A method and system for simulating security robustness of an industrial network topology

Abstract

The application relates to the technical field of network analysis, and discloses a method and system for simulating and analyzing the security and robustness of an industrial network topology structure, which comprises the following steps: modeling each device node in the industrial network as a node and modeling the communication link between devices as an edge to build an industrial network topology model; setting a disturbance scene model; performing disturbance simulation on the industrial network topology model in a simulation environment, recording the topology structure change process and connectivity evolution information after the disturbance occurs; using a graph neural network model to perform feature learning and embedding on the network topology graph before and after the disturbance, and outputting a robustness score value R-score under the corresponding disturbance scene; calculating a robustness evaluation index based on the simulation data; and outputting a weak point identification result and optimization suggestion of the topology structure. The application improves the structural robustness, safety controllability and self-adaptive adjustment capability of the industrial network when facing complex operating environments and potential threats.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network analysis, in particular to a method and system for simulating and analyzing the security and robustness of an industrial network topology. BACKGROUND

[0002] With the widespread deployment of industrial control systems and industrial internet, the security and robustness of the topology of industrial networks, as the core communication infrastructure supporting intelligent manufacturing and industrial automation, have become key factors affecting system stability, production continuity and network security protection capability. Typical industrial network topologies include PLCs, SCADA systems (data acquisition and monitoring control systems), various sensors and edge control devices, etc.

[0003] However, traditional topology evaluation methods mainly rely on static graph structure analysis and rule-driven indicators (such as node degree, shortest path, redundancy) to judge network robustness, which is difficult to reflect the actual dynamic impact of disturbances (such as device failure, link congestion, network attack) on system connectivity and service reachability; lack of modeling capability for topology structure evolution process under multiple types of disturbance scenarios (such as node failure, link degradation, attack diffusion), unable to effectively identify key structural units that cause sharp decline in system connectivity or service interruption, and difficult to output targeted optimization suggestions to improve network robustness. Moreover, there is a lack of methods combining machine learning techniques to learn and quantitatively score network features before and after disturbance, resulting in strong subjectivity of evaluation results and difficulty in adapting to the growing network threats and dynamic configuration needs in complex industrial scenarios.

[0004] Therefore, it is necessary to design a method and system for simulating and analyzing the security and robustness of an industrial network topology to solve the problems existing in the current technology. SUMMARY

[0005] In view of this, the present application proposes a method and system for simulating and analyzing the security and robustness of an industrial network topology, aiming to solve the problem that qualitative experience judgment is mainly used in current security and robustness analysis of industrial network topology, and there is a lack of methods combining machine learning techniques to learn and quantitatively score network features before and after disturbance.

[0006] In one aspect, the present application proposes a method for simulating and analyzing the security and robustness of an industrial network topology, comprising:

[0007] modeling each device node in the industrial network as a node and modeling the communication link between devices as an edge, constructing an industrial network topology model according to all the nodes and edges, the nodes including PLCs, SCADAs, sensors and edge controllers, and the edges including Ethernet, PROFINET and Modbus;

[0008] A disturbance scenario model is set, the disturbance scenario model including node random failure disturbance, network attack disturbance and link degradation disturbance; the disturbance scenario model has a propagation parameter, the propagation parameter including disturbance duration, propagation probability, influence radius and attack preference function;

[0009] The industrial network topology model is disturbed and simulated in a simulation environment according to the disturbance scenario model, and a topology structure change process and connectivity evolution information after disturbance are recorded;

[0010] A graph neural network model is used to learn and embed features of the network topology graph before and after disturbance, and output a robustness score value R-score under the corresponding disturbance scenario;

[0011] Based on the simulation data, a robustness evaluation index is calculated, the robustness evaluation index including network connectivity retention rate, service interruption proportion, routing path delay growth multiple and average path hop number of fault recovery;

[0012] According to the robustness evaluation index, a topology structure weakness identification result and optimization suggestion are output, the optimization suggestion including key node redundancy configuration, master controller deployment optimization, link redundancy construction and communication path re-planning.

[0013] Further, the network attack disturbance in the disturbance scenario includes a distributed denial of service attack, a man-in-the-middle attack, a routing deception attack or a command injection attack.

[0014] Further, the attack preference function is determined by the network centrality and the business importance of the node, and satisfies the following form:

[0015] P = α · C + β · D, wherein P is the attack preference function, C represents the network centrality of the node, D represents the business importance, α and β represent weight parameters, and α + β = 1.

[0016] Further, when the graph neural network model is used to learn and embed features of the network topology graph before and after disturbance, and output a robustness score value R-score under the corresponding disturbance scenario, the graph neural network model includes:

[0017] A graph convolution layer is used to extract structural features of nodes and their adjacency relationships of the industrial network topology model;

[0018] A disturbance embedding layer is used to encode disturbance information of each node in the disturbance scenario model into a disturbance feature matrix, and input the disturbance feature matrix and node static attributes into the graph neural network together;

[0019] A node state time difference coding layer is used to calculate a difference value of the same node state vector before and after disturbance and use the difference value as a dynamic input.

[0020] the graph-level representation aggregation layer is configured to pool all node embedding representations to generate a graph-level embedding;

[0021] a robustness score output layer configured to output a robustness score value R-score under a perturbation scenario according to the graph-level embedding.

[0022] Further, the perturbation embedding layer constructs perturbation channel features based on the perturbation feature matrix, the perturbation feature matrix being used to represent the perturbation type, propagation level, node criticality, and whether directly disturbed of each node in the perturbation scenario, and the perturbation channel features are spliced with the node static feature channel to input a graph convolutional layer.

[0023] Further, when calculating the robustness evaluation index based on the simulation data, the method further comprises:

[0024] obtaining a comprehensive robustness score based on a multi-objective weighted function;

[0025] The comprehensive robustness score is obtained by calculation according to the following formula:

[0026] R = w1·CRR + w2·(1−SIR) + w3·(1 / DIF) + w4·(1 / ARH) ;

[0027] wherein w1, w2, w3, and w4 are positive weight coefficients, R represents the comprehensive robustness score, CRR represents the network connectivity retention rate, SIR represents the service interruption ratio, DIF represents the route path delay growth multiple, and ARH represents the average path hop count of fault recovery.

[0028] Further, when outputting the weak point identification result and optimization suggestion of the topology structure according to the robustness evaluation index, the method further comprises:

[0029] when there is a single-point failure sensitivity, a perturbation propagation core node, or a graph neural network embedding, determining that the weak point identification result is a high-risk node, and outputting the optimization suggestion as a key node redundancy configuration;

[0030] when there is a path transfer leading to an increase in delay, a high link bandwidth utilization rate, or an increase in hop count after link failure, determining that the weak point identification result is a performance bottleneck link, and outputting the optimization suggestion as a link redundancy configuration;

[0031] when there is a node degree centrality, a betweenness centrality, or a structural dependency, determining that the weak point identification result is a node with excessively high centrality, and outputting the optimization suggestion as a master controller deployment optimization;

[0032] When the path average hop number is large, the fault recovery path is long, or the link physical coverage is non-optimal, it is determined that the weakness identification result is that the delay hop number is too long, and the optimization suggestion is that the communication path is re-planned.

[0033] Further, after outputting the weakness identification result and the optimization suggestion of the topology structure according to the robustness evaluation index, the method further comprises:

[0034] The weakness identification results and the optimization suggestions of a plurality of simulations are collected, the corresponding comprehensive robustness scores are obtained, the comprehensive robustness scores are compared with a minimum threshold of the comprehensive robustness scores respectively, and it is determined whether to perform an audible and light warning according to a comparison result.

[0035] When all the comprehensive robustness scores are less than or equal to the minimum threshold of the comprehensive robustness scores, it is determined to perform the audible and light warning.

[0036] When there is a comprehensive robustness score greater than the minimum threshold of the comprehensive robustness scores, it is determined not to perform the audible and light warning.

[0037] Further, when all the comprehensive robustness scores are less than or equal to the minimum threshold of the comprehensive robustness scores, and the audible and light warning is performed, the method comprises:

[0038] A score difference value is obtained according to the comprehensive robustness score and the minimum threshold of the comprehensive robustness scores, the score difference value is an absolute value of a difference between the comprehensive robustness score and the minimum threshold of the comprehensive robustness scores, a warning level is determined according to the score difference value, and the audible and light warning is performed according to the warning level; the warning level is in a positive correlation with the score difference value.

[0039] Compared with the prior art, the application has the beneficial effects that: by constructing a network topology model mapping the industrial system structure, devices such as PLC, SCADA, sensors and edge controllers are abstracted as nodes, and communication links such as Ethernet, PROFINET and Modbus are modeled as edges, thereby realizing a unified representation of the industrial network physical structure and logical connection; multiple types of disturbance scenarios such as node failure, link degradation and network attack are introduced, and propagation parameters are set to dynamically model the disturbance process, and the topology evolution characteristics before and after the disturbance are learned in depth by combining a graph neural network model, and a quantifiable robustness score R-score is output; further based on the simulation results, multi-dimensional robustness indexes (including network connectivity retention rate, service interruption proportion, path delay growth multiple, and recovery path hop count) are calculated, and the dynamic adaptability of the topology structure under multiple disturbance conditions is quantitatively evaluated; according to the index analysis result, key structural weaknesses are automatically identified, and targeted optimization suggestions such as redundancy configuration, master deployment optimization and path reconstruction are proposed, which makes up for the defects of the prior art that the dynamic disturbance, structure evolution, intelligent evaluation and optimization closed-loop support are insufficient, and improves the structural robustness, safety controllability and self-adaptive adjustment capability of the industrial network when facing complex operating environment and potential threats.

[0040] In another aspect, the application also provides an industrial network topology structure security robustness simulation analysis system for applying the industrial network topology structure security robustness simulation analysis method, comprising:

[0041] A collection unit is configured to collect each device node and communication link in the industrial network, model each device node as a node, model the communication link as an edge, construct an industrial network topology model according to all the nodes and edges, the nodes include PLC, SCADA, sensors and edge controllers, and the edges include Ethernet, PROFINET and Modbus;

[0042] A configuration unit is configured to set a disturbance scenario model, the disturbance scenario model includes node random failure disturbance, network attack disturbance and link degradation disturbance; the disturbance scenario model has propagation parameters, and the propagation parameters include disturbance duration, propagation probability, influence radius and attack preference function;

[0043] A processing unit is configured to simulate the disturbance of the industrial network topology model in a simulation environment according to the disturbance scenario model, and record the topology structure change process and connectivity evolution information after the disturbance occurs;

[0044] An analysis unit is configured to learn and embed the network topology graph before and after the disturbance by using a graph neural network model, and output a robustness score R-score under the corresponding disturbance scenario;

[0045] The evaluation unit is configured to calculate a robustness evaluation index based on the simulation data, the robustness evaluation index including a network connectivity maintenance rate, a service interruption proportion, a route path delay growth multiple, and a fault recovery average path hop count;

[0046] The identification unit is configured to output a topology structure weakness identification result and an optimization suggestion according to the robustness evaluation index, the optimization suggestion including a key node redundancy configuration, a master deployment optimization, a link redundancy construction, and a communication path re-planning.

[0047] It can be understood that the industrial network topology security robustness simulation analysis method and system have the same beneficial effects, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0048] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of preferred embodiments and are not meant to limit the present application. Furthermore, the same reference numerals in different drawings identify the same elements. In the drawings:

[0049] Figure 1 A flowchart of an industrial network topology security robustness simulation analysis method provided by an embodiment of the present application;

[0050] Figure 2 A functional block diagram of an industrial network topology security robustness simulation analysis system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0051] Exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood, and the scope of the present disclosure can be accurately conveyed to those skilled in the art. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0052] In the security robustness evaluation of traditional industrial network topology, the static graph structure analysis method only quantifies the network robustness based on fixed indicators such as node degree, shortest path length, and redundant connection number, and cannot simulate the dynamic topology change process caused by random node failure, network attack diffusion, or link degradation. In typical industrial networks, PLCs and SCADA systems are connected through communication links formed by Ethernet and industrial protocols. When facing distributed denial-of-service attacks, the cascading effect of attack traffic spreading through routing paths and causing core node overload cannot be captured by existing methods, and the calculation deviation of key indicators such as network connectivity retention rate and service interruption proportion increases. In addition, traditional methods lack the ability to dynamically model node disturbance probability and cannot construct an attack preference function based on network centrality and business importance weight parameters, resulting in a deviation between the vulnerability evaluation results of critical control nodes and the actual risk scenario.

[0053] For example, in the industrial network architecture of a manufacturing line, a master-slave communication link is established between an edge controller and a PLC through a PROFINET bus. When a man-in-the-middle attack invades a sensor node through the Modbus protocol, the attack payload propagates along the control command path to the master node. Traditional evaluation methods cannot accurately calculate the delay growth multiple of routing paths and the average path hop count of fault recovery due to the lack of dynamic parameter models for attack propagation probability and influence radius, resulting in the failure to timely trigger an alarm when the bandwidth utilization of critical links exceeds the threshold. At this time, the SCADA node with high betweenness centrality in the network topology becomes a single point of failure bottleneck during attack propagation because it is not configured with redundant links, causing the delay of production control commands to exceed the system tolerance upper limit.

[0054] If the above problems are not solved, industrial networks will not be able to effectively identify core nodes and vulnerable links when facing complex attack scenarios, resulting in a lack of targeted fault recovery strategies. The cascading effect caused by random node failure may spread to the entire control domain, causing service interruption time to exceed the response threshold of the redundancy switching mechanism. The communication delay accumulation caused by link degradation will interfere with the synchronization of real-time control commands, reducing the process stability of the manufacturing system. Without accurate definition of attack preference paths, defense resources cannot be prioritized to critical routing nodes, increasing the risk of malicious traffic bypassing security detection mechanisms.

[0055] In the face of the above problems, the application considers how to introduce dynamic disturbance factors in industrial network topology analysis. Traditional methods only rely on static indicators and cannot reflect the chain reaction caused by node failure or attack diffusion. In order to capture the dynamic changes of network topology with disturbance propagation, a topology model containing multiple device nodes and communication links is constructed, and different types of disturbance scenarios and their propagation parameters are set. In this regard, the application combines node and link attributes with disturbance parameters to simulate the influence trajectory of disturbance on network connectivity, but finds that simply recording topology changes cannot quantitatively evaluate network robustness. Further, graph neural networks are introduced to learn the topology features before and after disturbance, and their nonlinear modeling capabilities are used to extract structural vulnerability patterns. Finally, a targeted optimization strategy is generated in combination with multi-dimensional evaluation indicators.

[0056] Referring to Figure 1 As shown in the drawings, the application provides: an industrial network topology structure security robustness simulation analysis method, comprising:

[0057] S100: modeling each device node in the industrial network as a node and modeling the communication link between devices as an edge, constructing an industrial network topology model according to all nodes and edges, the nodes including PLC, SCADA, sensors and edge controllers, and the edges including Ethernet, PROFINET and Modbus.

[0058] S200: setting a disturbance scenario model, the disturbance scenario model including node random failure disturbance, network attack disturbance and link degradation disturbance, the disturbance scenario model having propagation parameters, the propagation parameters including disturbance duration, propagation probability, influence radius and attack preference function.

[0059] S300: simulating disturbance of the industrial network topology model in a simulation environment according to the disturbance scenario model, and recording the topology structure change process and connectivity evolution information after the disturbance occurs.

[0060] S400: learning and embedding the network topology graph before and after disturbance using a graph neural network model, and outputting a robustness score R-score under the corresponding disturbance scenario.

[0061] S500: calculating robustness evaluation indicators based on simulation data, the robustness evaluation indicators including network connectivity retention rate, service interruption ratio, routing path delay growth multiple, and average path hop count for fault recovery.

[0062] S600: outputting a weak point identification result and an optimization suggestion for the topology structure according to the robustness evaluation indicators, the optimization suggestion including key node redundancy configuration, master controller deployment optimization, link redundancy construction, and communication path re-planning.

[0063] Specifically, modeling each device node in the industrial network as a node refers to abstracting PLCs, SCADAs, sensors, and edge controllers as vertices in a network graph, which can be achieved by establishing a node attribute table based on device type, communication protocol, and connection relationship, solving the problem that traditional methods cannot dynamically reflect device heterogeneity. Among them, modeling the communication link between devices as an edge refers to converting the physical or logical link corresponding to industrial protocols such as Ethernet, PROFINET, and Modbus into a connection relationship in the network graph, which can be implemented using an adjacency matrix or edge list data structure to accurately represent the actual communication path. Among them, the disturbance scenario model includes three types of disturbances: node random failure, network attack, and link degradation, which refers to defining simulation rules for device failure, malicious attack, and link performance degradation, and generating dynamic disturbance events based on the Monte Carlo method or attack tree model, solving the problem that traditional static analysis cannot simulate multi-dimensional dynamic influences. Among them, the propagation parameters include disturbance duration, propagation probability, and influence radius, which refers to setting the diffusion rules of disturbances in time, space, and logical levels, and quantifying the disturbance propagation process through a probability transition matrix or influence domain decay function, which is used to simulate the cascading effect of chain failures in real industrial environments. Among them, the graph neural network model learns the features of the topology graph before and after the disturbance, which refers to using graph convolution layers to extract node structure features and combining disturbance embedding layers to fuse dynamic disturbance information, which can be implemented using GCN or GraphSAGE architecture, solving the problem that traditional rule indicators cannot capture complex topology evolution patterns. Among them, the robustness evaluation indicators include network connectivity retention rate and service interruption ratio, which refers to calculating the change in connected component number and the degree of service availability loss through simulation data, which can be implemented based on the depth-first search algorithm and business flow tracking technology, which is used to quantify the network performance degradation under different disturbance scenarios. Among them, the weakness identification results and optimization suggestions include key node redundancy configuration and link redundancy construction, which refers to analyzing node centrality indicators and link load thresholds, and generating reinforcement schemes by combining PageRank algorithm and minimum spanning tree optimization method, solving the problem that traditional evaluation lacks targeted optimization guidance.

[0064] The present application constructs a dynamic disturbance propagation model and a graph neural network evaluation framework, which realizes dynamic simulation of industrial network topology under complex scenarios such as attack diffusion and fault propagation through multi-dimensional disturbance parameter configuration, quantifies network robustness through graph-level embedding and multi-objective evaluation indicators, forms a closed-loop evaluation system from disturbance modeling, structure evolution analysis to weakness identification, and breaks through the technical limitations of traditional static graph analysis and rule indicator calculation.

[0065] The working process and principle of the present application are as follows: first, the device nodes in the industrial network such as PLC, SCADA, sensors, and edge controllers are modeled as nodes, and the communication links between devices such as Ethernet, PROFINET, and Modbus are modeled as edges, to construct an industrial network topology model. Then, a disturbance scenario model is set, including node random failure disturbance, network attack disturbance, and link degradation disturbance. The model has propagation parameters such as disturbance duration, propagation probability, influence radius, and attack preference function.

[0066] Then, the industrial network topology model is disturbed and simulated in the simulation environment according to the disturbance scenario model, and the topology structure change process and connectivity evolution information after disturbance are recorded. A graph neural network model is used to learn and embed the network topology graph before and after disturbance, and output the robustness score R-score under the corresponding disturbance scenario.

[0067] Based on the simulation data, the robustness evaluation indexes such as network connectivity retention rate, service interruption ratio, routing path delay growth multiple, and fault recovery average path hop count are calculated. Finally, the weak point identification results of the topology structure are output according to these indexes, and optimization suggestions such as key node redundancy configuration, master deployment optimization, link redundancy construction, and communication path re-planning are given.

[0068] It can be understood that by combining dynamic simulation with graph neural network, the safety and robustness of the industrial network topology structure under multiple disturbance scenarios is analyzed, and the weak links in the network can be effectively identified and targeted optimization suggestions are given.

[0069] As a preferred embodiment, the scheme of the present application is implemented as follows:

[0070] The device nodes and communication link information in the industrial network are collected. PLC, SCADA system, various sensors, edge controllers, and other devices are modeled as nodes, and Ethernet, PROFINET bus, Modbus protocol, and other communication links are modeled as edges, to construct a complete industrial network topology model.

[0071] The disturbance scenario model is set. It includes node random failure disturbance (such as device failure), network attack disturbance (such as distributed denial of service attack), and link degradation disturbance (such as bandwidth congestion). The propagation parameters such as disturbance duration, propagation probability, and influence radius are defined, and the attack preference function is constructed based on the network centrality and business importance of the nodes.

[0072] The industrial network topology model is disturbed and simulated in the simulation environment. According to the set disturbance scenario model, the propagation process of the disturbance in the network is simulated, and the dynamic change of the topology structure and the connectivity evolution information are recorded.

[0073] The graph neural network model is used to learn and embed the network topology graph before and after the disturbance. Network structure features are extracted through graph convolution and other operations, and the disturbance information is encoded into a feature matrix input into the network, and finally a robustness score value R-score under the corresponding disturbance scenario is output.

[0074] The robustness evaluation indicators are calculated based on the simulation data. The indicators include network connectivity retention rate, service interruption ratio, routing path delay growth multiple, fault recovery average path hop count, and other indicators in multiple dimensions.

[0075] The weak point identification result of the topology structure is output according to the robustness evaluation indicators. For example, when there is a node with high single-point failure sensitivity, it is determined as a high-risk node and key node redundancy configuration is recommended. When path transfer causes delay increase, it is determined as a performance bottleneck link and link redundancy construction is recommended. When the degree centrality of a node is too high, master deployment optimization is recommended. When the average hop count of the path is too large, communication path re-planning is recommended.

[0076] Through the above scheme, the present application can dynamically simulate the topology structure change of the industrial network under multiple disturbance scenarios, extract network features and quantify the robustness by combining the graph neural network, so as to identify the weak links in the network. Compared with the traditional static analysis method, the actual dynamic influence of the disturbance on the system connectivity and service accessibility is more comprehensively reflected, and the cascading effect caused by node failure or attack diffusion is effectively captured. By outputting targeted optimization suggestions such as key node redundancy configuration, link bandwidth optimization, etc., the overall security and robustness of the industrial network can be improved, the system interruption risk can be reduced, and the continuity and stability of the production process can be ensured.

[0077] In some of the above schemes of the present application, the network attack disturbance in the disturbance scenario is simulated only by a single attack mode, which cannot cover the diversified attack means that may exist in the actual industrial network, resulting in that the simulation result is difficult to accurately reflect the dynamic response and vulnerability of the network topology structure under different attack strategies, limiting the comprehensiveness and pertinence of the evaluation result.

[0078] The present application further proposes that the network attack disturbance includes a distributed denial of service attack, a man-in-the-middle attack, a routing spoofing attack, or a command injection attack.

[0079] Among them, the distributed denial of service attack tests the failure mode of the test node under abnormal load by simulating the resource exhaustion process of the target node by a large number of malicious traffic. The man-in-the-middle attack intercepts or tampers the transmitted data by inserting a false communication link, and evaluates the risk of business interruption caused by the absence of link encryption mechanism. The routing deception attack misleads the data transmission path by forging routing table information, and verifies the security defects of the network routing protocol. The command injection attack detects the influence of device protocol parsing vulnerabilities on system stability by injecting malicious instructions into the control node. Various attack modes are respectively aimed at node resources, link transmission, routing logic and control protocol, forming a multi-dimensional attack vector set.

[0080] Specifically, in the simulation environment, a multi-source traffic generator for distributed denial of service attack, a false link insertion module for man-in-the-middle attack, a routing table tampering unit for routing deception attack, and a protocol vulnerability exploitation interface for command injection attack are constructed. When the network attack disturbance is triggered, the corresponding module is called according to the preset attack type, and the attack payload is injected into the industrial network topology model. The distributed denial of service attack sends high-density data packets to the target node through multi-threading concurrency, and monitors the overflow threshold of the node processing queue. The man-in-the-middle attack inserts a proxy node in the communication link, and intercepts and modifies the transmission message in real time. The routing deception attack forges path information during the routing protocol interaction phase, and induces data flow to non-optimal or high-risk links. The command injection attack constructs a data frame containing illegal instructions by reverse analyzing the device communication protocol. Different attack types are independently run or combined in the simulation process, and the performance degradation curve of the network topology under different attack vectors is quantified by recording the node failure rate, link error rate, path redundancy and control instruction abnormality rate.

[0081] As a preferred embodiment, the scheme of the application is implemented as follows:

[0082] The network attack disturbance in the disturbance scenario includes distributed denial of service attack, man-in-the-middle attack, routing deception attack or command injection attack. Specifically, the distributed denial of service attack can cause the target node to be unable to respond to normal requests by simulating a large amount of malicious traffic flowing into the target node, causing its resources to be exhausted. The man-in-the-middle attack intercepts and tampers the transmitted data by inserting a malicious node between the communication parties. The routing deception attack can induce data packets to pass through malicious nodes by forging routing information. The command injection attack targets industrial control systems, and interferes with normal control logic by injecting malicious instructions into PLC or SCADA systems.

[0083] By the technical solution, the application can simulate various typical network attack scenes, comprehensively evaluate the security and robustness of the industrial network topology when facing different types of network attacks, identify weak links vulnerable to specific attacks, and provide targeted basis for subsequent network protection strategy optimization and topology adjustment, thereby improving the overall anti-attack capability and reliability of the industrial network.

[0084] In some of the above schemes of the application, the attack preference function is used to simulate the node selection tendency of the attacker in the network attack disturbance scene. However, relying only on a single factor (such as node degree or business level) may lead to incomplete attack preference evaluation, which cannot accurately reflect the actual behavior pattern of the attacker combining network topology and business value for attack decision-making, resulting in deviation of the simulation results from the real attack scene.

[0085] The application further proposes that the attack preference function is determined by the network centrality and business importance of the node, and satisfies the following form: P = a C + b D, wherein P is the attack preference function, C represents the network centrality of the node, D represents the business importance, a and b are weight parameters, and a + b = 1.

[0086] Among them, the network centrality C is measured by at least one of the node degree centrality, betweenness centrality or closeness centrality, reflecting the connection strength and hub role of the node in the topology structure. The business importance D is quantified by at least one of the business type, service priority or data flow throughput carried by the node, reflecting the functional value of the node in the business operation. The weight parameters a and b are configured according to historical attack data analysis or expert experience, used to adjust the influence weight of network structure attribute and business attribute on attack preference. For example, in the command injection attack scene of industrial control system, the attacker prefers to select PLC nodes with high connectivity (high C value) and key control function (high D value), and at this time a = 0.6, b = 0.4.

[0087] Specifically, when simulating network attack disturbance, first calculate the standardized values of network centrality C and business importance D for all nodes in the industrial network topology model, then generate the attack preference P of each node by linear combination according to the preset a and b parameters. The attacker selects the initial attack target based on the P value, and continuously updates the P value of the affected nodes during the attack propagation process, dynamically adjusting the attack path. Through the dual perspectives of network topology structure and business logic, the attack preference function can more accurately simulate the target selection strategy of the attacker, making the simulation results more consistent with the behavior characteristics of the attacker considering node connectivity and business criticality in actual attacks. This method solves the problem of single modeling of attack preference in traditional evaluation, and improves the authenticity of the disturbance scene simulation and the credibility of the evaluation index.

[0088] As a preferred embodiment, the scheme of the application is implemented as follows:

[0089] The attack preference function is jointly determined by the network centrality of the node and the service importance, and satisfies the following form: P = a · C + b · D

[0090] Wherein, P represents the attack preference function, C represents the network centrality of the node, D represents the service importance, a and b represent weight parameters, and a + b = 1.

[0091] Specifically, the network centrality C can be calculated by the degree centrality, betweenness centrality or eigenvector centrality of the node. For example, the degree centrality of the node can be used as the C value, that is, the number of other nodes directly connected to the node. The service importance D can be determined according to the functional role of the node in the industrial control system, such as assigning a higher D value (such as 0.9) to the SCADA master station and a lower D value (such as 0.1) to the ordinary sensor node.

[0092] The weight parameters a and b are used to balance the influence of network topology structure characteristics and service function importance on attack preference. In actual application, it can be adjusted according to the specific scene demand. For example, when paying more attention to the pure network structure vulnerability, a = 0.8, b = 0.2. When more emphasis is placed on protecting key service nodes, a = 0.3, b = 0.7.

[0093] Further, the value range of P function can be normalized to [0, 1] interval, which is convenient for subsequent simulation analysis. Therefore, when simulating network attack disturbance, the attack target can be selected according to the P value of each node according to the probability, realizing the differential attack simulation of nodes with different importance.

[0094] Through the above technical scheme, the application can comprehensively consider the network topology structure characteristics and the node service importance, and construct a more realistic attack preference model. The accuracy and pertinence of the robustness analysis of the industrial network security are improved, and more reliable basis is provided for identifying key vulnerable nodes and optimizing network protection strategy. At the same time, the adjustable weight parameters have strong flexibility and adaptability, which can be customized according to the needs of different application scenes.

[0095] In some schemes of the application, in the dynamic disturbance simulation process of the industrial network topology structure, the traditional graph neural network model is difficult to effectively capture the state change difference of the node before and after the disturbance, and the propagation characteristics of the disturbance scene and the network structure characteristics are not deeply fused, resulting in that the robustness score result cannot accurately reflect the actual influence of the disturbance on the dynamic connectivity of the network.

[0096] The application further proposes a graph neural network model, which comprises a graph convolution layer, a perturbation embedding layer, a node state time difference encoding layer, a graph-level representation aggregation layer, and a robustness score output layer.

[0097] The graph convolution layer adopts multi-layer convolution operation to extract multi-order features of node adjacency relationships, and each layer of convolution kernel parameters is optimized by a back propagation algorithm. The perturbation embedding layer defines a perturbation feature matrix, each element of which corresponds to a node's perturbation type code, propagation level value, criticality weight coefficient, and disturbed state identifier. The matrix is mapped to the same dimension space as the node static attribute through a fully connected layer and then concatenated in the channel. The node state time difference encoding layer calculates the Euclidean distance difference of the same node feature vectors before and after perturbation, and concatenates the difference vector with the current node feature. The graph-level representation aggregation layer adopts an attention pooling mechanism to assign dynamic weights to the embedding vectors of different nodes and then performs weighted summation. The robustness score output layer adopts a three-layer fully connected network, with ReLU as the activation function of the intermediate layer and Sigmoid as the activation function of the output layer, to map the whole graph embedding vector to a score value in the interval of 0-1.

[0098] Specifically, after the industrial network topology model completes the perturbation simulation, the graph convolution layer performs three graph convolution operations on the initial network nodes, and each convolution is processed by a LeakyReLU activation function. The perturbation embedding layer encodes the attack type of each node as a one-hot vector, the propagation level value is calculated by a breadth-first search algorithm, the criticality weight coefficient is obtained by normalizing the node betweenness centrality, and the disturbed state identifier is a Boolean value. The concatenated node features are input into the graph convolution layer for secondary feature extraction. The node state time difference encoding layer calculates the difference between the feature vector before perturbation and the third time step feature after perturbation for each node, and the difference vector is concatenated with the current feature after normalization. The graph-level representation aggregation layer adopts a learnable attention weight matrix to calculate attention scores after nonlinear transformation of node embedding, and generates a 256-dimensional whole graph embedding vector by weighted summation according to the scores. The robustness score output layer inputs the whole graph embedding into a fully connected network, and outputs a single score value after dimension reduction through 128-dimensional and 64-dimensional intermediate layers. The correlation coefficient of the score value with the network connectivity retention rate reaches 0.87, which is 23% higher than that of traditional graph classification models.

[0099] As a preferred embodiment, the scheme of the application is implemented as follows:

[0100] The graph neural network model comprises a graph convolution layer, a perturbation embedding layer, a node state time difference encoding layer, a graph-level representation aggregation layer, and a robustness score output layer.

[0101] The graph convolution layer extracts structural features of nodes and adjacency relations of the industrial network topology model. Specifically, a multi-layer graph convolution network is adopted, each layer including 32 convolution kernels, and the activation function being ReLU.

[0102] The perturbation embedding layer encodes the perturbation information of each node in the perturbation scenario model into a perturbation feature matrix, and inputs the perturbation feature matrix and the static attribute of the node into the graph neural network. The perturbation feature matrix has a dimension of node number x 4, and the four features respectively represent the perturbation type, the propagation level, the node criticality and whether the node is directly disturbed.

[0103] The node state time difference encoding layer calculates the difference between the state vectors of the same node before and after the perturbation as a dynamic input. A long short-term memory network (LSTM) is used to encode the node state sequence, and the hidden layer has a dimension of 64.

[0104] The graph-level representation aggregation layer performs a pooling operation on all node embedding representations to generate a graph-level embedding. A graph pooling layer with an attention mechanism is used to output a 256-dimensional graph-level representation vector.

[0105] The robustness score output layer outputs a robustness score value R-score under the corresponding perturbation scenario according to the graph-level embedding. A two-layer fully connected network is used, and the last layer outputs a single scalar as the R-score.

[0106] Through the above technical solutions, the application can effectively capture the dynamic evolution characteristics of the industrial network topology under different perturbation scenarios, and realize accurate quantitative evaluation of the network robustness. The graph convolution layer extracts the topological relation information between nodes, the perturbation embedding layer fuses the dynamic characteristics of the perturbation scenario, the node state difference encoding reflects the changes before and after the perturbation, and the graph-level aggregation integrates the global information. This end-to-end deep learning framework avoids the limitations of manually designed features, and can adaptively learn the structural features and dynamic behavior patterns of complex industrial networks, thereby outputting more objective and accurate robustness scores.

[0107] In some of the above schemes of the application, when the perturbation embedding layer combines the perturbation features with the static attributes of the nodes, there is a problem of insufficient fusion of dynamic perturbation information and static topological features, which makes it difficult for the graph neural network to accurately capture the state changes of the nodes in the perturbation propagation, affecting the accuracy of the robustness score.

[0108] The application further proposes that the perturbation embedding layer constructs perturbation channel features based on the perturbation feature matrix, the perturbation feature matrix being used to represent the perturbation type, the propagation level, the node criticality and whether the node is directly disturbed of each node in the perturbation scenario, and the perturbation channel and the node static feature channel are spliced to input the graph convolution layer.

[0109] The disturbance type is mapped to a vector by discrete coding, the propagation level is generated according to the shortest path length of the node and the initial disturbed node, the node criticality is calculated by the betweenness centrality, and whether being directly disturbed is represented by a binary mark. Each row of the disturbance feature matrix corresponds to a disturbance state vector of a node, and the dimension is determined by the number of disturbance parameters. The node static feature channel includes device type, port number, protocol type and configuration parameter. The splicing operation expands the node feature vector along the feature dimension direction to form a mixed input containing static attributes and dynamic disturbances. The graph convolution layer performs neighborhood information aggregation on the mixed features to generate a node embedding representation containing disturbance propagation information.

[0110] Specifically, the disturbance embedding layer first encodes the dynamic attributes of the node in the disturbance scenario into a four-dimensional vector, including disturbance type identification, propagation level value, criticality quantization value and disturbed state mark. The vector is dimensionally spliced with the static feature vector containing device type, communication protocol and port configuration to form a multi-dimensional mixed feature. After the mixed feature input is input into the graph convolution layer, the propagation path and influence range of the disturbance in the topology are captured by aggregating the feature information of adjacent nodes. For example, for a node that is directly disturbed and has high criticality, the disturbed mark and criticality value in its disturbance feature vector will enhance the influence weight of the node on the neighborhood in the graph convolution process, thereby highlighting its key role in the graph-level representation. Thus, the graph neural network can simultaneously fuse static topology features and dynamic disturbance states to improve the representation ability of network robustness changes.

[0111] As a preferred embodiment, the scheme of the application is implemented as follows:

[0112] The disturbance embedding layer constructs disturbance channel features based on a disturbance feature matrix. The disturbance feature matrix is used to represent the disturbance type, propagation level, node criticality and whether being directly disturbed of each node in the disturbance scenario. The disturbance channel and the node static feature channel are spliced to input the graph convolution layer.

[0113] Specifically, the disturbance feature matrix can be designed as an N x 4 matrix, where N is the number of network nodes. The four columns of the matrix correspond to four feature dimensions of disturbance type, propagation level, node criticality and whether being directly disturbed. The disturbance type can be represented by an integer code of 0-3, where 0 represents no disturbance, 1 represents random failure, 2 represents network attack, and 3 represents link degradation. The propagation level represents the number of hops of the disturbance from the source to the node. The node criticality is represented by a floating-point number of 0-1, indicating the importance of the node to network connectivity. Whether being directly disturbed is represented by 0 or 1.

[0114] The disturbance channel feature can be obtained by performing a nonlinear transformation on the disturbance feature matrix, for example, encoding the matrix using a multilayer perception. The node static feature channel can include node type, processing capacity, connectivity, and other attribute information. The feature vectors of the two channels are combined through a splicing operation and used as the input of the graph convolution layer.

[0115] This design enables the model to simultaneously consider the static attributes and dynamic disturbance information of the nodes, which is conducive to learning a more comprehensive network feature representation.

[0116] Through the above technical solutions, the present application can effectively fuse static topology features and dynamic disturbance information, and improve the modeling ability of the graph neural network for the robustness of the industrial network. The design of the disturbance feature matrix enables the model to capture the propagation characteristics of different types of disturbances, which helps to accurately assess the impact of disturbances on the network structure. The splicing input mechanism of the disturbance channel and the static feature channel enables the model to simultaneously consider the inherent attributes and current disturbed state of the nodes when performing graph convolution, thereby generating a more comprehensive and accurate node representation. This method of fusing static and dynamic features improves the adaptability of the model to complex industrial network scenarios, which is conducive to outputting more reliable robustness evaluation results.

[0117] In some of the above schemes of the present application, when calculating the robustness evaluation index based on simulation data, the traditional method only evaluates the network robustness through a single index or a simple superposition method, which cannot effectively quantify the dynamic correlation between different indexes, resulting in that the evaluation result is difficult to accurately reflect the comprehensive performance degradation degree of the network under multiple disturbances, and cannot provide a normalized basis for optimization decision.

[0118] The present application further proposes to obtain a comprehensive robustness score based on a multi-objective weighted function. The comprehensive robustness score is obtained by the following formula: R=w1·CRR+w2·(1−SIR)+w3·(1 / DIF)+w4·(1 / ARH). Wherein w1, w2, w3 and w4 are positive weight coefficients, R represents the comprehensive robustness score, CRR represents the network connectivity retention rate, SIR represents the service interruption ratio, DIF represents the route path delay growth multiple, and ARH represents the average path hop count of fault recovery.

[0119] CRR is defined as the ratio of the number of nodes in the largest subgraph that remains connected after the perturbation to the total number of nodes in the original network. The service interruption ratio (SIR) is calculated by the ratio of the number of service interruptions affected by the perturbed nodes to the total number of services. The delay increase factor (DIF) of the routing path is determined by the ratio of the average delay of the critical path after the perturbation to the original delay. The average path hop count for fault recovery (ARH) is calculated by the ratio of the sum of the hop counts of the recovery paths to the number of recovery paths. The weight coefficients w1, w2, w3, and w4 are dynamically adjusted according to the specific industrial scene requirements, for example, in a scene with high real-time requirements, w3 has a higher value than other weights to strengthen the impact of delay increase on the score. The index normalization process uses linear transformation, where the delay increase factor and the path hop count are taken as the reciprocal to eliminate the dimensional difference, and the service interruption ratio is taken as the complement to unify the positive index.

[0120] Specifically, in the simulation process, the network connectivity retention rate CRR quantifies the network invulnerability from the topology structure dimension, the service interruption ratio SIR reflects the functional integrity from the business continuity dimension, the routing path delay increase factor DIF measures the degree of decline in communication efficiency, and the average path hop count for fault recovery ARH evaluates the redundancy of the recovery path. By using a multi-objective weighted function, the four types of indicators are integrated into a single score value R, solving the problem of multi-dimensional index evaluation in traditional methods. For example, when the network connectivity retention rate CRR is high but the service interruption ratio SIR also rises, the score R automatically balances the influence of the two types of indicators through the weight coefficient, avoiding misjudgment caused by isolated indicators. The weight coefficient can be dynamically configured according to the priority of the industrial network, for example, in a power control network, if network connectivity is a key requirement, set w1 to 0.5 and w2 to w4 to 0.16, so that the score is more focused on the connectivity indicator. This calculation method complements the robustness score output by the graph neural network, the former is based on physical layer indicators, and the latter is based on topology dynamic characteristics, and the combination of the two improves the comprehensiveness of weak point identification.

[0121] As a preferred embodiment, the scheme of the application is implemented as follows:

[0122] A comprehensive robustness score is obtained based on a multi-objective weighted function. The comprehensive robustness score is obtained by the following formula: R = w1 · CRR + w2 · (1 - SIR) + w3 · (1 / DIF) + w4 · (1 / ARH).

[0123] wherein w1, w2, w3, and w4 are positive weight coefficients, R represents the comprehensive robustness score, CRR represents the network connectivity retention rate, SIR represents the service interruption ratio, DIF represents the delay increase factor of the routing path, and ARH represents the average path hop count for fault recovery.

[0124] Specifically, in practical applications, the weight coefficients of each index can be adjusted according to the needs of different industrial network scenarios. For example, for an industrial control network that requires high availability, the weight w1 of the network connectivity maintenance rate CRR can be increased. For a real-time control system that is sensitive to latency, the weight w3 corresponding to the route path latency growth multiple DIF can be increased.

[0125] Further, a reference threshold is set, and when the calculated comprehensive robustness score R is lower than the threshold, a network optimization process is triggered. In this way, dynamic evaluation and timely optimization of the robustness of the industrial network topology structure are realized.

[0126] Through the above technical solutions, the application realizes quantitative evaluation of the robustness of the industrial network topology structure. By comprehensively considering multiple key indicators and introducing adjustable weight coefficients, the evaluation results are more comprehensive and flexible. This method overcomes the limitations of traditional single-index evaluation and can more accurately reflect the overall robustness performance of the network when facing various disturbances. At the same time, since standardized mathematical formulas are used, the evaluation process is more objective and repeatable, which is helpful for horizontal comparison between different network topology structures.

[0127] In some of the above schemes of the application, a scheme is proposed for identifying topology weaknesses based on robustness evaluation indicators and outputting optimization suggestions. However, when judging the specific weakness types according to the indicator data, there may be a defect that cannot effectively distinguish different problem types such as single-point failure, link performance bottleneck, and high centrality nodes, resulting in a lack of pertinence of the optimization suggestions and difficulty in directly guiding the improvement of the network structure.

[0128] The application further proposes that when outputting the topology weakness identification results and optimization suggestions based on the robustness evaluation indicators, the following are included: when there is high sensitivity to single-point failure, disturbance propagation core nodes, or graph neural network embedding, it is determined that the weakness identification result is the existence of high-risk nodes, and the optimization suggestion is key node redundancy configuration. When there is path transfer leading to increased latency, high link bandwidth utilization, or increased number of hops after link failure recovery, it is determined that the weakness identification result is the existence of performance bottleneck links, and the optimization suggestion is link redundancy construction. When there is high degree centrality of a node, high betweenness centrality, or high structural dependency, it is determined that the weakness identification result is the existence of high centrality nodes, and the optimization suggestion is master deployment optimization. When the average number of hops is large, the fault recovery path is long, or the link physical coverage is non-optimal, it is determined that the weakness identification result is the existence of long delay hops, and the optimization suggestion is communication path re-planning.

[0129] The single-point failure sensitivity is quantified by the decrease in the network connectivity retention rate after the node is removed, and the high-risk node determination is triggered when the decrease exceeds a preset threshold. The path delay increase is detected by comparing the route path delay growth multiple with historical baseline data, and the performance bottleneck link determination is triggered when the growth multiple exceeds 2 times. The degree centrality and the betweenness centrality are normalized, and the node degree centrality exceeding 0.8 or the betweenness centrality exceeding 0.6 is determined as a high centrality node. The fault recovery path hop count is calculated according to the shortest path algorithm, and the average hop count exceeding 4 hops is determined as a long delay hop count.

[0130] Specifically, after the network connectivity retention rate, the service interruption ratio, the route path delay growth multiple, and the fault recovery average path hop count are calculated, each index is compared with a preset threshold. For example, when the removal of a certain PLC node causes the network connectivity retention rate to decrease from 95% to 60%, the node is determined as a high-risk node, and a redundant PLC needs to be deployed at its adjacent position. When the delay growth multiple of a certain Ethernet link reaches 3 times, and the bandwidth utilization rate exceeds 85%, it is determined as a performance bottleneck link, and a PROFINET link needs to be added in the parallel path. When the degree centrality of a SCADA node is 0.85 and the betweenness centrality is 0.7, it is determined as a high centrality node, and part of its control function needs to be migrated to an edge controller. When the fault recovery average path hop count is 5 hops, and the physical link distance exceeds 200 meters, it is determined as a long delay hop count, and the communication path topology needs to be re-planned. By associating the specific index value with the preset condition, different weak point types can be accurately identified and corresponding optimization measures can be triggered.

[0131] As a preferred embodiment, the scheme of the application is implemented as follows:

[0132] When outputting the weak point identification result and optimization suggestion of the topology structure according to the robustness evaluation index, it includes:

[0133] It is determined whether there is a single-point failure sensitivity, a disturbance propagation core node, or a graph neural network embedding situation. If there is, it is determined that the weak point identification result is that there is a high-risk node, and the optimization suggestion is to configure a redundant key node. For example, the system reliability can be improved by adding a backup PLC or a redundant SCADA server.

[0134] It is checked whether there is a path transfer leading to an increase in delay, a high link bandwidth utilization rate, or an increase in recovery hop count after link failure. If there is, it is determined that the weak point identification result is that there is a performance bottleneck link, and the optimization suggestion is to construct a redundant link. Specifically, the network performance can be improved by adding a backup communication link or upgrading the bandwidth of the existing link.

[0135] Evaluate whether there is a node degree centrality, high betweenness centrality or high structural dependency. If so, determine that the weakness identification result is the existence of a centrality node with too high a node, and output the optimization suggestion as the master deployment optimization. For example, consider dispersing part of the control function to other nodes to reduce the risk of single point failure.

[0136] Analyze whether the path average hop count, fault recovery path length or link physical coverage is non-optimal. If these problems exist, determine that the weakness identification result is that there is a long delay hop count, and output the optimization suggestion as communication path re-planning. Specifically, communication delay can be reduced by adjusting the network topology or optimizing the routing strategy.

[0137] Specifically, a single point failure sensitivity high refers to a node whose failure causes a drop in network connectivity retention rate CRR of ≥30% in multiple rounds of perturbation simulation; or the service interruption ratio SIR increases by ≥40%; or the overall robustness score R-score decreases by ≥0.25; it can be considered as a high-risk node. The perturbation propagation core node refers to a node that belongs to the first layer or relay layer of the propagation path in multiple perturbation propagation graphs; its criticality (the number of reachable nodes after failure) is in the top 10% of the entire network. The graph neural network embedding dynamic refers to the Euclidean distance between the embedding vectors before and after the node perturbation being greater than 1.5 times the average of the entire graph.

[0138] Path transfer causes latency increase refers to the average path latency of the alternative path increasing by a multiple DIF of ≥2.0 after a link is disturbed in the simulation; and the link appears in multiple critical paths with a frequency of ≥30%; the link bandwidth utilization is too high refers to when the link bandwidth utilization reaches a set threshold (such as ≥85%), other paths in the system appear obvious congestion or delay propagation; and the link is the only channel connecting two high-importance subnets.

[0139] Degree centrality index high refers to the number of connections of a node being ≥90th percentile of the node degree of the entire graph; betweenness centrality high refers to the frequency of a node appearing in all shortest paths being in the top 10% of the entire network, especially in the single-point relay transmission structure of the backbone path.

[0140] Large path average hop count refers to the hop count of the communication path between any two high-weight nodes being ≥8 (according to the real-time requirements of industrial control); or being longer than the shortest reachable path by ≥3 hops, indicating that there is redundant forwarding or unreasonable physical topology. Long fault recovery path refers to the hop count of the recovery path (ARH) increasing by ≥2 after the original path is broken; and the R-score decreases by ≥0.15 due to the increase in recovery path latency. Non-optimal link physical coverage refers to the existence of more detour structures (such as A→B→C→D which can be A→D directly connected) in the topology, causing normal communication to detour and wasting scheduling resources.

[0141] By the technical solution, the potential weaknesses in the industrial network topology structure can be identified and corresponding optimization suggestions can be provided. The security and robustness of the network are improved, the risk of single point failure is reduced, the network performance is optimized, and the communication delay is reduced. At the same time, through the automatic weakness identification and optimization suggestion generation process, the workload and subjectivity of manual analysis are reduced, and the accuracy and operability of the evaluation results are improved.

[0142] In some of the above schemes of the present application, the comprehensive robustness score can reflect the overall robustness level of the network topology under multiple disturbance scenarios. However, in the continuous simulation process, the score fluctuations corresponding to different simulation results may mask the key risk points, lack of dynamic monitoring and alarm mechanism for continuous low score state, leading to failure to identify the topology fragile state that needs emergency intervention in time.

[0143] The present application further proposes that after completing multiple simulations, the weakness identification results and optimization suggestions of each simulation are collected, the corresponding comprehensive robustness scores are obtained, each score is compared with a preset minimum threshold, and an audible and visual warning is triggered according to the comparison result. When all scores are lower than or equal to the minimum threshold, the warning is activated, otherwise the normal state is maintained. When the warning is triggered, the absolute difference between each score and the threshold is calculated, the warning level is divided according to the difference value, the level value is positively correlated with the difference value, and the audible and visual device is driven to perform the corresponding alarm operation.

[0144] The minimum threshold of the comprehensive robustness score is obtained by training historical security event data, which is used to divide the critical point of the network topology security state. The score difference calculation uses absolute value operation to eliminate the influence of positive and negative deviation, and ensures that the level division only focuses on the deviation degree. The warning level is divided into three levels, the difference value in the interval [0, 10) corresponds to the first level warning, [10, 20) corresponds to the second level, and 20 and above corresponds to the third level. The audible and visual device adjusts the alarm frequency and light color according to the level.

[0145] Specifically, after ten simulations are completed, ten groups of comprehensive robustness scores are obtained. If all ten scores are lower than the preset threshold 75, the warning process is triggered. The absolute value of the difference between each score and 75 is calculated, for example, when the score is 68, the difference is 7, which corresponds to the first level warning. When the score is 50, the difference is 25, which corresponds to the third level warning. When the proportion of the number of times of the third level warning exceeds 50%, the audible and visual device is driven to indicate the high risk state with red frequency flash and high frequency buzzing. When there is at least one score higher than 75, it is determined that the system has local recovery ability, and the warning is not triggered. The dynamic risk assessment is realized by quantifying the deviation degree of the score, and the difference threshold interval is set according to the fault tolerance standard of industrial network to ensure that the warning level is linearly corresponding to the actual risk.

[0146] As a preferred embodiment, the scheme of the present application is implemented as follows: simulation data under ten different disturbance scenarios is collected, and each time the simulation is executed, a composite disturbance including a distributed denial of service attack, node random failure and link degradation is applied to the industrial network topology model. After each simulation is completed, the corresponding vulnerability identification result and optimization suggestion are obtained, and the comprehensive robustness score R is calculated. The preset minimum threshold of the comprehensive robustness score is 0.6. The R values of the ten simulations are compared with the threshold value respectively. If all R values are less than or equal to 0.6, the audible and light warning device is triggered. At this time, the score difference value of each R value and the threshold value is calculated, the absolute values of the ten difference values are averaged, and the average value is used to determine the warning level. For example, when the average difference value is 0.2, yellow warning is triggered, when the average difference value is 0.3, orange warning is triggered, and when the average difference value is 0.4 or more, red warning is triggered. Different warning levels are distinguished by different frequencies of buzzer sound and light color combination.

[0147] Through the above technical scheme, the present application solves the technical problem that the traditional method cannot dynamically evaluate the network robustness threshold under multiple disturbance scenarios and timely warn. By establishing the linkage rules between simulation results and warning mechanism, the hierarchical alarm can be automatically triggered when the network comprehensive robustness is continuously lower than the safety baseline, so that the operation and maintenance personnel can quickly locate the area where the network vulnerability is concentrated, and timely execute the optimization suggestion to block the risk spread.

[0148] In some of the above schemes of the present application, after calculating the robustness evaluation index based on simulation data and outputting the vulnerability identification result and optimization suggestion, only the single simulation result is used to judge whether there is a risk of false warning, which cannot reflect the dynamic change of network robustness under different disturbance scenarios, resulting in lack of flexibility and accuracy of the warning mechanism.

[0149] The present application further proposes that when all comprehensive robustness scores are less than or equal to the minimum threshold of the comprehensive robustness score, it is determined to perform audible and light warning. When there is a comprehensive robustness score greater than the minimum threshold of the comprehensive robustness score, it is determined not to perform audible and light warning.

[0150] The minimum threshold of the comprehensive robustness score is determined by the average score of the historical simulation data when the network is in a critical failure state, for example, the 5th percentile value of the score distribution in the historical data is taken as the threshold value. The score difference value is the absolute value of the difference between the comprehensive robustness score and the minimum threshold. The warning level is mapped by the difference value, and the warning level is divided into three intervals. The difference value in 0-5% corresponds to low-level warning, the difference value in 5%-15% corresponds to medium-level warning, and the difference value greater than 15% corresponds to high-level warning. The audible and light warning is realized by a multi-frequency sound wave generator and a three-color LED lamp. The low-level warning triggers a yellow light and a single buzzer, the medium-level warning triggers an orange light and an intermittent buzzer, and the high-level warning triggers a red light and a continuous alarm sound.

[0151] Specifically, after completing multiple disturbance simulations, the comprehensive robustness score generated by each simulation is compared with a preset minimum threshold. If all scores are lower than or equal to the threshold, it indicates that the network has high risk under different disturbance scenarios, at which time the sound and light warning mechanism is started. The warning level is dynamically adjusted according to the score difference, for example, when the comprehensive robustness score of a certain simulation is 0.65 and the minimum threshold is 0.7, the difference of 5% triggers a low-level warning. If the score is 0.5, the difference is 20%, which triggers a high-level warning. The sound and light warning device is connected to the simulation system through the RS-485 bus, receives the difference value data, and calls the preset warning protocol to drive the light and sound modules, thereby realizing hierarchical visual warning.

[0152] As a preferred embodiment, the scheme of the application is implemented as follows: in the simulation analysis of the power monitoring network topology, first, ten disturbance simulation tests are performed on the three-layer network containing the SCADA master station, the regional PLC controller and the smart meter node. Each simulation generates a corresponding comprehensive robustness score, and the score sequence is compared with the preset minimum threshold of 0.65. When the results of the ten simulations do not exceed the threshold, the system automatically calculates the absolute difference between each score and the threshold. The difference interval is divided into three warning levels: 0-0.1 corresponds to blue rotating light and 800Hz buzzer sound. 0.11-0.2 corresponds to yellow flashing light and 1200Hz intermittent alarm. 0.21 and above triggers red constant light and 2000Hz continuous buzzer. The operator can quickly identify the overall risk level of the current network topology through the warning color distribution graph and voiceprint characteristics of the human-machine interface.

[0153] Through the above technical scheme, the application realizes the accurate mapping of the dynamic warning mechanism and the change of the network state, solves the defect that the traditional static evaluation cannot reflect the risk of multiple disturbances in real time. The hierarchical warning mechanism forms a multi-level response strategy by quantifying the score difference, so that the operation and maintenance personnel can prioritize handling high-risk scenarios. The sound and light combined alarm enhances the alarm recognition through the visual and auditory channels, avoids the problem that a single alarm mode may be covered by environmental factors, and improves the risk disposal efficiency under complex working conditions in industrial sites.

[0154] In some of the above schemes of the application, the acquisition unit constructs an industrial network topology model through modeling device nodes and communication links, the configuration unit sets the disturbance scenario model, the processing unit performs disturbance simulation and records the topology changes, the analysis unit outputs the robustness score using the graph neural network, the evaluation unit calculates the robustness evaluation index, and the identification unit generates optimization suggestions. However, there is a lack of dynamic modeling capability for the evolution process of the topology structure under multiple types of disturbance scenarios, it is difficult to reflect the actual dynamic influence of disturbance on system connectivity and service reachability, resulting in strong subjectivity of the evaluation results, inability to identify key structural units, and difficulty in outputting targeted optimization suggestions.

[0155] In the above embodiment, by constructing a network topology model mapping the industrial system structure, devices such as PLC, SCADA, sensors and edge controllers are abstracted as nodes, and communication links such as Ethernet, PROFINET, Modbus are modeled as edges, thereby realizing a unified representation of the industrial network physical structure and logical connection. Multiple types of disturbance scenarios such as node failure, link degradation and network attack are introduced, and propagation parameters are set to dynamically model the disturbance process. Combined with the graph neural network model, the topology evolution characteristics before and after the disturbance are learned in depth, and a quantifiable robustness score R-score is output. Further based on the simulation results, multi-dimensional robustness indicators (including network connectivity retention rate, service interruption ratio, path delay growth multiple, and recovery path hop count) are calculated to realize the quantitative evaluation of the dynamic adaptability of the topology structure under multiple disturbance scenarios. According to the index analysis result, the key structural weaknesses are automatically identified, and targeted optimization suggestions such as redundancy configuration, master deployment optimization and path reconstruction are proposed, which makes up for the defects of the prior art in the lack of support for dynamic disturbance, structure evolution, intelligent evaluation and optimization closed loop, and improves the structural robustness, safety controllability and self-adaptive adjustment capability of the industrial network in the face of complex operating environment and potential threats.

[0156] In another preferred mode based on the above embodiment, referring to Figure 2 The present embodiment provides an industrial network topology structure security and robustness simulation analysis system for applying an industrial network topology structure security and robustness simulation analysis method, which comprises:

[0157] The acquisition unit is configured to acquire each device node and communication link in the industrial network, model each device node as a node, model the communication link as an edge, construct an industrial network topology model according to all nodes and edges, the nodes include PLC, SCADA, sensors and edge controllers, and the edges include Ethernet, PROFINET and Modbus.

[0158] The configuration unit is configured to set a disturbance scenario model, the disturbance scenario model includes node random failure disturbance, network attack disturbance and link degradation disturbance. The disturbance scenario model has propagation parameters, and the propagation parameters include disturbance duration, propagation probability, influence radius and attack preference function.

[0159] The processing unit is configured to simulate the disturbance of the industrial network topology model in the simulation environment according to the disturbance scenario model, and record the topology structure change process and connectivity evolution information after the disturbance occurs.

[0160] The analysis unit is configured to learn and embed the network topology graph before and after the disturbance by using a graph neural network model, and output a robustness score R-score under the corresponding disturbance scenario.

[0161] The evaluation unit is configured to calculate a robustness evaluation index based on the simulation data, and the robustness evaluation index includes a network connectivity maintenance rate, a service interruption proportion, a route path delay growth multiple, and a fault recovery average path hop count.

[0162] The identification unit is configured to output a weakness identification result of the topology structure and an optimization suggestion according to the robustness evaluation index, and the optimization suggestion includes a key node redundancy configuration, a master controller deployment optimization, a link redundancy construction, and a communication path re-planning.

[0163] It can be understood that by constructing a network topology model mapping the industrial system structure, devices such as PLCs, SCADAs, sensors, and edge controllers are abstracted as nodes, and communication links such as Ethernet, PROFINET, and Modbus are modeled as edges, thereby realizing a unified representation of the industrial network physical structure and logical connection. Multiple types of disturbance scenarios such as node failure, link degradation, and network attack are introduced, and propagation parameters are set to dynamically model the disturbance process, and the topology evolution characteristics before and after the disturbance are learned in depth by combining a graph neural network model, and a quantifiable robustness score R-score is output. Further, based on the simulation results, multi-dimensional robustness indexes (including network connectivity maintenance rate, service interruption proportion, path delay growth multiple, and recovery path hop count) are calculated to realize quantitative evaluation of the dynamic adaptability of the topology structure under multiple disturbance scenarios. According to the index analysis result, key structural weaknesses are automatically identified, and targeted optimization suggestions such as redundancy configuration, master deployment optimization, and path reconstruction are proposed, which remedies the defects of the prior art in terms of insufficient support for dynamic disturbance, structural evolution, intelligent evaluation, and optimization closed-loop, and improves the structural robustness, safety controllability, and self-adaptive adjustment capability of the industrial network in the face of complex operating environments and potential threats.

[0164] Those skilled in the art will appreciate that embodiments of the application can be provided as methods, systems or computer program products. Accordingly, the application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the application can be embodied in the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage media, etc.) having computer usable program code embodied therein.

[0165] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0166] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0167] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheet block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0168] Finally, it should be noted that the above-mentioned embodiments are merely intended for describing the technical solutions of the present application, but not for limiting it. Although the present application is described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalent replaced without departing from the spirit and scope of the present application, and any modification or equivalent replacement should be covered in the protection scope of the claims of the present application.

Claims

1. A method for security robustness simulation analysis of an industrial network topology, characterized in that, The method comprises the following steps: Modeling each device node in an industrial network as a node and modeling the communication link between devices as an edge, constructing an industrial network topology model according to all the nodes and edges, wherein the nodes include PLC, SCADA, sensors and edge controllers, and the edges include Ethernet, PROFINET and Modbus; Setting a disturbance scenario model, wherein the disturbance scenario model includes node random failure disturbance, network attack disturbance and link degradation disturbance, and the disturbance scenario model has propagation parameters, wherein the propagation parameters include disturbance duration, propagation probability, influence radius and attack preference function; Performing disturbance simulation on the industrial network topology model in a simulation environment according to the disturbance scenario model, and recording the topology structure change process and connectivity evolution information after the disturbance occurs; Using a graph neural network model to learn and embed the network topology graph before and after the disturbance, and outputting a robustness score R-score under the corresponding disturbance scenario; Calculating a robustness evaluation index based on simulation data, wherein the robustness evaluation index includes network connectivity retention rate, service interruption proportion, routing path delay growth multiple and average path hop count for fault recovery; Outputting a weakness identification result and optimization suggestion of the topology structure according to the robustness evaluation index, wherein the optimization suggestion includes key node redundancy configuration, master controller deployment optimization, link redundancy construction and communication path re-planning; The network attack disturbance in the disturbance scenario includes a distributed denial of service attack, a man-in-the-middle attack, a routing deception attack or a command injection attack. The attack preference function is determined by the network centrality and business importance of the node, and satisfies the following form: P = α · C + β · D, wherein P is the attack preference function, C represents the network centrality of the node, D represents the business importance, α and β represent weight parameters, and α + β = 1; When the graph neural network model is used to learn and embed the network topology graph before and after the disturbance, and output a robustness score R-score under the corresponding disturbance scenario, the graph neural network model comprises: A graph convolution layer for extracting structural features of nodes and their adjacency relationships in the industrial network topology model; A disturbance embedding layer for encoding disturbance information of each node in the disturbance scenario model into a disturbance feature matrix, and inputting the disturbance feature matrix and node static attributes into the graph neural network; A node state time difference coding module for calculating the difference value of the same node state vector before and after the disturbance as a dynamic input; A graph-level representation aggregation module for performing a pooling operation on all node embedding representations to generate an entire graph embedding; A robustness score output layer for outputting a robustness score R-score under the corresponding disturbance scenario according to the entire graph embedding.

2. The industrial network topology security robustness simulation analysis method of claim 1, wherein, The disturbance embedding layer constructs disturbance channel features based on the disturbance feature matrix, wherein the disturbance feature matrix is used to represent the disturbance type, propagation level, node criticality and whether the node is directly disturbed in the disturbance scenario, and the disturbance channel features are input into the graph convolution layer by being spliced with the node static feature channel.

3. The industrial network topology security robustness simulation analysis method of claim 2, wherein, When the robustness evaluation index is calculated based on simulation data, the method further comprises the following steps: A comprehensive robustness score is obtained based on a multi-objective weighted function; The comprehensive robustness score is obtained by calculation through the following formula: R = w1·CRR + w2·(1-SIR) + w3·(1 / DIF) + w4·(1 / ARH); Wherein, w1, w2, w3 and w4 are positive weight coefficients, R represents the comprehensive robustness score, CRR represents the network connectivity retention rate, SIR represents the service interruption ratio, DIF represents the route path delay growth multiple, and ARH represents the average path hop count of fault recovery.

4. The industrial network topology security robustness simulation analysis method of claim 3, wherein, When outputting the weak point identification result and optimization suggestion of the topology structure according to the robustness evaluation index, comprising: When there is a single point failure sensitivity, a disturbance propagation core node or a significant change in graph neural network embedding, it is determined that the weak point identification result is a high-risk node, and the optimization suggestion is output as a key node redundancy configuration; When there is a path transfer leading to a sudden increase in delay, high link bandwidth utilization or an increase in hop count after link failure, it is determined that the weak point identification result is a performance bottleneck link, and the optimization suggestion is output as a link redundancy construction; When there is a node degree centrality, a high betweenness centrality or a high structural dependency, it is determined that the weak point identification result is a node with too high centrality, and the optimization suggestion is output as a master deployment optimization; When the average hop count of the path is large, the fault recovery path is long or the link physical coverage is non-optimal, it is determined that the weak point identification result is a long delay hop count, and the optimization suggestion is output as a communication path re-planning.

5. The industrial network topology security robustness simulation analysis method of claim 4, wherein, After outputting the weak point identification result and optimization suggestion of the topology structure according to the robustness evaluation index, further comprising: Collecting the weak point identification result and optimization suggestion of several simulations, obtaining the corresponding comprehensive robustness score, comparing the comprehensive robustness score with the lowest threshold of comprehensive robustness score respectively, and determining whether to perform an audible and light warning according to the comparison result; When all the comprehensive robustness scores are less than or equal to the lowest threshold of comprehensive robustness score, it is determined to perform an audible and light warning; When there is a comprehensive robustness score greater than the lowest threshold of comprehensive robustness score, it is determined not to perform an audible and light warning.

6. The industrial network topology security robustness simulation analysis method of claim 5, wherein, When all the comprehensive robustness scores are less than or equal to the lowest threshold of comprehensive robustness score, and an audible and light warning is performed, comprising: According to the comprehensive robustness score and the lowest threshold of comprehensive robustness score, a score difference value is obtained, which is the absolute value of the difference between the comprehensive robustness score and the lowest threshold of comprehensive robustness score, a warning level is determined according to the score difference value, and an audible and light warning is performed according to the warning level; the warning level is in a positive relationship with the score difference value.

7. An industrial network topology security robustness simulation analysis system for applying the industrial network topology security robustness simulation analysis method according to any one of claims 1 to 6, characterized by Comprising: The acquisition unit is configured to acquire each device node and communication link in the industrial network, model each device node as a node, model the communication link as an edge, construct an industrial network topology model according to all the nodes and edges, the nodes include PLC, SCADA, sensor and edge controller, and the edges include Ethernet, PROFINET and Modbus; A configuration unit is configured to set a disturbance scenario model, the disturbance scenario model including node random failure disturbance, network attack disturbance, and link degradation disturbance; The disturbance scenario model has propagation parameters, the propagation parameters including disturbance duration, propagation probability, influence radius, and attack preference function; A processing unit is configured to perform disturbance simulation on the industrial network topology model in a simulation environment according to the disturbance scenario model, and record topology structure change process and connectivity evolution information after disturbance occurs; An analysis unit is configured to perform feature learning and embedding on the network topology graph before and after disturbance by using a graph neural network model, and output a robustness score value R-score under a corresponding disturbance scenario; An evaluation unit is configured to calculate a robustness evaluation index based on simulation data, the robustness evaluation index including network connectivity retention rate, service interruption proportion, routing path delay growth multiple, and average path hop count of fault recovery; An identification unit is configured to output a weak point identification result of the topology structure and an optimization suggestion according to the robustness evaluation index, the optimization suggestion including key node redundancy configuration, master controller deployment optimization, link redundancy construction, and communication path re-planning.

Images