topology relationship based on the knowledge graph and improves the detection efficiency of active network mapping.

[0094] Further, if Figure 4 and 5 As shown in the figure, the process of using network security information and the network full-link knowledge graph to determine the risk points of industrial assets through a network vulnerability analysis model based on a graph neural network includes:

[0095] Generate an adjacency matrix of the network vulnerability analysis model using the network security information, and generate a degree matrix of the network vulnerability analysis model using the network full-link knowledge graph;

[0096] A virus feature fingerprint library is generated through virus simulation software, and the virus feature fingerprint library and the network full-link knowledge graph are used to train and test the network vulnerability analysis model; the adjacency matrix and the degree matrix are matched with virus feature fingerprints by the tested network vulnerability analysis model to determine the risk points of the industrial assets.

[0097] Specifically, the virus feature fingerprint is a time series distribution feature of abnormal traffic.

[0098] Further, if Figure 6 As shown, the network vulnerability analysis model includes the first to fourth graph convolution layers, wherein the first to third graph convolution layers respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

[0099] Specifically, the gradient hidden layer / hidden layer of each layer from the first to the fourth convolutional layer uses a 3×3 convolution kernel with a stride of 1. The nonlinear activation function uses the ReLU activation function, which adds nonlinearity and allows for a certain amount of negative values. The number of output channels for the first convolutional layer is set to 64, and the number of output channels for the second convolutional layer is set to 128, respectively. Therefore, through four convolutions, the underlying features of the image, including edges, texture, and shape, are extracted layer by layer, ensuring rich feature information and enhancing feature representativeness.

[0100] Furthermore, the traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes IP address, MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

[0101] Specifically, the traffic analysis tool performs analysis based on the traffic data obtained by active and passive adaptive detection, and some traffic analysis tools can be used, such as Wireshark, tcpdump, etc. The information of the devices in the network is automatically extracted, mainly including the source IP information, target IP address, MAC address, AP detection data and other information of the data packet to extract device information, and firmware analysis is performed at the same time. The firmware mentioned in this embodiment is not hardware, but software, generally referring to a binary program stored in a non-volatile memory, which is usually burned directly onto the hardware development board. The first step of firmware analysis is to use the Binwalk tool or other unpacking tools to analyze the network device firmware package, and dig out as much information as possible. Then, using the extracted valuable information, a combination of static analysis and dynamic simulation can be used to conduct network device vulnerability mining and analysis to obtain the security status of the devices connected to the network.

[0102] In the above solution, the virus feature fingerprint matching of the knowledge graph integrated with network information is achieved through graph neural network, which enables accurate identification of potential risk points, helps to intuitively identify the locations of vulnerabilities and complex attack chains, and thus better helps enterprises to carry out targeted vulnerability patching and risk control.

[0103] Furthermore, the query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped by using the query tool according to the pre-network knowledge graph to generate a network full-link knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes:

[0104] Accessing a pre-IP list of routing devices connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining an IP address of a host device connected to the subnet according to the pre-IP list;

[0105] According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

[0106] Furthermore, the process of actively mapping the pre-IP list through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection node and the detection target IP address of the pre-network knowledge graph includes:

[0107] Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol;

[0108] The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

[0109] Furthermore, the process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes:

[0110] The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

[0111] Specifically, the current status of hosts within a subnet is typically detected using the ICMP ping method. Pinging all possible IP addresses within a subnet sequentially can be somewhat blind, increasing network burden. Combining ICMP-based topology discovery with ARP-based topology discovery first accesses the ipNetToMediaTable table in the MIB library of the gateway connected to the subnet. The variable ipNetToMediaNetAddress in the table is used to determine the IP addresses of the hosts actually connected to the subnet. These actual IP addresses are then pinged to determine the host status. This significantly reduces the number of pings, improves algorithm efficiency, and reduces network burden. Furthermore, asynchronous pinging can be used to shorten detection time.

[0112] The type of network device can be determined by accessing the ipFowarding and sysServices variables in the MIB library. The ipFowarding variable indicates whether the network device has the ability to forward IP packets. If it has this function, the value is 1, indicating that the device is a gateway; if it does not have this function, the value is 2.

[0113] The value of sysServices indicates the set of services a network device can provide and can be used to determine the OSI layer the device operates at. For example, if sysServices = 2, it indicates that the device operates at the data link layer, meaning it is a bridge.

[0114] For network interfaces, the interface table (ifTable) is used to describe them in the MIB library. The ifType field in the interface table is used to describe the type of the interface, represented by an integer. By accessing the value of the ifType field in the interface table and comparing it with the network interface type table, the network interface of the network device can be determined.

[0115] In the above scheme, by combining the network active mapping method based on ICMP protocol tools with the network active mapping method based on SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0116] As a specific implementation of this embodiment, after obtaining the network topology of the local area network and storing it in a network topology data structure, a minimum spanning tree algorithm is used to select mapping nodes. The data structure storing the network topology is input into the algorithm. The algorithm selects seed nodes based on weight and distance. The weight can be based on the number of ports and network connections of the current node. After the algorithm completes, a minimum spanning tree is generated, which is the network mapping sequence.

[0117] After acquiring several nodes in the current network topology as seed nodes, formal detection begins, primarily using active and passive adaptive detection. As the name implies, active and passive adaptive detection automatically complements the strengths and weaknesses of active and passive detection based on target type and status. Within the mapping range of the seed node, a preliminary assessment of the target node's situation is made through passive detection, followed by adaptive active detection for further in-depth exploration and analysis. This allows information to be obtained even from target nodes that do not actively generate traffic. Furthermore, since there are multiple seed nodes in the network topology, each responsible for different mapping areas, the use of active detection does not significantly impact the equipment and can significantly improve the accuracy and effectiveness of network detection. In short, the goal of active and passive adaptive detection is to obtain as comprehensive and accurate information on network resource attributes as possible without affecting network performance or increasing network load.

[0118] While using active and passive adaptive detection, use traffic analysis and firmware analysis technology to obtain more data from the network. Traffic analysis needs to be performed based on the traffic data obtained by active and passive adaptive detection. Some traffic analysis tools can be used, such as Wireshark, tcpdump, etc. Automatically extract the information of devices in the network, mainly the source IP information, destination IP address, MAC address and other information of the data packet. Extract device information and perform firmware analysis at the same time. The firmware mentioned in this patent is not hardware, but software, which generally refers to binary programs stored in non-volatile memory and is usually burned directly onto the hardware development board. The first step in firmware analysis is to use the Binwalk tool or other unpacking tools to analyze the network device firmware package, dig out as much information as possible, and then use the extracted valuable information to combine static analysis with dynamic simulation to conduct network device vulnerability mining and analysis to obtain the security status of devices connected to the network.

[0119] After active and passive adaptive detection, traffic analysis, and firmware analysis, the seed node can obtain all device information within its mapping range, including the device's basic information, security information, and whether it is authentic and valid. Combined with the network topology information at the seed device, all asset mapping information within the current range can be obtained. The seed node transmits the mapping information to the mapping node, which integrates the seed node's scanning results to map the asset information within the global area network.

[0120] According to the distribution of information assets within the network coverage, combined with the detailed asset information obtained by surveying and mapping, it contains both structured data and semi-structured and unstructured data. First, the structured data is automatically extracted, and the unstructured data needs to extract information such as entities, attributes, and relationships. Finally, the extracted information is converted into triples suitable for graph storage. Each triple is composed of a subject (entity), a predicate (relationship), and an object (entity or attribute). It should be noted that in this embodiment, the triples are routing device-subnet-IP address segment, bridge-subnet-IP address, and the extracted triples are merged according to the original logical relationship. Merger. In the knowledge fusion stage, the main work is error correction and completion of knowledge; in the knowledge processing stage, the focus is on updating and purifying knowledge to form a knowledge graph, which is stored using Neo4j. It has a freely adjacent graph storage structure and better data analysis and processing capabilities. Therefore, the Neo4j graph database is used to store triple data and build a full-link industrial asset mapping information knowledge graph to facilitate interactive query and correlation analysis, improve the relevance of network asset information, and improve defense capabilities such as security performance, risk warning, and damage assessment. It fully controls important network information in the local area network, refines the asset status and the security risks faced.

[0121] At the same time, the surveying and mapping nodes and seed nodes maintain a continuous detection state. When the network topology changes, the network topology stored in the surveying and mapping system must also change. At the same time, the minimum spanning tree algorithm will be triggered to reselect the seed node. At the same time, the seed node will also monitor the changes in device information within the scope of its responsibility. Due to the smaller detection range and the joint execution of active and passive adaptive detection, traffic analysis, and firmware analysis algorithms, it can ensure that all information within the monitoring range can be updated in real time, achieving high-sensitivity monitoring and faster response speed.

[0122] Therefore, this embodiment utilizes an intelligent mapping method based on a knowledge graph, combined with graph databases, semantic analysis, and reasoning technologies, to better visualize the complex relationships between industrial assets and support dynamic updates and correlation analysis. Advantages of Intelligent Data Integration and Correlation: The knowledge graph organically integrates data from various sources (device information, network topology, protocol data, vulnerability information, threat intelligence, etc.) to form a contextually relevant graph. By correlating the multi-dimensional attributes of industrial assets (such as device model, vendor, protocol, and vulnerability), it automatically generates dependencies between assets, facilitating end-to-end security monitoring and attack path analysis. Advantages of Dynamic Updates and Real-Time Reasoning: The knowledge graph can reflect changes in the industrial environment in real time and automatically updates using dynamic data (such as network logs, traffic monitoring, and device status), ensuring timely and accurate asset mapping. Graph-based reasoning capabilities enable the knowledge graph to automatically detect potential risks and security vulnerabilities and provide remediation measures or optimization suggestions. Advantages of Context Awareness and Complex Relationship Modeling: The knowledge graph possesses semantic understanding capabilities, enabling it to identify and present complex contextual relationships. For example, not only can you see the vulnerabilities of a particular device, but you can also see its dependencies with other key devices, allowing for more targeted security protection. It can transcend the data silos of traditional methods and correlate multi-dimensional data such as asset information, threat intelligence, and operation logs, making security decisions more comprehensive and accurate. Advantages of attack path analysis and prediction: Security mapping based on knowledge graphs can automatically analyze possible attack paths for attackers. By modeling the dependencies between assets, it can discover possible penetration points and vulnerability exploitation paths, providing early warning of potential security threats. Knowledge graphs also support simulated attacks, helping security teams evaluate the effectiveness of security strategies.

[0123] This embodiment achieves complementary advantages and disadvantages between active and passive network mapping. Minimum spanning tree clustering reduces the number of detection nodes in active network mapping, improving detection efficiency. A network vulnerability analysis model based on a graph neural network improves the perception and effectiveness of risk detection. Together, they achieve the integration of industrial asset network topology relationships based on a knowledge graph, enabling intuitive visualization and detection of key nodes, potential security vulnerabilities, and attack paths, thereby enhancing the security protection level of industrial assets. A greedy algorithm, a k-means clustering algorithm, and detection cost estimation are used to determine the topological relationships between subnets, routing devices, and hosts, as well as the detection nodes and target IP addresses. This achieves the integration of industrial asset network topology relationships based on a knowledge graph while improving the detection efficiency of active network mapping. By matching virus signature fingerprints with network information integrated into the knowledge graph through a graph neural network, potential risk points can be accurately identified, helping to intuitively identify vulnerability locations and complex attack chains, thereby better assisting enterprises in targeted vulnerability patching and risk control. By combining the active network mapping method based on ICMP protocol tools with the active network mapping method based on SNMP protocol, the number of detections is further reduced, the algorithm efficiency is improved, and the overall burden of the security mapping network is reduced.

[0124] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

[0125] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that the present invention is susceptible to various modifications and variations. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A full-link industrial asset security mapping method based on knowledge graph, characterized by: include: Obtain HTTP protocol messages of the industrial asset network to be mapped through network passive mapping, and determine the subnet IP address range by parsing the HTTP protocol messages; The geographic information corresponding to the subnet IP address range is used to generate a pre-network knowledge graph reflecting the detection nodes and detection target IP addresses through a detection strategy determination model based on minimum spanning tree clustering; Actively mapping the network to be mapped using a query tool based on the pre-network knowledge graph to generate a full-link network knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet; Obtaining network security information of the routing device and the host device through a traffic firmware analysis tool; Determine the risk points of industrial assets by using the network vulnerability analysis model based on graph neural network to analyze the network security information and the network full-link knowledge graph; The process of generating a pre-network knowledge graph includes: Calculate the device distance based on the geographical information of multiple devices corresponding to the subnet IP address range; The device distance is used to generate a minimum spanning tree structure diagram reflecting the relationship between routing devices, host devices and their IP addresses in the subnet through a topology generation submodel; Determine the sub-model for the subnet IP address range by detecting nodes according to the connection relationship of the minimum spanning tree structure graph to generate the detection node and the pre-detection target IP address; generating a detection cost value from the detection node to multiple pre-detection target IP addresses using a cost formula based on the detection node's distance from the pre-detection target IP address, network traffic, and computing power performance value, and selecting the detection target IP address from the pre-detection target IP addresses based on the detection cost value; Generate the pre-network knowledge graph according to the minimum spanning tree structure diagram, the detection node and the detection target IP address; The topology generation sub-model is determined based on a greedy algorithm, and the detection node determination sub-model is determined based on a k-means clustering algorithm.

2. The full-link industrial asset security mapping method based on knowledge graph according to claim 1 is characterized in that: The process of generating the detection node and pre-detection target IP address includes: Generate a cluster set based on the connection relationship of the minimum spanning tree structure graph and the detection target geographic information set corresponding to the subnet IP address range; The cluster set is subjected to cluster calculation through the detection node determination submodel, and the cluster cluster of the cluster calculation result is used as the detection node to generate the pre-detection target IP address.

3. The full-link industrial asset security mapping method based on knowledge graph according to claim 1 is characterized in that: The detection cost value is calculated based on the computing power performance value; Among them, computing power performance values ​​include CPU efficiency ratio, throughput and forwarding rate.

4. The full-link industrial asset security mapping method based on knowledge graph according to claim 1 is characterized in that: The process of determining the risk points of industrial assets includes: Generate an adjacency matrix of the network vulnerability analysis model using the network security information, and generate a degree matrix of the network vulnerability analysis model using the network full-link knowledge graph; Generate a virus feature fingerprint library through virus simulation software, and use the virus feature fingerprint library and the network full-link knowledge graph to train and test the network vulnerability analysis model; The adjacency matrix and the degree matrix are used to perform virus feature fingerprint matching on the tested network vulnerability analysis model to determine the risk points of the industrial assets.

5. The full-link industrial asset security mapping method based on knowledge graph according to claim 1 is characterized in that: The network vulnerability analysis model includes a first graph convolution layer to a fourth graph convolution layer, wherein the first graph convolution layer to the third graph convolution layer respectively include a gradient hidden layer, a nonlinear activation function layer and a regularization layer for gradient extraction of virus feature fingerprints, and the fourth graph convolution layer includes a hidden layer and a classification activation function layer.

6. The full-link industrial asset security mapping method based on knowledge graph according to claim 1 is characterized in that: The traffic firmware analysis tool includes a traffic analysis tool and a firmware analysis tool, and the network security information includes IP address, MAC address, traffic statistics data, AP detection data and firmware data, wherein the IP address and MAC address of the routing device and the host device are obtained through the traffic analysis tool, and the traffic statistics data, AP detection data and firmware data of the routing device and the host device are obtained through the firmware analysis tool.

7. The full-link industrial asset security mapping method based on knowledge graph according to any one of claims 1 to 6 is characterized in that: The query tool includes an SNMP protocol tool and an ICMP protocol tool. The process of actively mapping the network to be mapped using the query tool based on the pre-network knowledge graph to generate a network full-link knowledge graph reflecting the relationship between routing devices, host devices and their IP addresses in the subnet includes: Accessing a pre-IP list of routing devices connected to the subnet in the pre-network knowledge graph through the SNMP protocol tool, and determining an IP address of a host device connected to the subnet according to the pre-IP list; According to the detection nodes and detection target IP addresses of the pre-network knowledge graph, the pre-IP list is actively mapped through the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph.

8. The full-link industrial asset security mapping method based on knowledge graph according to claim 7 is characterized in that: The process of actively mapping the pre-IP list using the ICMP protocol tool and the SNMP protocol tool to generate the network full-link knowledge graph according to the detection nodes and detection target IP addresses of the pre-network knowledge graph includes: Determine the active IP address of the active device in the pre-IP list by using the Ping tool of the ICMP protocol; The MIB library of the active device is accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device, and the network full-link knowledge graph is generated.

9. The full-link industrial asset security mapping method based on knowledge graph according to claim 8 is characterized in that: The process of accessing the MIB library of the active device through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device includes: The ipFowarding variable and the sysServices variable of the MIB library of the active device are accessed through the SNMP protocol tool to determine that the active IP address is the IP address of the routing device or the host device.

Images