Industrial control system safety protection capability evaluation method and device and storage medium

Abstract

The invention discloses an industrial control system safety protection capability evaluation method and device and a storage medium. The method comprises the following steps: constructing a four-level evaluation index system; constructing an initial decision matrix of the evaluated system based on the Z number, and converting each grade evaluation result in the initial decision matrix into a triangular fuzzy number; determining a reliability weight value of each Z number in the initial decision matrix, and weighting the initial decision matrix by using the reliability weight value of each Z number to obtain a decision matrix; performing normalization processing on the decision matrix to obtain a normalized decision matrix; performing weighting processing on respective corresponding elements in the normalized decision matrix by using the weight value of each evaluation index to obtain a weighted normalized decision matrix; determining a corresponding value of each evaluation object in the evaluated system by using the weighted normalized decision matrix; according to the value of each evaluation object, the safety protection capability of the evaluated system is determined, and the safety protection capability of the industrial control system can be accurately evaluated.

Description

Technical Field

[0001] This article relates to network security technology, and in particular to an evaluation method, device and storage medium for the security protection capability of an industrial control system. Background Art

[0002] With the rapid development of the industrial Internet and the deep integration of industrialization and informatization, industrial control systems, as the core of industrial production and manufacturing, are accelerating their development in the direction of networking and intelligence, laying a solid foundation for enterprises to improve production efficiency, optimize complex processes, and achieve digital transformation. But at the same time, the security boundary between industrial control systems and the Internet has become more blurred, and cyber attacks on industrial control systems have occurred frequently, and the security situation they face is becoming increasingly severe. In order to cope with the increasingly severe security risks and threats to industrial control systems, it is necessary to improve the security protection capabilities of industrial control systems in combination with the actual needs of industrial control system security protection. Therefore, it is necessary to carry out the evaluation of industrial control system information security protection capabilities, guide enterprises to implement industrial control system information security protection capability construction, and effectively improve the level of industrial control security protection. Summary of the invention

[0003] The embodiments of the present application provide a method, device and storage medium for evaluating the security protection capability of an industrial control system.

[0004] An evaluation method for the security protection capability of an industrial control system, comprising: An initial decision matrix of the evaluated system is constructed based on the Z number, wherein the initial decision matrix is ​​a matrix of I*J dimensions, and the first component A in the Z number of the i-th row and j-th column in the initial decision matrix represents the level evaluation result of the evaluation index j of the evaluation object i in the level of safety protection capability, and the second component B represents the level evaluation result of the evaluation index j of the evaluation object i in the level of reliability, wherein the maximum value of the total number of evaluation indicators corresponding to a single evaluation object among I evaluation objects is J, i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and I and J are both positive integers greater than or equal to 2; According to a preset conversion rule, each grade evaluation result in the initial decision matrix is ​​converted into a triangular fuzzy number; Determine the reliability weight value of each Z number in the initial decision matrix according to the triangular fuzzy number of the second component B in each Z number in the initial decision matrix; Using the reliability weight value of each Z number, weighting the triangular fuzzy numbers in the first component A of each of the initial decision matrices to obtain a decision matrix; Normalizing the elements of each column in the decision matrix based on the triangular fuzzy numbers in the same column in the decision matrix to obtain a normalized decision matrix; Using the weight value of each evaluation index, weighted processing is performed on the corresponding elements in the normalized decision matrix to obtain a weighted normalized decision matrix, wherein the sum of the weight values ​​of all evaluation indexes of the same evaluation object is 1; Determine the corresponding value of each evaluation object in the evaluated system by using the weighted normalized decision matrix; The security protection capability of the evaluated system is determined based on the value of each evaluation object.

[0005] A storage medium stores a computer program, wherein the computer program is configured to execute the method described above when running.

[0006] An evaluation device for the security protection capability of an industrial control system includes a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the method described above.

[0007] The embodiments of the present application, when evaluating the security protection capability of an industrial control system, solve the problems of neglect of data quality, excessive subjectivity, incomparable results, etc. existing in the prior art through Z-number reliability fusion, fuzzy number conversion, weighted reliability weights, normalization of decision matrices, and weighted weight values ​​of evaluation indicators, and provide a standardized and feasible technical solution for the accurate evaluation and optimization of the security protection capability of industrial control systems.

[0008] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0010] Figure 1 A schematic diagram of an evaluation system provided in an embodiment of the present application; Figure 2 A flowchart of a method for evaluating the security protection capability of an industrial control system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0012] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features and elements disclosed in the present application may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.

[0013] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0014] The evaluation of the security protection capability of industrial control systems is a multi-dimensional and complex problem. System security issues involve many factors, and there is a mutual coupling effect between the factors. In order to effectively evaluate the security protection capability of industrial control systems, the embodiment of this application establishes a multi-level and multi-dimensional indicator system for the security protection capability of industrial control systems.

[0015] In the embodiment of the present application, when determining the evaluation indicators of the security protection capability of the industrial control system, based on the characteristics of the industrial control system, the national standard "GB / T 41400-2022 Information Security Technology Industrial Control System Information Security Protection Capability Maturity Model" is referenced to determine the evaluation indicators of the security protection capability of the industrial control system.

[0016] Specifically, the security protection capability of the evaluated system is evaluated through at least a two-level evaluation system; wherein any content item in the kth level is provided with at least two branch content items in the k+1th level; wherein: In the kth level, at least two content items are selected as evaluation objects, and the corresponding content items of the selected content items in the k+1th level are used as evaluation indicators corresponding to the evaluation objects, wherein the at least two content items selected in the kth level belong to the same content item in the k-1th level, wherein k is an integer greater than 1.

[0017] In the above evaluation system, by obtaining the value of the evaluation object, the security protection capability of the industrial control system can be evaluated objectively and accurately.

[0018] Figure 1 This is a schematic diagram of the evaluation system provided in the embodiment of the present application. Figure 1 As shown, the evaluation system is a 4-level evaluation system, and the sequential content items from left to right are gradually refined; among them: The content item of level 1 is the security protection capability of the system being evaluated; The security protection capability of the evaluated system at level 2 includes at least one of historical security events, current security protection capability, and future threat response capability; wherein: The corresponding content item of the historical security incident in level 3 includes at least one of the historical security incident detection capability, the historical security incident response capability and the historical security incident recovery capability; The current security protection capability corresponds to a content item in level 3 including at least one of a device-level security protection capability, a hierarchical-level security protection capability, and an organization-level security protection capability; The future threat response capability corresponds to at least one of threat prediction capability, active defense capability and emergency response capability in level 3; in: The content items corresponding to the historical security incident detection capability in level 4 include at least one of the frequency of security incidents, the security incident detection rate, the security incident false alarm rate and the average detection time; The content items corresponding to the historical security incident response capability in level 4 include at least one of average response time and response measure success rate; The content items corresponding to the historical security incident recovery capability in level 4 include at least one of mean repair time and incident repair rate; The content items corresponding to the device-level security protection capability in level 4 include at least one of device physical security, device boundary protection, device access control, device communication security, device security reinforcement, and device backup and recovery; The content items corresponding to the hierarchical security protection capability in level 4 include at least one of security area division, network boundary security, remote access security, identity authentication, industrial data security, vulnerability management, threat detection and risk monitoring; The content items corresponding to the organizational-level security protection capability in level 4 include at least one of security planning and architecture, personnel management and training, threat warning, threat handling and supply chain security; The content items corresponding to the threat prediction capability in level 4 include at least one of threat intelligence coverage, average threat intelligence update time, threat prediction accuracy, and threat prediction false alarm rate; The content item corresponding to the active defense capability in level 4 includes at least one of an unknown threat detection rate, an unknown threat false alarm rate, and an unknown threat interception rate; The content items corresponding to the emergency response capability in level 4 include at least one of zero-day vulnerability response time, key operation response time and automation processing coverage.

[0019] The zero-day vulnerability response time mentioned above is used to describe the time interval from the discovery of a vulnerability to the adoption of effective countermeasures when facing a zero-day vulnerability. Zero-day vulnerabilities refer to software vulnerabilities that have not yet been made public or patched, and such vulnerabilities are often exploited by attackers to launch attacks. For industrial control systems, timely response to zero-day vulnerabilities is very important because it can reduce the time the system is exposed to unknown threats, thereby reducing security risks. This indicator is of great significance in evaluating the emergency response capabilities of industrial control systems because it is directly related to the system's reaction speed and processing efficiency when facing new and unknown threats.

[0020] The evaluation system provided in the embodiment of the present application integrates the characteristics and protection standards of industrial control systems, and establishes multi-level and multi-dimensional evaluation indicators based on three dimensions: historical security incidents, current security protection capabilities, and future threat response capabilities. It can comprehensively and systematically reflect the security protection status of industrial control systems and provide a solid foundation for accurate evaluation.

[0021] When evaluating the security protection capability of the evaluated system, the evaluation objects are at least two content items selected in the kth level, and each evaluation object corresponds to at least two evaluation indicators in the k+1th level. Therefore, it is necessary to determine the most important indicator and the least important indicator of each content item in the kth level in the k+1th level.

[0022] In an embodiment of the present application, the most important and least important indicators among the evaluation indicators corresponding to the same evaluation object are determined based on the idea of ​​stepwise weighted evaluation ratio analysis, and based on the most important and least important indicators corresponding to the same evaluation object, the weight value of each evaluation indicator corresponding to the evaluation object is determined.

[0023] The method for determining the most important and least important indicators among the evaluation indicators corresponding to the evaluation object i is as follows: Step A1: obtaining the scoring result of each evaluation indicator of the evaluation object i, wherein the scoring result is between 1 and 7, wherein the higher the scoring result, the higher the probability of occurrence of the evaluation indicator; Step A2: when j is equal to 1, the scoring result of evaluation index j is set as the initial score of evaluation index j; when j is greater than 1, the absolute value of the difference between the scoring result of evaluation index j and the scoring result of evaluation index j-1 is set as the initial score of evaluation index j; Step A3: when j is equal to 1, the initial coefficient of the evaluation index j is set to 1; when j is greater than 1, the result of adding 1 to the initial score of the evaluation index j is set as the initial coefficient of the evaluation index j; Step A4: when j is equal to 1, the initial weight of the evaluation index j is set to 1; when j is greater than 1, the ratio of the initial weight of the evaluation index j-1 to the initial coefficient of the evaluation index j is set as the initial weight of the evaluation index j; Step A5: using the sum of the initial weights of all evaluation indicators of the evaluation object i, normalize the initial weight of each evaluation indicator to obtain the normalized weight of each evaluation indicator; Step A6: Determine the most important indicator B and the least important indicator W of the evaluation object i according to the normalized weight of each evaluation indicator of the evaluation object i.

[0024] Steps A1 to A6 are described below: In step A1, at least two experts are asked to score each evaluation indicator corresponding to evaluation object i according to the 7-point Likert scale (as shown in Table 1), where the average score of evaluation indicator j is the scoring result of evaluation indicator j. ; Table 1

[0025] In step A2, the initial score of the evaluation index j is The calculation expression is .

[0026] In step A3, the initial coefficient of the evaluation index j is The calculation expression is .

[0027] In step A4, the initial weight of the evaluation index j is The calculation expression is .

[0028] In step A5, the normalized weight of the evaluation index j is The calculation expression is ,in represents the total number of evaluation indicators for evaluation object i, where is an integer greater than or equal to 2.

[0029] In step A6, the evaluation index with the highest normalized weight value in evaluation object i is selected as the most important index in evaluation object i. ; Select the evaluation index with the lowest normalized weight in evaluation object i as the least important index in evaluation object i .

[0030] The above method of determining the most important and least important indicators for each evaluation object has the following advantages: 1. Dynamic progressive quantitative analysis (steps A1-A4): The relative importance relationship between indicators is constructed by the absolute value method of difference (step A2), and the chain conduction calculation of indicator weights is realized through the recursive formula (steps A3-A4). Compared with the traditional static weight allocation, it can better reflect the dynamic correlation between indicators.

[0031] An initial coefficient adjustment mechanism is introduced (step A3) to avoid the zero value problem through "+1" smoothing processing and ensure the numerical stability of weight calculation.

[0032] 2. Scientific normalization processing (step A5): By normalizing the total sum, the mathematical constraint that the total weight is 1 is enforced, ensuring the comparability of the weights of indicators at different levels and providing a consistent quantitative benchmark for the multi-level evaluation system.

[0033] 3. Automated decision support (step A6): The most important / least important indicators are automatically identified based on the extreme values ​​of normalized weights, eliminating subjective judgment bias. It is especially suitable for rapid screening of large-scale indicator systems (such as the fourth-level indicators of industrial control systems).

[0034] 4. Risk Probability Mapping (Step A1): By directly associating the 1-7 point scale with the probability of risk occurrence, the weight calculation result naturally possesses risk warning characteristics, which is in line with the core principle of "high risk, high weight" in the field of security protection.

[0035] 5. Computational efficiency optimization: The time complexity is controlled within the linear time complexity based on the determination method of the recursive algorithm. , compared with the square time complexity of methods such as the Analytic Hierarchy Process (AHP) that require the construction of a judgment matrix , which is more suitable for industrial scenarios with high real-time requirements.

[0036] In summary, the embodiments of the present application significantly improve the analysis efficiency of complex indicator systems while maintaining accuracy, and provide key technical support for real-time quantitative evaluation of the security protection capabilities of industrial control systems.

[0037] The method of determining the weight values ​​of all evaluation indicators of evaluation object i includes: Step B1: From all evaluation indicators of evaluation object i, determine a most important indicator B and a least important indicator W, where both B and W are less than or equal to A positive integer of ; Step B2, obtaining the value of the importance of the most important indicator B relative to each other evaluation indicator of the evaluation object i, and obtaining a first preference value; and obtaining the value of the importance of other evaluation indicators of the evaluation object i relative to the least important indicator W, and obtaining a second preference value, wherein the larger the value of the first preference value and the second preference value, the higher the importance of the former relative to the latter; Step B3: based on the constraint conditions of the evaluation indicators of the evaluation object i, determine the weight value of each evaluation indicator of the evaluation object i, including: The weight value of each evaluation indicator is positive; The sum of the weight values ​​of all evaluation indicators is equal to 1; The larger value of the first absolute value and the second absolute value of each evaluation index is less than or equal to the consistency error, where: The first absolute value of the evaluation index j is the absolute value of the difference between the first ratio of the evaluation index j and the first preference value of the evaluation index j, wherein the first ratio is the ratio of the weight value of the optimal evaluation index B to the weight value of the evaluation index j; The second absolute value of the evaluation index j is the absolute value of the difference between the second ratio of the evaluation index j and the second preference value of the evaluation index j, wherein the second ratio is the ratio of the weight value of the evaluation index j to the weight value of the least important index W.

[0038] Step B2 and step B3 are described below: In step B2, the following operations are performed on all evaluation indicators of evaluation object i, including: Use 1-9 values ​​(as shown in Table 2) to determine the most important indicator for evaluation object i The first preference value relative to all other indicators of evaluation object i ; Use the values ​​1-9 (as shown in Table 2) to determine the least important indicator of all other indicators of evaluation object i relative to evaluation object i The second preference value .

[0039] Table 2

[0040]

[0041] In step B3, for all evaluation indicators of the same evaluation object i, each pair and ,have and In order to make all evaluation indicators of the same evaluation object i meet the above conditions, it is necessary to make the maximum absolute difference of each evaluation indicator of the same evaluation object and In addition, considering the non-negativity and constraints of weights, for all evaluation indicators of the same evaluation object i, the following constraints can be obtained:

[0042] The above questions are transformed into the following questions:

[0043] Solving the above problem, we can get the weight value of each evaluation index of evaluation object i and consistency error .

[0044] In addition, after obtaining the weight values ​​of all evaluation indicators of evaluation object i, the consistency index of evaluation object i is determined according to the total number of evaluation indicators of evaluation object i; Calculate the ratio between the consistency error of evaluation object i and the consistency index of evaluation object i to obtain the consistency value of evaluation object i; If the consistency value of the evaluation object i is less than a preset threshold, the weight values ​​of all evaluation indicators of the evaluation object i are determined to be allowed to participate in the weighted calculation of the elements in the normalized decision matrix.

[0045] Among them, the consistency value The calculation expression is ; in, is the consistency index, which is determined from Table 3 according to the total number of evaluation indicators of evaluation object i.

[0046] Table 3

[0047]

[0048] when , indicating that there are logical conflicts in the importance scores of evaluation indicators by different experts, and it is necessary to propose contradictory scores or re-score, so as to avoid distortion of weight calculation due to subjective bias or inconsistent cognition of experts and ensure the scientificity and reliability of the evaluation method; When , it is considered that different experts have consistent scores on the importance of the evaluation indicators, and the determined weight values ​​can participate in subsequent calculations.

[0049] The above method of determining the weight of each evaluation indicator in each evaluation object has the following advantages: 1. Structured Preference Modeling (Steps B1-B2): Through the comparison mechanism of double anchor points (most important indicator B / least important indicator W), the complex multi-indicator comparison is simplified into two sets of directional preference relationships (first preference value / second preference value), which not only retains the core logic of expert judgment but also greatly reduces the number of comparisons.

[0050] 2. Constrained optimization design (step B3): The weight allocation is transformed into a constrained optimization problem, and the consistency error is controlled by double absolute difference (first absolute value / second absolute value), which is stricter than the traditional CR test, ensuring that the weight results simultaneously meet: a) preference transitivity (the importance of B relative to other indicators) b) inverse preference consistency (the importance of other indicators relative to W) c) weight normalization (the sum is 1) 3. Enhanced industrial adaptability: Allowing non-integer preference values ​​(such as 3.5) is more in line with the fuzzy judgment in actual risk assessment than the 1-9 integer scale of AHP; The error tolerance mechanism (consistency error threshold) is used to automatically balance the subjective differences of experts and avoid the common problem of repeated matrix adjustment in AHP.

[0051] 4. Improved computing performance: The weight value is solved based on the convex optimization problem under linear constraints to improve the efficiency of weight solution.

[0052] In summary, the embodiments of the present application, through dual-anchor preference modeling and constrained optimization theory, while maintaining the scientific nature of decision-making, solve the efficiency bottleneck and subjective problems of traditional methods in large-scale indicator evaluation of industrial control systems.

[0053] Figure 2 A flow chart of a method for evaluating the security protection capability of an industrial control system provided in an embodiment of the present application. Figure 2 As shown, the method evaluates the industrial control system by at least two evaluation indicators of each of I evaluation objects, wherein the maximum value of the total number of evaluation indicators corresponding to a single evaluation object in I evaluation objects is J, and the method includes: Step C1, constructing an initial decision matrix of the evaluated system based on the Z number, wherein the initial decision matrix is ​​an I*J-dimensional matrix, and the first component A of the Z number in the i-th row and j-th column in the initial decision matrix represents the level evaluation result of the evaluation index j of the evaluation object i in the level of safety protection capability, and the second component B represents the level evaluation result of the evaluation index j of the evaluation object i in the level of reliability, wherein i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and wherein I and J are both positive integers greater than or equal to 2; Step C2, converting each grade evaluation result in the initial decision matrix into a triangular fuzzy number according to a preset conversion rule; Step C3, determining the reliability weight value of each Z number in the initial decision matrix according to the triangular fuzzy number of the second component B in each Z number in the initial decision matrix; Step C4, using the reliability weight value of each Z number, weighting the triangular fuzzy numbers in the first component A of each of the initial decision matrices to obtain a decision matrix; Step C5, normalizing the elements of each column in the decision matrix based on the triangular fuzzy numbers in the same column in the decision matrix to obtain a normalized decision matrix; Step C6: using the weight value of each evaluation index, weighting the corresponding elements in the normalized decision matrix to obtain a weighted normalized decision matrix, wherein the sum of the weight values ​​of all evaluation indexes of the same evaluation object is 1; Step C7: using the weighted normalized decision matrix, determining the corresponding value of each evaluation object in the evaluated system; Step C8: Determine the security protection capability of the evaluated system according to the value of each evaluation object.

[0054] The embodiment of the present application provides a method to achieve a scientific quantitative evaluation of the security protection capability of an industrial control system, and its core advantages are as follows: 1. Fusion reliability assessment (Z number application): The initial decision matrix (step C1) adopts the Z number (the first component A is the evaluation result of the safety protection capability level, and the second component B is the evaluation result of the reliability level), taking into account the indicator score and data credibility at the same time, avoiding the one-sidedness of a single value and improving the robustness of the evaluation results. For example, an indicator with a high score but low reliability will not excessively affect the final conclusion.

[0055] 2. Dynamic fuzzy data processing: The triangular fuzzy number conversion (step C2) quantifies the linguistic variables (e.g., strong or medium) into fuzzy numbers (l, m, u)), retaining the uncertainty in the expert judgment; and the reliability weight calculation (step C3) generates weights based on the second component B to ensure that high-confidence data dominates the decision, achieving fuzziness compatible with subjective evaluation, while suppressing low-quality data noise through weights.

[0056] 3. Double weighting mechanism: The triangular fuzzy number of the first component of each element in the initial decision matrix is ​​adjusted using the reliability weight value of the second component of each element in the initial decision matrix (step C4) to reduce the impact of low-reliability grade evaluation results on the evaluation results; at the same time, ensure that high-reliability grade rating results dominate.

[0057] The weight values ​​of the evaluation indicators are used to weight the respective triangular fuzzy numbers in the normalized decision matrix to ensure that the contribution of important indicators to the total score is greater than that of minor indicators to the total score.

[0058] Based on the above double weighting mechanism, the coordinated optimization of data quality and indicator importance is achieved to avoid single-dimensional deviation.

[0059] 4. Normalization: Normalizing the elements of the corresponding column in the decision matrix based on the triangular fuzzy numbers in the same column in the decision matrix (step C5) can eliminate dimensional differences and ensure cross-indicator comparability.

[0060] To summarize, the method provided in the embodiments of the present application, when evaluating the security protection capability of an industrial control system, solves the problems of neglect of data quality, excessive subjectivity, and incomparable results existing in the prior art through Z-number reliability fusion, fuzzy number conversion, weighted reliability weights, normalization of decision matrices, and weighted weight values ​​of evaluation indicators, and provides a standardized and feasible technical solution for the accurate evaluation and optimization of the security protection capability of industrial control systems.

[0061] Steps C1 to C8 are described below: In step C1, the initial decision matrix with Z number elements is constructed using Z number , including I evaluation objects and J evaluation indicators, where the Z number is a fuzzy number considering reliability, expressed as .

[0062] Among them, the first component A is the level evaluation result of the security protection capability, which can be very poor (VL), poor (L), relatively poor (ML), medium (M), relatively strong (MH), strong (H) or very strong (VH); the second component A is the level evaluation result of the reliability, which can be very poor (VL), poor (L), medium (M), strong (H) or very strong (VH).

[0063] Among them, the grade evaluation result of the second component B of the Z number mainly reflects the credibility of the data source, but it also covers the comprehensive evaluation of data quality and the stability of evaluation indicators.

[0064] For example, the first component and the second component of the Z-number of the evaluation index of a certain evaluation object are strong (H) and medium (M), respectively.

[0065] In step C2, each level evaluation result in the initial decision matrix is ​​converted into a triangular fuzzy number by combining the conversion rules of the linguistic variables for evaluating the security protection capability of the industrial control system (as shown in Table 4) and the conversion rules of the reliability linguistic variables (as shown in Table 5).

[0066] Table 4

[0067]

[0068] Table 5

[0069]

[0070] Taking the first component and the second component of the Z number as an example, which are strong (H) and medium (M), respectively, based on Table 4, we can get the triangular fuzzy number corresponding to the first component strong (H) is (7, 9, 10), and based on Table 5, we can get the triangular fuzzy number corresponding to the second component medium (M) is (0.3, 0.5, 0.7), and we can get the initial decision matrix The element is represented as [(7,9,10), (0.3,0.5,0.7)].

[0071] By analogy, we can get the initial decision matrix including triangular fuzzy numbers: The details are as follows:

[0072] in, Indicates The first evaluation object The triangular fuzzy number corresponding to the level evaluation result of the safety protection capability of the evaluation index is Indicates The first evaluation object The triangular fuzzy number corresponding to the grade evaluation result of the reliability of the evaluation index.

[0073] In step C3, ,in and is a triangular membership function. Therefore, the calculation expression of the reliability weight is as follows: ; in, represents the reliability weight, The triangular membership function of the second component B represents the grade evaluation result of the second component B The membership degree of Represents a variable The increment by which integration is performed.

[0074] Based on the above expression, the second component of the Z number can be The triangular fuzzy number is converted into an exact value. Taking the elements [(7,9,10), (0.3,0.5,0.7)] as an example, the reliability weight is 0.5.

[0075] In step C4, the initial decision matrix One implementation method of weighting the triangular fuzzy numbers in the first component A of each is as follows: ; The above expression defines a reliability weight Adjusted fuzzy sets ,in: By Satisfaction All elements and their corresponding membership Composition, of which express right The membership degree of is the original membership function By reliability weight The result after scaling.

[0076] Among them, for the initial decision matrix Another way to weight the triangular fuzzy numbers in the first component A of each is as follows: The initial decision matrix The decision matrix is ​​obtained by multiplying the triangular fuzzy number of the first component A of each element by the square root of the respective reliability weight. The triangular fuzzy number of each element in .

[0077] Continuing with the above example, we can set the reliability weight The triangular fuzzy number of the first component in the Z number is weighted and the calculation expression is: , we can get the following: ; in, will serve as an element in the decision matrix.

[0078] Compared with directly using the reliability weight, the square root value based on the reliability weight has the following advantages: 1. Balance weight impact: The square root function is a concave function with a decreasing growth rate. This means that the increase in high-weight values ​​will be moderately suppressed, while the relative role of low-weight values ​​will be retained. This operation can prevent high reliability indicators from excessively dominating decision results, while preventing low reliability indicators from being completely ignored, thereby enhancing the balance of the evaluation system.

[0079] 2. Improve the robustness of the evaluation method: The square root operation can smooth the nonlinear effect of weights and reduce the sensitivity of extreme weight values ​​to the results. For example, if the weight of an indicator is extremely high (such as 0.9), the increase of its square root (0.95) is smaller than the linear scaling, which can prevent the evaluation indicator from having too large a deviation in the comprehensive decision and improve the tolerance to outliers.

[0080] 3. Practical application significance In practical scenarios such as industrial control systems, reliability weights may reflect the uncertainty of indicators or data quality. The square root operation reduces the noise interference of low-quality data through nonlinear adjustment, while retaining its potential information value, making the evaluation results more practical.

[0081] In summary, this method achieves a balance between mathematical rigor and practical needs by introducing the square root function, which not only optimizes the rationality of weight distribution, but also enhances the adaptability in complex scenarios.

[0082] In step C5, the decision matrix The details are as follows: ; From the above content, we can know that the decision matrix is an I*J-dimensional matrix, in which each element is a triangular fuzzy number, expressed as , respectively represent the lower limit, middle value and upper limit of the triangular fuzzy number.

[0083] For the above decision matrix Perform normalization: ; For each column j, calculate the sum of the squares of the three parts of each element in all rows i, and then take the square root of the sum of squares as the normalized denominator; divide the three parts of each element by the denominator of the corresponding column to obtain the normalized value.

[0084] In step C6, the weighted normalized decision matrix as follows:

[0085] Among them, the weight value of each evaluation indicator of each evaluation object is used to weight the values ​​of the corresponding evaluation indicators in the normalized decision matrix. The calculation expression is: , and .

[0086] In step C7, due to the weighted normalized decision matrix The normalized weighted value of each evaluation object in is fuzzy and is expressed as , these values ​​should be converted to exact values ​​via the best non-fuzzyperformance (BNP).

[0087] Finally, according to the calculated The evaluation index can be The values ​​are sorted from large to small to determine the security protection capability of the industrial control system.

[0088] Preferably, the method for obtaining the corresponding value of the evaluation object i in the evaluated system includes: All evaluation indicators of evaluation object i are divided into beneficial indicators and non-beneficial indicators, where the higher the value of the beneficial indicator, the higher the safety protection capability; the higher the value of the non-beneficial indicator, the worse the safety protection capability; Calculating the difference between the sum of the beneficial indicators and the sum of the non-beneficial indicators of the evaluation object i in the weighted normalized decision matrix to obtain a comprehensive fuzzy value of the evaluation object i; According to the comprehensive fuzzy value of evaluation object i, the value of evaluation object i is determined.

[0089] Among them, beneficial indicators are indicators that meet the Beneficial Criteria, where the larger the indicator value, the more beneficial it is (e.g., the higher the "threat prediction capability" score, the stronger the security protection capability); Among them, non-beneficial indicators are indicators that meet the non-beneficial criteria, where the smaller the indicator value, the more beneficial it is (such as the shorter the "zero-day vulnerability response time", the stronger the protection capability).

[0090] Differentiating all evaluation indicators of the same evaluation object according to the above two types of standards can avoid logical contradictions in the evaluation results. For example, a logical contradiction may be that a long response time is considered to be a high protection capability.

[0091] In the evaluation object i, evaluation indexes 1 to f are all beneficial indicators, and evaluation indexes f+1 to f+1 are all beneficial indicators. If all are non-beneficial indicators, the comprehensive fuzzy value of each evaluation object is calculated by the following calculation expression, including: ; Among them, due to is a triangular fuzzy number. The above calculation needs to be performed parameter by parameter (l, m, u) according to the fuzzy number rules.

[0092] The above method of determining the comprehensive fuzzy value of the evaluation object has the following advantages, including: 1. Accurately distinguish the contribution direction of indicators: The division of beneficial indicators and non-beneficial indicators ensures the consistency of the evaluation logic, avoids misjudgment due to confusion of indicator nature, and makes the evaluation results more in line with actual safety needs.

[0093] 2. Dynamically balanced protection capability: Directly quantify the offsetting effect between indicators through difference calculation (the sum of beneficial indicators minus the sum of non-beneficial indicators). For example, if a system has a high score for a beneficial indicator and a high score for another non-beneficial indicator, the difference calculation can automatically balance the influence of the two indicators to avoid a single indicator dominating the result. It can reflect the real comprehensive protection level of the system rather than unilaterally emphasizing a certain type of indicator.

[0094] 3. Fuzzy mathematics enhances robustness: In the weighted normalized decision matrix, the elements are triangular fuzzy numbers, and the difference operation retains the fuzziness, which is compatible with the uncertainty in expert scoring and avoids the information loss caused by forced precision in traditional methods.

[0095] In summary, through directional indicator classification and fuzzy difference calculation, the scientific quantification and dynamic balance of the security protection capabilities of industrial control systems are achieved.

[0096] In the embodiment of the present application, the comprehensive fuzzy value of the evaluation object i is expressed as , as a fuzzy value, can be converted to a specific value through the best non-fuzzy performance (BNP).

[0097] Among them, the calculation expression of BNP in the related art is as follows: ; In the above calculation expression, the median is emphasized 50% of the total, upper and lower limits , Symmetrical distribution.

[0098] Different from the above expression, the conversion expression in the embodiment of the present application is as follows: ; The above calculation expression can be simplified to , that is, calculate the arithmetic mean of the triangular fuzzy numbers of the evaluation object i.

[0099] The conversion expression provided in the embodiment of the present application is used to calculate the value of the evaluation object, which has the following advantages, including: 1. High computational efficiency: No complex weight distribution is required, and the three-value average is directly taken, which has a faster calculation speed and is suitable for industrial control systems with high real-time requirements.

[0100] 2. Symmetry processing: Give equal weight to the three parameters of triangular fuzzy numbers (lower limit, median, and upper limit) to avoid potential bias caused by emphasizing the median. This method is suitable for scenarios where upper and lower limit information is equally important.

[0101] 3. Reduce subjective intervention: The "doubling of median weight" in conventional methods implies subjective judgment of experts, while the simple average method does not require manual setting of weights, thus reducing subjective interference and improving the objectivity of the results.

[0102] 4. Enhanced compatibility: When the difference between the upper and lower limits and the median of the fuzzy number is small (such as when the data distribution is concentrated), the simple average result is close to the weighted average, but the calculation is simpler; when the upper and lower limits are wide (such as when the uncertainty is high), it can avoid the weighted method ignoring the boundary effect due to the excessive weight of the median.

[0103] In step C7, the evaluation indicators are sorted from large to small according to their values ​​to determine the security protection capability of the industrial control system.

[0104] In summary, the method provided in the embodiment of the present application has the following advantages, including: 1) Multi-level, multi-dimensional industrial control system security protection capability indicator system: A multi-level, multi-dimensional four-level indicator system for industrial control system security protection capability evaluation is established from the three dimensions of historical security incidents, current security protection capabilities, and future threat response capabilities, which comprehensively covers all key elements of industrial control system security protection.

[0105] 2) Quantitative analysis of indicators at the same level: Determine the initial coefficient, initial weight and normalized initial weight of each indicator through specific calculations, and then find out the most important and least important indicators, and solve for the optimal weight value of the evaluation indicator to achieve a quantitative assessment of the importance of each evaluation indicator.

[0106] 3) Construct a decision matrix in combination with the Z number: Introduce the Z number to construct the initial decision matrix, convert its elements into triangular fuzzy numbers, and combine the industrial control system security protection capability language variable and reliability language variable conversion rules to obtain a decision matrix containing triangular fuzzy numbers. Then, after normalization and combining with weights, a weighted normalized decision matrix is ​​constructed to effectively deal with the ambiguity and uncertainty in the evaluation process.

[0107] 4) Determine the security protection capability evaluation results: Calculate the normalized weighted value according to the beneficial and non-beneficial standards, convert the fuzzy normalized weighted value into a clear value through the best non-fuzzy performance, and rank each evaluation indicator according to the value to determine the comprehensive evaluation result of the security protection capability of the industrial control system.

[0108] In addition, an embodiment of the present application further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the method described above when running.

[0109] An embodiment of the present application also provides an evaluation device for the security protection capability of an industrial control system, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the method described above.

[0110] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A method for evaluating the security protection capability of an industrial control system, comprising: An initial decision matrix of the evaluated system is constructed based on the Z number, wherein the initial decision matrix is ​​a matrix of I*J dimensions, and the first component A of the Z number of the i-th row and j-th column in the initial decision matrix represents the level evaluation result of the evaluation index j of the evaluation object i in the level of safety protection capability, and the second component B represents the level evaluation result of the evaluation index j of the evaluation object i in the level of reliability, wherein the maximum value of the total number of evaluation indicators corresponding to a single evaluation object among I evaluation objects is J, i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and I and J are both positive integers greater than or equal to 2; According to a preset conversion rule, each grade evaluation result in the initial decision matrix is ​​converted into a triangular fuzzy number; Determine the reliability weight value of each Z number in the initial decision matrix according to the triangular fuzzy number of the second component B in each Z number in the initial decision matrix; Using the reliability weight value of each Z number, weighting the triangular fuzzy numbers in the first component A of each of the initial decision matrices to obtain a decision matrix; Normalizing the elements of each column in the decision matrix based on the triangular fuzzy numbers in the same column in the decision matrix to obtain a normalized decision matrix; Using the weight value of each evaluation index, weighted processing is performed on the corresponding elements in the normalized decision matrix to obtain a weighted normalized decision matrix, wherein the sum of the weight values ​​of all evaluation indexes of the same evaluation object is 1; Determine the corresponding value of each evaluation object in the evaluated system by using the weighted normalized decision matrix; The security protection capability of the evaluated system is determined based on the value of each evaluation object.

2. The method according to claim 1, characterized in that The method for obtaining the weight values ​​of all evaluation indicators of evaluation object i includes: From all the evaluation indicators of the evaluation object i, determine the most important indicator B and the least important indicator W, where B and W are both less than or equal to A positive integer, where is the total number of evaluation indicators of evaluation object i, is an integer greater than or equal to 2 and less than or equal to J; Obtain the value of the importance of the most important indicator B relative to each other evaluation indicator of the evaluation object i to obtain a first preference value; and obtain the value of the importance of other evaluation indicators of the evaluation object i relative to the least important indicator W to obtain a second preference value, wherein the larger the value of the first preference value and the second preference value, the higher the importance of the former relative to the latter; Based on the constraint conditions of the evaluation indicators of the evaluation object i, the weight value of each evaluation indicator of the evaluation object i is determined, wherein the constraint conditions include: The weight value of each evaluation indicator is positive; The sum of the weight values ​​of all evaluation indicators is equal to 1; The larger value of the first absolute value and the second absolute value of each evaluation index is less than or equal to the consistency error, where: The first absolute value of the evaluation index j is the absolute value of the difference between the first ratio of the evaluation index j and the first preference value of the evaluation index j, wherein the first ratio is the ratio of the weight value of the optimal evaluation index B to the weight value of the evaluation index j; The second absolute value of the evaluation index j is the absolute value of the difference between the second ratio of the evaluation index j and the second preference value of the evaluation index j, wherein the second ratio is the ratio of the weight value of the evaluation index j to the weight value of the least important index W.

3. The method according to claim 2, characterized in that The method for determining the most important indicator B and the least important indicator W of the evaluation object i includes: Obtain the scoring result of each evaluation indicator of the evaluation object i, where the scoring result is between 1 and 7, and the higher the scoring result, the higher the probability of occurrence of the evaluation indicator; When j is equal to 1, the scoring result of evaluation index j is set as the initial score of evaluation index j; when j is greater than 1, the absolute value of the difference between the scoring result of evaluation index j and the scoring result of evaluation index j-1 is set as the initial score of evaluation index j; When j is equal to 1, the initial coefficient of evaluation index j is set to 1; when j is greater than 1, the result of adding 1 to the initial score of evaluation index j is set as the initial coefficient of evaluation index j; When j is equal to 1, the initial weight of evaluation index j is set to 1; when j is greater than 1, the ratio of the initial weight of evaluation index j-1 to the initial coefficient of evaluation index j is set as the initial weight of evaluation index j; Using the sum of the initial weights of all evaluation indicators of evaluation object i, the initial weight of each evaluation indicator is normalized to obtain the normalized weight of each evaluation indicator; According to the normalized weight of each evaluation indicator of evaluation object i, the most important indicator B and the least important indicator W of evaluation object i are determined.

4. The method according to claim 2, characterized in that: The method further comprises: After obtaining the weight values ​​of all evaluation indicators of evaluation object i, the consistency index of evaluation object i is determined according to the total number of evaluation indicators of evaluation object i; Calculate the ratio between the consistency error of evaluation object i and the consistency index of evaluation object i to obtain the consistency value of evaluation object i; If the consistency value of the evaluation object i is less than a preset threshold, the weight values ​​of all evaluation indicators of the evaluation object i are determined to be allowed to participate in the weighted calculation of the elements in the normalized decision matrix.

5. The method according to claim 1, characterized in that The method for obtaining the corresponding value of the evaluation object i in the evaluated system includes: All evaluation indicators of evaluation object i are divided into beneficial indicators and non-beneficial indicators, where the higher the value of the beneficial indicator, the higher the safety protection capability; the higher the value of the non-beneficial indicator, the worse the safety protection capability; Calculating the difference between the sum of the beneficial indicators and the sum of the non-beneficial indicators of the evaluation object i in the weighted normalized decision matrix to obtain a comprehensive fuzzy value of the evaluation object i; According to the comprehensive fuzzy value of evaluation object i, the value of evaluation object i is determined.

6. The method according to claim 5, characterized in that: The calculation expression of the value of evaluation object i is ; in, It is the expression of triangular fuzzy number of the comprehensive fuzzy value of evaluation object i.

7. The method according to claim 1, characterized in that The method evaluates the security protection capability of the evaluated system through at least a two-level evaluation system; wherein any content item in the kth level is provided with at least two branch content items in the k+1th level; wherein: In the kth level, at least two content items are selected as evaluation objects, and the corresponding content items of the selected content items in the k+1th level are used as evaluation indicators corresponding to the evaluation objects, wherein the at least two content items selected in the kth level belong to the same content item in the k-1th level, wherein k is an integer greater than 1.

8. The method according to claim 7, characterized in that: The content item of level 1 is the security protection capability of the system being evaluated; The security protection capability of the evaluated system at level 2 includes at least one of historical security events, current security protection capability, and future threat response capability; wherein: The corresponding content item of the historical security incident in level 3 includes at least one of the historical security incident detection capability, the historical security incident response capability and the historical security incident recovery capability; The current security protection capability corresponds to a content item in level 3 including at least one of a device-level security protection capability, a hierarchical-level security protection capability, and an organization-level security protection capability; The future threat response capability corresponds to at least one of threat prediction capability, active defense capability and emergency response capability in level 3; in: The content items corresponding to the historical security incident detection capability in level 4 include at least one of the frequency of security incidents, the security incident detection rate, the security incident false alarm rate and the average detection time; The content items corresponding to the historical security incident response capability in level 4 include at least one of average response time and response measure success rate; The content items corresponding to the historical security incident recovery capability in level 4 include at least one of mean repair time and incident repair rate; The content items corresponding to the device-level security protection capability in level 4 include at least one of device physical security, device boundary protection, device access control, device communication security, device security reinforcement, and device backup and recovery; The content items corresponding to the hierarchical security protection capability in level 4 include at least one of security area division, network boundary security, remote access security, identity authentication, industrial data security, vulnerability management, threat detection and risk monitoring; The content items corresponding to the organizational-level security protection capability in level 4 include at least one of security planning and architecture, personnel management and training, threat warning, threat handling and supply chain security; The content items corresponding to the threat prediction capability in level 4 include at least one of threat intelligence coverage, average threat intelligence update time, threat prediction accuracy, and threat prediction false alarm rate; The content item corresponding to the active defense capability in level 4 includes at least one of an unknown threat detection rate, an unknown threat false alarm rate, and an unknown threat interception rate; The content items corresponding to the emergency response capability in level 4 include at least one of zero-day vulnerability response time, key operation response time and automation processing coverage.

9. The method according to any one of claims 1 to 8, characterized in that: The calculation expression of the reliability weight is: ; in, represents the reliability weight, The triangular membership function of the second component B represents the grade evaluation result of the second component B The membership degree of Represents a variable x The increment by which integration is performed.

10. The method according to claim 9, characterized in that The method for obtaining the decision matrix includes: The triangular fuzzy number of the first component A of each element in the initial decision matrix is ​​multiplied by the square root of the respective reliability weight to obtain the triangular fuzzy number of each element in the decision matrix.

11. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 10 when executed.

12. An evaluation device for the security protection capability of an industrial control system, comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 10.

Images