Evaluation Method, Device and Storage Medium for Industrial Control System Security Protection Capability

Abstract

An evaluation method, device, and storage medium for the security protection ability of an industrial control system. The method includes: constructing a four-level evaluation index system; constructing an initial decision matrix of the system to be evaluated based on Z-numbers, and converting each level evaluation result in the initial decision matrix into a triangular fuzzy number; determining the reliability weight value of each Z-number in the initial decision matrix, and using the reliability weight value of each Z-number to weight the initial decision matrix to obtain a decision matrix; performing normalization processing on the decision matrix to obtain a normalized decision matrix; using the weight value of each evaluation index to weight the corresponding elements in the normalized decision matrix to obtain a weighted normalized decision matrix; using the weighted normalized decision matrix to determine the corresponding value of each evaluation object in the system to be evaluated; and determining the security protection ability of the system to be evaluated according to the value of each evaluation object, which can accurately evaluate the security protection ability of the industrial control system.

Description

Technical Field

[0001] This document relates to network security technologies, particularly to a method, apparatus, and storage medium for evaluating the security protection capabilities of industrial control systems. Background Art

[0002] With the rapid development of the industrial Internet and the deep integration of industrialization and informatization, industrial control systems, as the central hubs of industrial production and manufacturing, are accelerating their development along the directions of networking and intelligence, laying a solid foundation for enterprises to improve production efficiency, optimize complex processes, and achieve digital transformation. However, at the same time, the security boundaries between industrial control systems and the Internet have become more blurred, and network attack incidents against industrial control systems occur frequently, facing an increasingly severe security situation. To address the increasingly severe security risks and threats of industrial control systems, it is necessary to enhance the security protection capabilities of industrial control systems in combination with the actual requirements of industrial control system security protection. Therefore, it is necessary to carry out the evaluation work of industrial control system information security protection capabilities to guide enterprises to implement the construction of industrial control system information security protection capabilities and effectively improve the industrial control security protection level. Summary of the Invention

[0003] Embodiments of the present application provide a method, apparatus, and storage medium for evaluating the security protection capabilities of industrial control systems.

[0004] A method for evaluating the security protection capabilities of industrial control systems includes:

[0005] Construct an initial decision matrix of the system to be evaluated based on Z-numbers, where the initial decision matrix is an I*J-dimensional matrix. In the initial decision matrix, the first component A of the Z-number in the i-th row and j-th column represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of security protection capabilities, and the second component B represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of reliability. Among them, the maximum value of the total number of evaluation indexes corresponding to a single evaluation object among I evaluation objects is J, i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and both I and J are positive integers greater than or equal to 2;

[0006] Convert each grade evaluation result in the initial decision matrix into a triangular fuzzy number according to a preset conversion rule;

[0007] Determine the reliability weight value of each Z-number in the initial decision matrix according to the triangular fuzzy number of the second component B in each Z-number in the initial decision matrix;

[0008] Use the reliability weight value of each Z-number to weight the triangular fuzzy number in the first component A of each Z-number in the initial decision matrix to obtain a decision matrix;

[0009] Normalize the elements in each column of the decision matrix based on the triangular fuzzy numbers in the same column of the decision matrix to obtain a normalized decision matrix;

[0010] Use the weight values of each evaluation index to perform weighted processing on the corresponding elements in the normalized decision matrix to obtain a weighted normalized decision matrix, where the sum of the weight values of all evaluation indexes of the same evaluation object is 1;

[0011] Use the weighted normalized decision matrix to determine the corresponding value of each evaluation object in the system to be evaluated;

[0012] Determine the security protection ability of the system to be evaluated according to the values of each evaluation object.

[0013] A storage medium stores a computer program, wherein the computer program is configured to execute the method described above when running.

[0014] An evaluation device for the security protection ability of an industrial control system includes a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the method described above.

[0015] In the embodiment of the present application, when evaluating the security protection ability of an industrial control system, through Z-number reliability fusion, fuzzy number conversion, weighting of reliability weights, normalization processing of the decision matrix, and weighting of the weight values of evaluation indexes, the problems of ignoring data quality, being too subjective, and incomparable results in the prior art are solved, providing a standardized and implementable technical solution for the accurate evaluation and optimization of the security protection ability of industrial control systems.

[0016] Other features and advantages of the present application will be described in the subsequent specification, and part of them will become obvious from the specification, or will be understood by implementing the present application. Other advantages of the present application can be realized and obtained through the solutions described in the specification and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings are used to provide an understanding of the technical solutions of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.

[0018] Figure 1 It is a schematic diagram of the evaluation system provided by the embodiment of the present application;

[0019] Figure 2 It is a schematic flowchart of the evaluation method for the security protection ability of an industrial control system provided by the embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] This application describes multiple embodiments, but the description is exemplary rather than restrictive, and it will be apparent to those of ordinary skill in the art that there may be more embodiments and implementation solutions within the scope of the embodiments described in this application. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically restricted, any feature or element of any embodiment can be used in combination with any other feature or element in any other embodiment, or can replace any other feature or element in any other embodiment.

[0021] This application includes and contemplates combinations with features and elements known to those of ordinary skill in the art. The embodiments, features, and elements disclosed in this application can also be combined with any conventional features or elements to form unique inventive solutions. Any feature or element of any embodiment can also be combined with features or elements from other inventive solutions to form another unique inventive solution. Therefore, it should be understood that any feature shown and / or discussed in this application can be implemented alone or in any suitable combination. Therefore, the embodiments are not subject to other limitations except those made in accordance with the appended claims and their equivalents. In addition, various modifications and changes can be made within the scope of the appended claims.

[0022] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not depend on the specific order of the steps described herein, the method or process should not be limited to the specific order of steps described. As will be understood by those of ordinary skill in the art, other step orders are possible. Therefore, the specific order of steps set forth in the specification should not be construed as a limitation on the claims. In addition, the claims directed to the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art can easily understand that these orders can be varied and still remain within the spirit and scope of the embodiments of this application.

[0023] The evaluation of the security protection ability of industrial control systems is a multi-dimensional and complex problem. There are many factors involved in the system security problem, and there are mutual coupling effects among the factors. To effectively evaluate the security protection ability of industrial control systems, the embodiments of this application establish an index system for the security protection ability of industrial control systems at multiple levels and dimensions.

[0024] In the embodiments of the present application, when determining the evaluation indicators for the security protection capabilities of industrial control systems, based on the characteristics of industrial control systems and with reference to the national standard "GB / T 41400-2022 Information Security Technology - Maturity Model for Information Security Protection Capabilities of Industrial Control Systems", the evaluation indicators for the security protection capabilities of industrial control systems are determined.

[0025] Specifically, the security protection capabilities of the system to be evaluated are evaluated through at least a two-level evaluation system; any content item in the k-th level has at least two branched content items in the (k + 1)-th level; where:

[0026] In the k-th level, at least two content items are selected as evaluation objects, and the corresponding content items in the (k + 1)-th level of the selected content items are used as the evaluation indicators corresponding to the evaluation objects, where at least two of the selected content items in the k-th level belong to the same content item in the (k - 1)-th level, and k is an integer greater than 1.

[0027] In the above evaluation system, by obtaining the values of the evaluation objects, the security protection capabilities of industrial control systems can be objectively and accurately evaluated.

[0028] Figure 1 It is a schematic diagram of the evaluation system provided for the embodiments of the present application. As Figure 1 shown, this evaluation system is a four-level evaluation system, and the content items are gradually refined from left to right; where:

[0029] The content item in the first level is the security protection capability of the system to be evaluated;

[0030] The content items of the security protection capability of the system to be evaluated in the second level include at least one of historical security events, current security protection capabilities, and future threat response capabilities; where:

[0031] The corresponding content items of the historical security events in the third level include at least one of the historical security event detection capability, historical security event response capability, and historical security event recovery capability;

[0032] The corresponding content items of the current security protection capabilities in the third level include at least one of the device-level security protection capability, hierarchical-level security protection capability, and organizational-level security protection capability;

[0033] The corresponding content items of the future threat response capabilities in the third level include at least one of the threat prediction capability, active defense capability, and emergency response capability;

[0034] Where:

[0035] The content items corresponding to the historical security incident detection capability at Level 4 include at least one of the security incident occurrence frequency, security incident detection rate, security incident false alarm rate, and average detection time;

[0036] The content items corresponding to the historical security incident response capability at Level 4 include at least one of the average response time and response measure success rate;

[0037] The content items corresponding to the historical security incident recovery capability at Level 4 include at least one of the average repair time and incident repair rate;

[0038] The content items corresponding to the device-level security protection capability at Level 4 include at least one of device physical security, device boundary protection, device access control, device communication security, device security hardening, and device backup and recovery;

[0039] The content items corresponding to the hierarchical-level security protection capability at Level 4 include at least one of security area division, network boundary security, remote access security, identity authentication, industrial data security, vulnerability management, threat detection, and risk monitoring;

[0040] The content items corresponding to the organization-level security protection capability at Level 4 include at least one of security planning and architecture, personnel management and training, threat warning, threat handling, and supply chain security;

[0041] The content items corresponding to the threat prediction capability at Level 4 include at least one of threat intelligence coverage rate, average threat intelligence update time, threat prediction accuracy rate, and threat prediction false alarm rate;

[0042] The content items corresponding to the active defense capability at Level 4 include at least one of the unknown threat detection rate, unknown threat false alarm rate, and unknown threat interception rate;

[0043] The content items corresponding to the emergency response capability at Level 4 include at least one of the zero-day vulnerability response time, critical operation response time, and automation processing coverage rate.

[0044] Among them, the zero-day vulnerability response time in the above text is used to describe the time interval from discovering a zero-day vulnerability to taking effective countermeasures when facing a zero-day vulnerability. A zero-day vulnerability refers to those software vulnerabilities that have not been publicly disclosed or patched, and such vulnerabilities are often exploited by attackers to launch attacks. For industrial control systems, timely response to zero-day vulnerabilities is very important because it can reduce the time the system is exposed to unknown threats, thereby reducing security risks. This indicator is of great significance in evaluating the emergency response capability of industrial control systems because it directly relates to the reaction speed and processing efficiency of the system when facing new and unknown threats.

[0045] The evaluation system provided by the embodiments of the present application integrates the characteristics and protection standards of industrial control systems, and establishes multi-level and multi-dimensional evaluation indicators from three dimensions: historical security events, current security protection capabilities, and future threat response capabilities, which can comprehensively and systematically reflect the security protection status of industrial control systems and provide a solid foundation for accurate evaluation.

[0046] When evaluating the security protection capabilities of the system to be evaluated, the evaluation objects are at least two content items selected in the k-th level, and each evaluation object corresponds to at least two evaluation indicators in the (k + 1)-th level. Therefore, it is necessary to determine the most important indicator and the least important indicator of each content item in the k-th level in the (k + 1)-th level.

[0047] In the embodiments of the present application, based on the idea of step-by-step weighted evaluation ratio analysis, the most important indicator and the least important indicator in the evaluation indicators corresponding to the same evaluation object are determined, and based on the most important indicator and the least important indicator corresponding to the same evaluation object, the weight value of each evaluation indicator corresponding to the evaluation object is determined.

[0048] Among them, the method for determining the most important indicator and the least important indicator in the evaluation indicators corresponding to the evaluation object i is as follows:

[0049] Step A1: Obtain the scoring results of each evaluation indicator of the evaluation object i, where the scoring results are between 1 and 7, and the higher the scoring result, the higher the occurrence probability of the evaluation indicator;

[0050] Step A2: When j is equal to 1, set the scoring result of the evaluation indicator j as the initial score of the evaluation indicator j; when j is greater than 1, set the absolute value of the difference between the scoring result of the evaluation indicator j and the scoring result of the evaluation indicator j - 1 as the initial score of the evaluation indicator j;

[0051] Step A3: When j is equal to 1, set the initial coefficient of the evaluation indicator j as 1; when j is greater than 1, set the result of adding 1 to the initial score of the evaluation indicator j as the initial coefficient of the evaluation indicator j;

[0052] Step A4: When j is equal to 1, set the initial weight of the evaluation indicator j as 1; when j is greater than 1, set the ratio of the initial weight of the evaluation indicator j - 1 to the initial coefficient of the evaluation indicator j as the initial weight of the evaluation indicator j;

[0053] Step A5: Use the sum of the initial weights of all evaluation indicators of the evaluation object i to normalize the initial weight of each evaluation indicator to obtain the normalized weight of each evaluation indicator;

[0054] Step A6: Determine the most important indicator B and the least important indicator W of the evaluation object i according to the normalized weights of each evaluation indicator of the evaluation object i.

[0055] The following is an explanation of steps A1 to A6:

[0056] In step A1, at least two experts score each evaluation index corresponding to the evaluation object i according to the 7-point Likert scale (as shown in Table 1), where the average score of the evaluation index j is the scoring result of the evaluation index j ;

[0057] Table 1

[0058]

[0059] In step A2, the initial score of the evaluation index j is calculated by the expression .

[0060] In step A3, the initial coefficient of the evaluation index j is calculated by the expression .

[0061] In step A4, the initial weight of the evaluation index j is calculated by the expression .

[0062] In step A5, the normalized weight of the evaluation index j is calculated by the expression , where represents the total number of evaluation indexes of the evaluation object i, where is an integer greater than or equal to 2

[0063] In step A6, select the evaluation index with the highest value of the normalized weight in the evaluation object i as the most important index in the evaluation object i ; select the evaluation index with the lowest value of the normalized weight in the evaluation object i as the least important index in the evaluation object i .

[0064] The above method for determining the most important index and the least important index in each evaluation object has the following advantages:

[0065] 1. Dynamic progressive quantitative analysis (steps A1 - A4):

[0066] The relative importance relationship between indexes is constructed by using the differential absolute value method (step A2), and the chain conduction calculation of index weights is realized through the recurrence formula (steps A3 - A4), which can better reflect the dynamic correlation between indexes compared with the traditional static weight allocation

[0067] Introduce an initial coefficient adjustment mechanism (step A3), avoid the zero value problem through the smoothing process of "+1", and ensure the numerical stability of weight calculation.

[0068] 2. Scientific normalization processing (step A5):

[0069] Force the sum of weights to satisfy the mathematical constraint of 1 through sum normalization, ensure the comparability of weights of indicators at different levels, and provide a consistent quantitative benchmark for the multi-level evaluation system.

[0070] 3. Automated decision support (step A6):

[0071] Automatically identify the most important / least important indicators based on the extreme values of the normalized weights, eliminate subjective judgment biases, and are especially suitable for the rapid screening of large-scale indicator systems (such as the fourth-level indicators of industrial control systems).

[0072] 4. Risk probability mapping (step A1):

[0073] Directly associate the 1-7 scale with the risk occurrence probability, so that the weight calculation results naturally have the characteristics of risk warning, which conforms to the core principle of "high risk, high weight" in the field of safety protection.

[0074] 5. Computational efficiency optimization:

[0075] Based on the determination method of the recurrence algorithm, control the time complexity to linear time complexity Compared with the square time complexity of methods that require constructing judgment matrices such as the Analytic Hierarchy Process (AHP) It is more suitable for industrial scenarios with high real-time requirements.

[0076] In summary, while maintaining accuracy, the embodiments of the present application significantly improve the analysis efficiency of complex indicator systems, and provide key technical support for the real-time quantitative evaluation of the safety protection ability of industrial control systems.

[0077] Among them, the method for determining the weight values of all evaluation indicators of the evaluation object i includes:

[0078] Step B1, from all the evaluation indicators of the evaluation object i, determine a most important indicator B and a least important indicator W, where both B and W are positive integers less than or equal to ;

[0079] Step B2. Obtain the value of the importance degree of the most important metric B relative to each of the other evaluation metrics for the evaluation object i to obtain a first preference value; and, obtain the value of the importance degree of the other evaluation metrics of the evaluation object i relative to the least important metric W to obtain a second preference value, where the larger the value of the first preference value and the second preference value, the higher the degree of importance of the former relative to the latter;

[0080] Step B3. Based on the constraint conditions of the evaluation metrics of the evaluation object i, determine the weight value of each evaluation metric of the evaluation object i, including:

[0081] The weight value of each evaluation metric is a positive value;

[0082] The sum of the weight values of all evaluation metrics is equal to 1;

[0083] For each evaluation metric, the larger value of the first absolute value and the second absolute value is less than or equal to the consistency error, where:

[0084] The first absolute value of the evaluation metric j is the absolute value of the difference between the first ratio of the evaluation metric j and the first preference value of the evaluation metric j, where the first ratio is the ratio of the weight value of the optimal evaluation metric B to the weight value of the evaluation metric j;

[0085] The second absolute value of the evaluation metric j is the absolute value of the difference between the second ratio of the evaluation metric j and the second preference value of the evaluation metric j, where the second ratio is the ratio of the weight value of the evaluation metric j to the weight value of the least important metric W.

[0086] The following is an explanation of Step B2 and Step B3:

[0087] In Step B2, the following operations are performed on all the evaluation metrics of the evaluation object i, including:

[0088] Use the values from 1 to 9 (as shown in Table 2) to determine the most important metric of the evaluation object i The first preference value relative to all the other metrics of the evaluation object i ;

[0089] Use the values from 1 to 9 (as shown in Table 2) to determine all the other metrics of the evaluation object i relative to the least important metric of the evaluation object i of the second preference value .

[0090] Table 2

[0091]

[0092] In Step B3, for all the evaluation metrics of the same evaluation object i, for each pair and , there is and . In order to make all the evaluation indicators of the same evaluation object i meet the above conditions, it is necessary to minimize the maximum absolute difference and of each evaluation indicator of the same evaluation object. In addition, considering the non-negativity and constraints of the weights, the following constraint conditions can be obtained for all the evaluation indicators of the same evaluation object i:

[0093]

[0094] The above problem is transformed into the following problem:

[0095]

[0096] By solving the above problem, the weight values and the consistency error of each evaluation indicator of the evaluation object i can be obtained.

[0097] In addition, after obtaining the weight values of all the evaluation indicators of the evaluation object i, the consistency index of the evaluation object i is determined according to the total number of the evaluation indicators of the evaluation object i;

[0098] Calculate the ratio between the consistency error of the evaluation object i and the consistency index of the evaluation object i to obtain the consistency value of the evaluation object i;

[0099] If the consistency value of the evaluation object i is less than the preset threshold, it is determined that the weight values of all the evaluation indicators of the evaluation object i are allowed to participate in the weighted calculation of the elements in the normalized decision matrix.

[0100] Among them, the calculation expression of the consistency value is ;

[0101] Among them, is the consistency index, which is determined from Table 3 according to the total number of the evaluation indicators of the evaluation object i.

[0102] Table 3

[0103]

[0104] When , it indicates that there are logical conflicts in the importance scores of the evaluation indicators by different experts, and contradictory scores need to be proposed or re-scored, so as to avoid the distortion of weight calculation caused by experts' subjective biases or cognitive inconsistencies and ensure the scientificity and reliability of the evaluation method; when , it is considered that the importance scores of the evaluation indicators by different experts are consistent, and the determined weight values can participate in the subsequent calculations.

[0105] The method for determining the weight of each evaluation index in each evaluation object has the following advantages:

[0106] 1. Structured preference modeling (Steps B1 - B2):

[0107] Through the comparison mechanism of double anchor points (the most important index B / the least important index W), the complex multi - index comparison is simplified into two groups of directional preference relationships (the first preference value / the second preference value), which not only retains the core logic of expert judgment but also greatly reduces the number of comparisons.

[0108] 2. Constraint optimization design (Step B3):

[0109] The weight allocation is transformed into an optimization problem with constraints. The consistency error is controlled by the double absolute difference (the first absolute value / the second absolute value), which is more stringent than the traditional CR test, ensuring that the weight results simultaneously satisfy: a) preference transitivity (the importance of B relative to other indicators); b) inverse preference consistency (the importance of other indicators relative to W); c) weight normalization (the sum is 1).

[0110] 3. Strengthening industrial adaptability:

[0111] Allowing non - integer preference values (such as 3.5), which is more in line with the fuzzy judgment in actual risk assessment compared with the 1 - 9 integer scale of AHP;

[0112] Automatically balancing the subjective differences of experts through the error tolerance mechanism (consistency error threshold), avoiding the common problem of repeatedly adjusting the matrix in AHP.

[0113] 4. Improving computational efficiency:

[0114] Solving the weight value based on the convex optimization problem under linear constraints, improving the efficiency of weight solution.

[0115] In summary, through the double - anchor - point preference modeling and constraint optimization theory, the embodiment of the present application solves the efficiency bottleneck and subjectivity problem of the traditional method in the large - scale index evaluation of industrial control systems while maintaining the scientific nature of decision - making.

[0116] Figure 2 It is a schematic flow chart of the evaluation method for the security protection ability of the industrial control system provided by the embodiment of the present application. As Figure 2 shown, the method evaluates the industrial control system through at least two evaluation indexes of each of the I evaluation objects, where the maximum value of the total number of evaluation indexes corresponding to a single evaluation object among the I evaluation objects is J. The method includes:

[0117] Step C1: Construct an initial decision matrix of the system to be evaluated based on Z - numbers. The initial decision matrix is an I*J - dimensional matrix. In the initial decision matrix, for the Z - number in the i - th row and j - th column, the first component A represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of security protection ability, and the second component B represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of reliability, where i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and both I and J are positive integers greater than or equal to 2;

[0118] Step C2: According to the preset conversion rules, convert each grade evaluation result in the initial decision matrix into a triangular fuzzy number;

[0119] Step C3: According to the triangular fuzzy number of the second component B in each Z - number in the initial decision matrix, determine the reliability weight value of each Z - number in the initial decision matrix;

[0120] Step C4: Use the reliability weight value of each Z - number to weight the triangular fuzzy number in the first component A of each Z - number in the initial decision matrix to obtain a decision matrix;

[0121] Step C5: Based on the triangular fuzzy numbers in the same column of the decision matrix, perform normalization processing on the elements in each column of the decision matrix to obtain a normalized decision matrix;

[0122] Step C6: Use the weight value of each evaluation index to weight the corresponding elements in the normalized decision matrix to obtain a weighted - normalized decision matrix, where the sum of the weight values of all evaluation indexes of the same evaluation object is 1;

[0123] Step C7: Use the weighted - normalized decision matrix to determine the corresponding value of each evaluation object in the system to be evaluated;

[0124] Step C8: According to the value of each evaluation object, determine the security protection ability of the system to be evaluated.

[0125] The method provided in the embodiments of the present application realizes the scientific quantitative evaluation of the security protection ability of industrial control systems, and its core advantages are as follows:

[0126] 1. Fusion of reliability assessment (application of Z - numbers):

[0127] The initial decision matrix (Step C1) uses Z - numbers (the first component A is the grade evaluation result of security protection ability, and the second component B is the grade evaluation result of reliability), taking into account both index scores and data credibility, avoiding the one - sidedness of single values, and improving the robustness of evaluation results. For example, an index with a high score but low reliability will not overly affect the final conclusion.

[0128] 2. Dynamic fuzzy data processing:

[0129] Triangular fuzzy number conversion (step C2) quantifies linguistic variables (such as strong or medium) into fuzzy numbers (l, m, u), retaining the uncertainty in expert judgment; and, reliability weight calculation (step C3) generates weights based on the second component B to ensure that high-confidence data dominates the decision-making, achieving compatibility with the ambiguity of subjective evaluation, while suppressing low-quality data noise through weights.

[0130] 3. Dual weighting mechanism:

[0131] Adjust the triangular fuzzy numbers of the first component of each element in the initial decision matrix using the reliability weight values of the second component of each element in the initial decision matrix (step C4) to reduce the impact of low-reliability level evaluation results on the evaluation results; at the same time, ensure that high-reliability level rating results dominate.

[0132] Weight the respective triangular fuzzy numbers in the normalized decision matrix using the weight values of the evaluation indicators to ensure that the contribution of important indicators to the total score is greater than the contribution of minor indicators to the total score.

[0133] Based on the above dual weighting mechanism, achieve the collaborative optimization of data quality and indicator importance, and avoid single-dimensional deviation.

[0134] 4. Normalization processing:

[0135] Normalize the elements in the corresponding columns of the decision matrix based on the triangular fuzzy numbers in the same column of the decision matrix (step C5), which can eliminate the dimension difference and ensure cross-index comparability.

[0136] In summary, the method provided in the embodiments of the present application, when evaluating the security protection ability of industrial control systems, through Z-number reliability fusion, fuzzy number conversion, weighting of reliability weights, normalization processing of the decision matrix, and weighting of the weight values of evaluation indicators, solves the problems of ignoring data quality, being too subjective, and incomparable results existing in the prior art, and provides a standardized and implementable technical solution for the accurate evaluation and optimization of the security protection ability of industrial control systems.

[0137] The following describes steps C1 to C8:

[0138] In step C1, use Z-numbers to construct an initial decision matrix with Z-number elements , including I evaluation objects and J evaluation indicators, where Z-number is a fuzzy number considering reliability, and its expression form is .

[0139] Among them, the first component A is the rating result of the security protection ability, which can be very poor (VL), poor (L), relatively poor (ML), medium (M), relatively strong (MH), strong (H), or very strong (VH); the second component A is the rating result of the reliability, which can be very poor (VL), poor (L), medium (M), strong (H), or very strong (VH).

[0140] Among them, the rating result of the second component B of the Z-number mainly reflects the credibility of the data source, but also covers the comprehensive evaluation of the data quality and the stability of the evaluation index.

[0141] For example, the first component and the second component of the Z-number of the evaluation index of a certain evaluation object are strong (H) and medium (M), respectively.

[0142] In step C2, combining the conversion rules of the linguistic variables for evaluating the security protection ability of the industrial control system (as shown in Table 4) and the conversion rules of the reliability linguistic variables (as shown in Table 5), convert each rating result in the initial decision matrix into a triangular fuzzy number.

[0143] Table 4

[0144]

[0145] Table 5

[0146]

[0147] Taking the first component and the second component of the Z-number being strong (H) and medium (M) respectively as an example, based on Table 4, the triangular fuzzy number corresponding to the first component strong (H) can be obtained as (7, 9, 10), and based on Table 5, the triangular fuzzy number corresponding to the second component medium (M) can be obtained as (0.3, 0.5, 0.7), and in the initial decision matrix this element is represented as [(7, 9, 10), (0.3, 0.5, 0.7)].

[0148] And so on, the initial decision matrix including triangular fuzzy numbers can be obtained Specifically as follows:

[0149]

[0150] Among them, represents the triangular fuzzy number corresponding to the rating result of the security protection ability of the th evaluation index of the th evaluation object, represents the triangular fuzzy number corresponding to the rating result of the reliability of the th evaluation index of the th evaluation object.

[0151] In step C3, , where and are triangular membership functions. Therefore, the calculation expression of the reliability weight is as follows:

[0152] ;

[0153] where, represents the reliability weight, represents the membership degree of the grade evaluation result of the second component B to the triangular membership function of the second component B of, represents the increment of integrating the variable .

[0154] Based on the above expression, the triangular fuzzy number of the second component of the Z-number can be converted into an exact numerical value. Taking the element [(7, 9, 10), (0.3, 0.5, 0.7)] in the initial decision matrix as an example, the reliability weight is 0.5.

[0155] In step C4, one implementation method for weighting the triangular fuzzy numbers in the respective first components A in the initial decision matrix is as follows:

[0156] ;

[0157] where, the above expression defines a fuzzy set adjusted by the reliability weight , where:

[0158] consists of all elements satisfying and their corresponding membership degrees , where represents 's membership degree to ; where is the result of scaling the original membership function by the ratio of the reliability weight .

[0159] where, another implementation method for weighting the triangular fuzzy numbers in the respective first components A in the initial decision matrix is as follows:

[0160] Weight the initial decision matrix The square root value of the reliability weight is multiplied by the first component A of each element in the triangular fuzzy number to obtain the decision matrix The triangular fuzzy number of each element in the.

[0161] Continuing with the above example, the reliability weight Perform a weighted process on the triangular fuzzy number of the first component in the Z-number. The calculation expression is , and the following content can be obtained:

[0162] ;

[0163] Among them, Will be used as an element in the decision matrix.

[0164] Based on the square root value of the reliability weight, compared with directly using the reliability weight, there are the following advantages:

[0165] 1. Balance the influence of weights:

[0166] The square root function is a concave function, and its growth rate decreases. This means that the increase of high weight values will be moderately inhibited, while the relative role of low weight values is retained. Through this operation, it is possible to avoid the excessive dominance of high reliability indicators in the decision-making result, and at the same time prevent low reliability indicators from being completely ignored, thereby enhancing the balance of the evaluation system.

[0167] 2. Improve the robustness of the evaluation method:

[0168] The square root operation can smooth the non-linear effect of weights and reduce the sensitivity of the result to extreme weight values. For example, if the weight of a certain indicator is extremely high (such as 0.9), the increase of its square root (0.95) is less than linear scaling, which can prevent the evaluation indicator from generating too large a deviation in the comprehensive decision-making and improve the tolerance to outliers.

[0169] 3. Practical application significance

[0170] In actual scenarios such as industrial control systems, the reliability weight may reflect the uncertainty of indicators or data quality. The square root operation reduces the noise interference of low-quality data through non-linear adjustment while retaining its potential information value, making the evaluation result more practically guiding.

[0171] To sum up, by introducing the square root function, this method achieves a balance between mathematical rigor and practical needs, not only optimizing the rationality of weight allocation but also enhancing the adaptability in complex scenarios.

[0172] In step C5, the decision matrix Specifically as follows:

[0173] ;

[0174] As can be seen from the above, the decision matrix is a matrix of dimension I*J, where each element is a triangular fuzzy number, expressed as , representing the lower limit, the middle value, and the upper limit of the triangular fuzzy number respectively.

[0175] For the above decision matrix perform normalization:

[0176] ;

[0177] For each column j, calculate the sum of the squares of the three parts of each element in all rows i, and then take the square root of the sum of the squares as the denominator for normalization; divide the three parts of each element by the denominator corresponding to the column to obtain the normalized value.

[0178] In step C6, the weighted normalized decision matrix is as follows:

[0179]

[0180] wherein, the numerical values of the respective corresponding evaluation indicators in the normalized decision matrix are weighted by using the weight values of each evaluation indicator of each evaluation object, and the calculation expression is , and .

[0181] In step C7, since the normalized weighted values of each evaluation object in the weighted normalized decision matrix are fuzzy, expressed as , these values should be converted into definite values through the best non-fuzzy performance (BNP).

[0182] Finally, according to the calculated value, the evaluation indicators can be sorted from large to small according to the value to determine the safety protection ability of the industrial control system.

[0183] Preferably, the method for obtaining the value corresponding to the evaluation object i in the system to be evaluated includes:

[0184] Divide all the evaluation indicators of the evaluation object i into beneficial indicators and non-beneficial indicators, where the higher the value of the beneficial indicator, the higher the safety protection ability; the higher the value of the non-beneficial indicator, the worse the safety protection ability;

[0185] Calculate the difference between the sum of the beneficial indicators and the sum of the non-beneficial indicators of the evaluation object i in the weighted normalized decision matrix to obtain the comprehensive fuzzy value of the evaluation object i;

[0186] Determine the value of the evaluation object i according to the comprehensive fuzzy value of the evaluation object i.

[0187] Among them, the beneficial indicators are the indicators that meet the beneficial criteria (Beneficial Criteria), where the beneficial criteria are that the larger the indicator value, the more beneficial (for example, the higher the score of "threat prediction ability", the stronger the security protection ability);

[0188] Among them, the non-beneficial indicators are the indicators that meet the non-beneficial criteria (Non-beneficial Criteria), where the non-beneficial criteria are that the smaller the indicator value, the more beneficial (for example, the shorter the "zero-day vulnerability response time", the stronger the protection ability).

[0189] Classifying all the evaluation indicators of the same evaluation object according to the above two types of criteria can avoid logical contradictions in the evaluation results. For example, the logical contradiction can be that a long response time is considered to have a high protection ability.

[0190] In the evaluation object i, the evaluation indicators 1 to evaluation indicator f are all beneficial indicators, and the evaluation indicators f + 1 to evaluation indicator are all non-beneficial indicators. Then, calculate the comprehensive fuzzy value of each evaluation object through the following calculation expression, including:

[0191] ;

[0192] Among them, since is a triangular fuzzy number, the above calculation needs to be carried out for each parameter (l, m, u) according to the fuzzy number rules.

[0193] The above method for determining the comprehensive fuzzy value of the evaluation object has the following advantages, including:

[0194] 1. Accurately distinguish the contribution direction of indicators: The division of beneficial indicators and non-beneficial indicators ensures the consistency of the evaluation logic, avoids misjudgment caused by confusion of indicator properties, and makes the evaluation results more in line with the actual security needs.

[0195] 2. Dynamically balance the protection ability: The offset effect between indicators is directly quantified through the difference operation (the sum of beneficial indicators minus the sum of non-beneficial indicators). For example, if a certain beneficial indicator of a system has a high score, and at the same time, another non-beneficial indicator also has a high score, the difference operation can automatically balance the influence of the two, avoid a single indicator dominating the result, and can reflect the true comprehensive protection level of the system, rather than emphasizing a certain type of indicator one-sidedly.

[0196] 3. Fuzzy mathematics enhances robustness: In the weighted normalized decision matrix, the elements are triangular fuzzy numbers. The difference operation retains the fuzziness, which is compatible with the uncertainty in expert scoring and avoids information loss caused by forced precision in traditional methods.

[0197] In summary, through directional index classification and fuzzy difference calculation, the scientific quantification and dynamic balance of the security protection ability of industrial control systems are achieved.

[0198] In the embodiment of this application, the comprehensive fuzzy value of the evaluation object i is expressed as , and as a fuzzy value, it can be converted into a definite value through the best non-fuzzy performance (BNP).

[0199] Among them, the calculation expression of BNP in the related technology is as follows:

[0200] ;

[0201] In the above calculation expression, it is emphasized that the median accounts for 50%, and the upper and lower limits , are symmetrically distributed.

[0202] Different from the above expression, the conversion expression in the embodiment of this application is as follows:

[0203] ;

[0204] The above calculation expression can be simplified to , that is, calculate the arithmetic mean of the triangular fuzzy numbers of the evaluation object i.

[0205] Using the conversion expression provided in the embodiment of this application to calculate the value of the evaluation object has the following advantages, including:

[0206] 1. High calculation efficiency: Without complex weight assignment, directly take the average of the three values, with a faster calculation speed, which is suitable for industrial control systems with high real-time requirements.

[0207] 2. Symmetry processing: Equal weights are given to the three parameters (lower limit, median, upper limit) of the triangular fuzzy number, avoiding potential biases caused by emphasizing the median, and is applicable to scenarios where the upper and lower limit information is equally important.

[0208] 3. Reducing subjective intervention: The "doubling of the median weight" in the conventional method implies the subjective judgment of experts, while the simple average method does not require artificial setting of weights, reduces subjective interference, and improves the objectivity of the results.

[0209] 4. Enhanced compatibility: When the difference between the upper and lower bounds and the median of the fuzzy number is small (such as when the data distribution is concentrated), the simple average result is close to the weighted average, but the calculation is more concise; when the range of the upper and lower bounds is wide (such as when the uncertainty is high), it can avoid the weighted method ignoring the boundary effect due to the excessive weight of the median.

[0210] In step C7, the evaluation indicators are sorted in descending order of value to determine the security protection ability of the industrial control system.

[0211] In summary, the method provided by the embodiment of the present application has the following advantages, including:

[0212] 1) A multi-level and multi-dimensional security protection ability index system for industrial control systems: A four-level evaluation index system for the security protection ability of industrial control systems with multiple levels and dimensions is established from three dimensions: historical security events, current security protection ability, and future threat response ability, comprehensively covering all key elements of the security protection of industrial control systems.

[0213] 2) Quantitative analysis of indicators at the same level: By specific calculations, the initial coefficient, initial weight, and normalized initial weight of each indicator are determined, and then the most important and least important indicators are found, and the optimal weight value of the evaluation indicators is solved to achieve a quantitative evaluation of the importance of each evaluation indicator.

[0214] 3) Constructing a decision matrix by combining Z numbers: Introduce Z numbers to construct an initial decision matrix, convert its elements into triangular fuzzy numbers, and combine the conversion rules of the language variables of the security protection ability and reliability of the industrial control system to obtain a decision matrix containing triangular fuzzy numbers. Then, after normalization processing and combining weights to construct a weighted normalized decision matrix, effectively handle the fuzziness and uncertainty in the evaluation process.

[0215] 4) Determining the evaluation result of the security protection ability: Calculate the normalized weighted value according to the beneficial and non-beneficial criteria, convert the fuzzy normalized weighted value into a clear value through the best non-fuzzy performance, and sort each evaluation indicator according to this value to determine the comprehensive evaluation result of the security protection ability of the industrial control system.

[0216] In addition, the embodiment of the present application also provides a storage medium, in which a computer program is stored, and the computer program is set to execute the method described above when running.

[0217] The embodiment of the present application also provides an evaluation device for the security protection ability of an industrial control system, including a memory and a processor. A computer program is stored in the memory, and the processor is set to run the computer program to execute the method described above.

[0218] Those of ordinary skill in the art will understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and appropriate combinations thereof. In the hardware implementation, the division of the functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be executed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software can be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

Claims

1. An evaluation method for the security protection ability of an industrial control system, comprising: Constructing an initial decision matrix of the system to be evaluated based on Z - numbers, where the initial decision matrix is an I * J - dimensional matrix. In the Z - number at the i - th row and j - th column of the initial decision matrix, the first component A represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of security protection ability, and the second component B represents the grade evaluation result of the evaluation index j of the evaluation object i in the grade of reliability. Among them, the maximum value of the total number of evaluation indexes corresponding to a single evaluation object among I evaluation objects is J, i is a positive integer less than or equal to I, j is a positive integer less than or equal to J, and both I and J are positive integers greater than or equal to 2; Converting each grade evaluation result in the initial decision matrix into a triangular fuzzy number according to a preset conversion rule; Determining the reliability weight value of each Z - number in the initial decision matrix according to the triangular fuzzy number of the second component B in each Z - number in the initial decision matrix; Removing the second component B of each Z - number in the initial decision matrix, and using the reliability weight value of each Z - number to weight the triangular fuzzy number in the first component A of each Z - number in the initial decision matrix to obtain a decision matrix; Normalizing the elements in each column of the decision matrix based on the triangular fuzzy numbers in the same column of the decision matrix to obtain a normalized decision matrix; Using the weight value of each evaluation index to weight the corresponding elements in the normalized decision matrix to obtain a weighted - normalized decision matrix, where the sum of the weight values of all evaluation indexes of the same evaluation object is 1; Using the weighted - normalized decision matrix to determine the value corresponding to each evaluation object in the system to be evaluated; Determining the security protection ability of the system to be evaluated according to the value of each evaluation object; Among them, the calculation expression of the reliability weight is ; Among them, represents the reliability weight, represents the membership degree of the grade evaluation result of the second component B to the triangular membership function of the second component B ; represents the increment when integrating the variable x ; Among them, the acquisition method of the decision matrix includes: Multiplying the triangular fuzzy number of the first component A of each element in the initial decision matrix by the square - root value of its respective reliability weight to obtain the triangular fuzzy number of each element in the decision matrix.

2. The method according to claim 1, wherein The acquisition method of the weight values of all evaluation indexes of the evaluation object i includes: From all the evaluation indicators of the evaluation object i, determine one most important indicator B and one least important indicator W, where both B and W are positive integers less than or equal to , where is the total number of evaluation indicators of the evaluation object i, is an integer greater than or equal to 2 and less than or equal to J; Obtaining the value of the importance degree of the most important index B relative to each other evaluation index of the evaluation object i to obtain a first preference value; and obtaining the value of the importance degree of the other evaluation indexes of the evaluation object i relative to the least important index W to obtain a second preference value, where the larger the value of the first preference value and the second preference value, the higher the importance degree of the former relative to the latter; Based on the constraint conditions of the evaluation indexes of the evaluation object i, determining the weight value of each evaluation index of the evaluation object i, where the constraint conditions include: The weight value of each evaluation index is a positive value; The sum of the weight values of all evaluation indexes is equal to 1; The larger value of the first absolute value and the second absolute value in each evaluation index is less than or equal to the consistency error, where: The first absolute value of evaluation index j is the absolute value of the difference between the first ratio of evaluation index j and the first preference value of evaluation index j, where the first ratio is the ratio of the weight value of the optimal evaluation index B to the weight value of evaluation index j; The second absolute value of evaluation index j is the absolute value of the difference between the second ratio of evaluation index j and the second preference value of evaluation index j, where the second ratio is the ratio of the weight value of evaluation index j to the weight value of the least important index W.

3. The method according to claim 2, wherein The determination methods of the most important index B and the least important index W of evaluation object i include: Obtain the scoring results of each evaluation index of evaluation object i, where the scoring results are between 1 and 7, and the higher the scoring result, the higher the occurrence probability of the evaluation index; When j is equal to 1, set the scoring result of evaluation index j as the initial score of evaluation index j; when j is greater than 1, set the absolute value of the difference between the scoring result of evaluation index j and the scoring result of evaluation index j - 1 as the initial score of evaluation index j; When j is equal to 1, set the initial coefficient of evaluation index j as 1; when j is greater than 1, set the result of adding 1 to the initial score of evaluation index j as the initial coefficient of evaluation index j; When j is equal to 1, set the initial weight of evaluation index j as 1; when j is greater than 1, set the ratio of the initial weight of evaluation index j - 1 to the initial coefficient of evaluation index j as the initial weight of evaluation index j; Use the sum of the initial weights of all evaluation indexes of evaluation object i to normalize the initial weight of each evaluation index to obtain the normalized weight of each evaluation index; Determine the most important index B and the least important index W of evaluation object i according to the normalized weights of each evaluation index of evaluation object i.

4. The method according to claim 2, wherein The method further includes: After obtaining the weight values of all evaluation indexes of evaluation object i, determine the consistency index of evaluation object i according to the total number of evaluation indexes of evaluation object i; Calculate the ratio between the consistency error of evaluation object i and the consistency index of evaluation object i to obtain the consistency value of evaluation object i; If the consistency value of evaluation object i is less than the preset threshold, determine that the weight values of all evaluation indexes of evaluation object i are allowed to participate in the weighted calculation of the elements in the normalized decision matrix.

5. The method according to claim 1, characterized in that The obtaining method of the value corresponding to evaluation object i in the evaluated system includes: Divide all evaluation indexes of evaluation object i into beneficial indexes and non-beneficial indexes, where the higher the value of the beneficial index, the higher the security protection ability; the higher the value of the non-beneficial index, the worse the security protection ability; Calculate the difference between the sum of the beneficial indexes and the sum of the non-beneficial indexes of evaluation object i in the weighted normalized decision matrix to obtain the comprehensive fuzzy value of evaluation object i; Determine the value of evaluation object i according to the comprehensive fuzzy value of evaluation object i.

6. The method according to claim 5, wherein: The calculation expression for the value of evaluation object i is ; Among them, is the expression form of the triangular fuzzy number of the comprehensive fuzzy value of the evaluation object i.

7. The method according to claim 1, characterized in that, The method evaluates the security protection ability of the evaluated system through at least two-level evaluation systems; any content item in the k-th level has at least two branched content items in the k + 1-th level; wherein: In the k-th level, at least two content items are selected as evaluation objects, and the corresponding content items of the selected content items in the (k + 1)-th level are used as evaluation indicators corresponding to the evaluation objects, where at least two content items selected in the k-th level belong to the same content item in the (k - 1)-th level, and k is an integer greater than 1.

8. The method according to claim 7, characterized in that: The content item at the first level is the security protection ability of the system to be evaluated; The content items of the security protection ability of the system to be evaluated at the second level include at least one of historical security events, current security protection ability, and future threat response ability; where: The corresponding content items of the historical security events at the third level include at least one of historical security event detection ability, historical security event response ability, and historical security event recovery ability; The corresponding content items of the current security protection ability at the third level include at least one of device-level security protection ability, hierarchical-level security protection ability, and organizational-level security protection ability; The corresponding content items of the future threat response ability at the third level include at least one of threat prediction ability, proactive defense ability, and emergency response ability; Where: The corresponding content items of the historical security event detection ability at the fourth level include at least one of the frequency of security event occurrence, security event detection rate, security event false alarm rate, and average detection time; The corresponding content items of the historical security event response ability at the fourth level include at least one of the average response time and the success rate of response measures; The corresponding content items of the historical security event recovery ability at the fourth level include at least one of the average repair time and the event repair rate; The corresponding content items of the device-level security protection ability at the fourth level include at least one of device physical security, device boundary protection, device access control, device communication security, device security reinforcement, and device backup and recovery; The corresponding content items of the hierarchical-level security protection ability at the fourth level include at least one of security area division, network boundary security, remote access security, identity authentication, industrial data security, vulnerability management, threat detection, and risk monitoring; The corresponding content items of the organizational-level security protection ability at the fourth level include at least one of security planning and architecture, personnel management and training, threat warning, threat handling, and supply chain security; The corresponding content items of the threat prediction ability at the fourth level include at least one of threat intelligence coverage rate, average time for threat intelligence update, threat prediction accuracy rate, and threat prediction false alarm rate; The corresponding content items of the proactive defense ability at the fourth level include at least one of the detection rate of unknown threats, false alarm rate of unknown threats, and interception rate of unknown threats; The corresponding content items of the emergency response ability at the fourth level include at least one of the zero-day vulnerability response time, critical operation response time, and automation processing coverage rate.

9. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 8 when running.

10. An evaluation device for the security protection ability of an industrial control system, comprising a memory and a processor, characterized in that, A computer program is stored in the memory, and the processor is configured to run the computer program to execute the method described in any one of claims 1 to 8.

Images