Risk assessment method and system for shipborne computer system

Abstract

The invention discloses a risk assessment method and system for a shipborne computer system, and relates to the technical field of network security. Through detailed analysis and quantification of each threat vulnerability, the most easily attacked part in the system can be accurately identified, so that protection measures are enhanced in a targeted manner, and potential security risks are effectively reduced. And secondly, the threat quantized value of each security event is determined by combining the network boundary protection capability and the threat severity, so that the evaluation result is closer to the actual situation, and a more scientific and reasonable protection strategy can be formulated. Besides, risk assessment is performed by integrating the threat vulnerability value and the threat quantized value on the basis of the probability that the threat vulnerability triggers the security event based on the key threat, so that the accuracy and reliability of risk assessment are further improved, and the shipborne computer system can maintain high security and stability in a complex and changeable marine environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a risk assessment method and system for a shipboard computer system. Background Art

[0002] Modern ships rely extensively on computer systems to perform their core functions and operations. These systems not only support critical tasks such as navigation, communications, and automated control, but are also responsible for managing the ship's various equipment and sensors. Specifically, ship computer systems include the following major components: navigation and control systems, communications systems, monitoring and management systems, and safety and protection systems. These systems are connected through complex networks to form a highly integrated information infrastructure that ensures the efficient and safe operation of ships.

[0003] In order to protect ship computer systems from various threats, multi-layered security measures are usually adopted, including but not limited to the following aspects:

[0004] Physical security measures: Limit physical access to computer systems, such as using access cards and biometric technology, to prevent unauthorized personnel from accessing critical equipment.

[0005] Network isolation and firewalls: Isolate different network areas (such as internal networks and external networks) and deploy firewalls to prevent malicious traffic from entering sensitive areas.

[0006] Intrusion Detection and Prevention System (IDS / IPS): monitors network traffic in real time, identifies potential attack behaviors, and takes timely countermeasures.

[0007] Access control and authentication mechanism: Implement strict user authentication and permission management to ensure that only authorized users can access specific resources.

[0008] Data encryption and integrity check: Encrypt transmitted data to prevent data leakage or tampering, and perform integrity checks regularly.

[0009] Logging and auditing: Record all system activities for subsequent analysis and auditing to detect abnormal behavior or potential threats.

[0010] These measures together constitute the network security protection system of the ship's computer system, ensuring that the ship can operate safely in a complex and changing environment.

[0011] Current risk assessment methods primarily rely on historical data, real-time threat intelligence, and expert experience to quantify the probability of a threat exploiting a vulnerability to trigger a security incident. However, these methods still have significant limitations in practical applications. In ship computing systems, in particular, the sources of cybersecurity threats are diverse and complex. These include improper personnel management practices, such as the random insertion of unchecked USB flash drives, illegal network connections, and external malicious attacks. These factors can directly cause critical equipment to cease operation or the ship to become paralyzed, leading to serious security consequences. However, existing assessment models fail to fully incorporate key elements such as personnel management, equipment access control, and network connection security. This can result in risk calculations that do not accurately reflect actual conditions, increasing potential security risks. Summary of the Invention

[0012] The purpose of the present invention is to provide a risk assessment method and system for shipboard computer systems to address the problem that existing assessment models fail to fully integrate key factors such as personnel management, equipment access control, and network connection security, which may result in the calculation results of risk values being unable to accurately reflect the actual situation and increase potential safety hazards.

[0013] To achieve the above objectives, the present invention provides the following technical solution: a risk assessment method for a shipboard computer system, comprising:

[0014] Step 1: Classify the shipboard computer system into three safety events based on the impact of the shipboard computer system failure on the ship's operating status;

[0015] Step 2: Perform multi-level analysis on each security incident to identify threat vulnerabilities and obtain a comprehensive threat vulnerability value for each threat vulnerability; determine the threat severity of each threat vulnerability;

[0016] Step 3: Determine the network boundary protection capability of the shipboard computer system and determine the threat quantification value of each security event based on the comprehensive threat vulnerability value, network boundary protection capability and threat severity of the threat vulnerability point;

[0017] Step 4: Obtain the probability of a key threat exploiting a threat vulnerability to trigger a security incident. Perform a risk assessment based on the probability of a key threat exploiting a threat vulnerability to trigger a security incident, the comprehensive threat vulnerability value, and the threat quantification value to obtain a risk assessment value.

[0018] Furthermore, security incidents include: monitoring and information management security incidents, alarm and monitoring control security incidents, and propulsion and manipulation control security incidents.

[0019] Furthermore, we conduct multi-level analysis on each security incident, including static code analysis, dynamic behavior monitoring analysis, and threat attack risk analysis.

[0020] Build a potential vulnerability matrix for each security incident. The potential vulnerability matrix includes the potential vulnerability type, potential vulnerability location, and associated devices of the potential vulnerability;

[0021] Among them, static code analysis includes: determining the code complexity, potential vulnerability density and number of unauthorized access interfaces by calling the static code of each security event, and comprehensively analyzing to obtain the first vulnerability value of each potential vulnerability point;

[0022] Dynamic behavior monitoring and analysis, including: calling the resource usage rate, abnormal behavior frequency and alarm value of each potential vulnerability in the operating system monitoring record, and comprehensively analyzing to obtain the second vulnerability value of each potential vulnerability;

[0023] Threat attack risk analysis includes: obtaining a potential threat list, calculating similarity scores between potential threats in the potential threat list and threats in a historical threat intelligence database, defining potential threats in the threat list with similarity scores greater than or equal to 0.7 as critical threats, defining threats in the threat list with similarity scores greater than 0 and less than 0.7 as non-critical threats, and mapping critical threats and / or non-critical threats to each potential threat vulnerability in a potential threat vulnerability matrix to obtain a mapping matrix; defining similarity scores between critical threats and / or non-critical threats and threats in a historical threat intelligence database as a matching degree, defining the square of the similarity score as an activity degree, and comprehensively analyzing the matching degree and the activity degree to obtain a third vulnerability value for each potential vulnerability;

[0024] A comprehensive vulnerability point value is obtained based on the first vulnerability point value, the second vulnerability point value, and the third vulnerability point value; a vulnerability threshold is preset, and potential vulnerabilities corresponding to comprehensive vulnerability point values greater than the vulnerability threshold are regarded as threat vulnerabilities;

[0025] The non-threat vulnerability points and the mapped potential threat vulnerability points in the mapping matrix are eliminated, and the key threat points and the mapped potential threat vulnerability points are retained to obtain the threat vulnerability matrix.

[0026] Furthermore, based on the impact scope, duration, and recoverability of the shipboard computer system failure at each threat vulnerability point, the physical access control score of the shipboard computer system is determined to obtain the threat severity of each threat vulnerability point;

[0027] The acquisition of physical access control scores includes:

[0028] Get whitelisted devices and define a calibration effectiveness score;

[0029] Define a coverage score based on the coverage level of the automatic scanning function;

[0030] The physical access control score is obtained based on the correction effectiveness score and the coverage score.

[0031] Furthermore, the definition process of the calibration effectiveness score includes:

[0032] The whitelist device list of the shipboard computer system is called to obtain the number of devices allowed to access; the historical access records are called to obtain the number of historical access devices; based on the number of devices allowed to access and the number of historical access devices, the coverage ratio of whitelist devices is obtained;

[0033] The update frequency of whitelist devices in historical access records is called and the maximum update frequency of whitelist devices is obtained through screening. The basic coverage score is obtained based on the whitelist device coverage ratio and the maximum update frequency of whitelist devices.

[0034] Define a time period, determine the change in the number of devices allowed to access within the time period based on the number of devices allowed to access, and determine the success rate of adjusting the whitelist devices; obtain the basic coverage score at each time point in the time period, and average all time points to obtain the time point mean; average the basic coverage scores at all time points to obtain the basic coverage score mean; obtain a correction value based on the basic coverage score at each time point, the time point mean, and the basic coverage score mean; obtain the whitelist device adjustment rate score based on the correction value, the change in the number of devices allowed to access, and the whitelist device adjustment success rate;

[0035] Define the maximum tolerated number of unauthorized access attempts and the threat frequency; adjust the rate score of whitelist devices, the coverage ratio of whitelist devices, the maximum update frequency of whitelist devices, and the maximum tolerated number of unauthorized access attempts to obtain the number of unauthorized access attempts and the threat frequency, obtain the correction item, correct the basic coverage score, and obtain the correction effectiveness score.

[0036] Furthermore, determine the network perimeter protection capabilities, including:

[0037] The detection rate of the intrusion system is used as the basic network boundary protection capability. According to the basic network boundary protection capability and the threat severity of each security incident, the network boundary protection capability of each security incident is obtained.

[0038] Furthermore, the feasibility score of each key threat is determined based on the historical threat intelligence database. Based on the feasibility score of the key threat, the network boundary protection capability and the threat severity, the probability of each key threat exploiting the threat vulnerability to trigger a security incident is obtained.

[0039] Furthermore, the calculation formula of the risk assessment value is:

[0040]

[0041] Where, F i represents the risk assessment value of the i-th security event, represents the probability that the Lth key threat exploits the kth threat vulnerability to trigger the ith security incident, H i Represents the comprehensive threat vulnerability value of the i-th security event, y i represents the threat quantification value of the i-th security event, and m represents the total number of threat vulnerabilities.

[0042] Furthermore, the formula for the threat severity of each threat vulnerability is:

[0043]

[0044] In the above formula, Q k represents the severity of the threat of the kth vulnerability, ω k Represents the weight coefficient of the kth threat vulnerability point, R k represents the impact range of the shipboard computer system failure at the kth threat vulnerability point, S k represents the recoverability of the shipboard computer system failure at the kth threat vulnerability point, ln is a logarithmic function, T k represents the duration of the shipborne computer system failure at the kth threat vulnerability point, P represents the physical access control score of the shipborne computer system, e is an exponential function, W represents the correction effectiveness score, G represents the coverage score, and C w Represents the coverage ratio of whitelist devices, R w represents the maximum update frequency of the whitelist device, Δw represents the correction value, A w Represents the number of unauthorized access attempts, M w Represents the maximum number of unauthorized accesses tolerated. Represents the amount of change in the device allowed to be accessed. represents the success rate of whitelist device adjustment, t represents the time point within the time period, and W 0，t represents the base coverage score at time point t, represents the mean of basic coverage score, W0 represents the basic coverage score, represents the mean value at each time point, U w represents the adjustment rate score of the whitelist device, Y represents the threat frequency, w1 represents the adjustment coefficient of the change in the amount of allowed access devices, w2 represents the adjustment coefficient of the whitelist device adjustment success rate, and w3 represents the adjustment coefficient of the correction value. represents the correction value, λ represents the exponential decay coefficient, ψ represents the adjustment coefficient between the whitelist device coverage ratio and the maximum update frequency of whitelist devices, ε represents the logarithmic adjustment coefficient, α represents the power term of the impact range, and β represents the power term of recoverability, where α=β=2.

[0045] Furthermore, the calculation formula of the threat quantification value is:

[0046]

[0047] Where K represents the network boundary protection capability of the shipborne computer system.

[0048] Technical effects and advantages of the present invention:

[0049] By dividing the shipboard computer system into three security events and conducting a multi-level analysis of each security event, identifying threat vulnerabilities and calculating a comprehensive threat vulnerability value, this present invention not only significantly improves the accuracy and comprehensiveness of the system's security assessment but also provides a solid data foundation for subsequent risk management and protection strategies. First, through detailed analysis and quantification of each threat vulnerability, the most vulnerable parts of the system can be accurately identified, allowing targeted protection measures to be strengthened and effectively reducing potential security risks. Second, by combining the network boundary protection capabilities and threat severity to determine the threat quantification value of each security event, the assessment results are more closely aligned with actual conditions and help formulate more scientific and reasonable protection strategies. In addition, risk assessment is performed based on the probability of key threats triggering security events using threat vulnerabilities, the comprehensive threat vulnerability value, and the threat quantification value, further improving the accuracy and reliability of risk assessments and ensuring that the shipboard computer system can maintain a high level of security and stability in the complex and changing marine environment. This systematic risk assessment method improves the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flow chart of a risk assessment method for a shipboard computer system provided in this embodiment;

[0051] Figure 2 This is a structural diagram of a risk assessment system for a shipboard computer system provided in this embodiment. DETAILED DESCRIPTION

[0052] The following will be combined with the accompanying drawings to clarify the technical solutions in the embodiments of the present invention; although it is clear that the embodiments described are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] like Figure 1 As shown, this embodiment discloses a risk assessment method for a shipboard computer system, comprising:

[0054] Step 1: Classify the shipboard computer system into three security events based on the impact of the shipboard computer system failure on the ship's operating status; security events include: monitoring and information management security events, alarm and monitoring control security events, and propulsion and manipulation control security events.

[0055] External threats / viruses typically invade shipboard computer systems through code, networks, or external physical access, causing them to malfunction. For example, malware can infiltrate systems through vulnerabilities or unauthorized access interfaces, modifying or damaging system code; attackers can exploit network vulnerabilities or weak passwords to access systems, install malware, or steal sensitive data; and unauthorized personnel can introduce malware into systems by inserting USB flash drives or other storage devices.

[0056] A security incident is a situation caused by an external threat or virus that could negatively impact a vessel and its operations. In a ship environment, security incidents are typically categorized based on the degree of impact of the external threat or virus point, resulting in the three security incidents mentioned above.

[0057] Specifically, if a computer system failure caused by an external threat or virus intrusion does not damage or disable the ship's hardware, and therefore poses no threat to personnel, ship safety, or the environment, the current security incident is considered to have a low risk level. This is defined in this embodiment as a first security incident, specifically a monitoring and information management security incident. For example, certain malware may cause system performance degradation but will not directly impact the ship's operations or safety.

[0058] External threats / viruses invading computer systems can cause damage or disable important ship hardware, but will not affect critical systems or the ship's operation. Ultimately, this could endanger personnel, ship safety, and the environment. This security event is considered medium-risk and, in this embodiment, is defined as a second-level security event, specifically an alarm and monitoring control security event. For example, certain malware may cause auxiliary equipment (such as non-critical sensors) to malfunction, but will not affect propulsion or navigation systems.

[0059] External threats / viruses invading computer systems can damage or disable critical ship hardware (such as propulsion and navigation systems), rendering the ship unable to navigate. This immediately endangers personnel, ship safety, and the environment. This security incident is considered a high-risk event and, in this embodiment, is defined as a third-level security event. Specifically, a third-level security event is an alarm and monitoring control security event. For example, a malicious attack could cause the remote control system to fail, rendering the ship unable to operate normally and potentially leading to a major safety incident.

[0060] Monitoring and Information Management Security Incidents: These incidents involve the ship's information management system, such as monitoring equipment status and recording navigation logs. Alarm and Monitoring Control Security Incidents: These incidents involve the ship's alarm and monitoring control systems, such as fire alarms and temperature monitoring. Propulsion and Maneuvering Control Security Incidents: These incidents involve the ship's propulsion and maneuvering systems, such as engine control and steering gear control.

[0061] Step 2: Conduct multi-level analysis on each security incident, identify threat vulnerabilities and obtain comprehensive threat vulnerability values for the threat vulnerabilities; and determine the threat severity of each threat vulnerability.

[0062] On the one hand, a multi-level analysis is conducted on each security incident, including: static code analysis of security incidents, dynamic behavior monitoring analysis, and threat attack risk analysis.

[0063] A potential vulnerability matrix is constructed for each security incident. The potential vulnerability matrix includes the potential vulnerability type, potential vulnerability location, and associated devices of the potential vulnerability.

[0064] First, potential vulnerabilities refer to weak points in the shipboard computer system that may be exploited by external threats or viruses to launch attacks. These vulnerabilities can exist in all aspects of the shipboard computer system, including hardware, software, network configuration, user behavior, etc. Specifically, the types of potential vulnerabilities are:

[0065] Software vulnerabilities: known or unknown security holes in operating systems, applications, or other software.

[0066] Configuration errors: Security risks caused by improper system configuration, such as opening unnecessary ports, using default usernames and passwords, etc.

[0067] Unauthorized access interface: There are access interfaces in the system that have not been properly authenticated and authorized.

[0068] Physical security issues: Lax access control to physical devices may result in unauthorized personnel having direct access to system hardware.

[0069] User behavior issues: Security risks introduced by improper user operations, such as inserting an unchecked USB flash drive, clicking on phishing emails, etc.

[0070] Secondly, determine the system architecture diagram and collect the hardware equipment of the shipboard computer system, as well as the corresponding configuration information and installed software and corresponding version information. Use tools such as SonarQube and Fortify to scan the above-mentioned software and hardware codes to find potential security vulnerabilities; monitor the operating status of the shipboard computer system through the deployed intrusion detection system (IDS), traffic analysis tools, etc., and identify abnormal software or hardware; use threat intelligence databases (such as CVE, NVD) to find out whether the installed software has known vulnerabilities. In this embodiment, the potential security vulnerabilities, abnormal software or hardware, and software vulnerabilities obtained from the above analysis are regarded as potential vulnerabilities. Through manual review or automated tool scanning, the specific code segments of the potential vulnerabilities are determined, and the locations of the potential vulnerabilities are marked in the system architecture diagram to facilitate subsequent analysis and processing. Call the network topology of the shipboard computer system to determine the associated devices of each potential vulnerability mentioned above, and finally construct a potential vulnerability matrix based on the associated devices, potential vulnerability locations, and potential vulnerability types.

[0071] Among them, static code analysis includes: determining the code complexity, potential vulnerability density and the number of unauthorized access interfaces by calling the static code of each security event, and comprehensively analyzing to obtain the first vulnerability value of each potential vulnerability.

[0072] Code complexity is calculated using the Cyclomatic Complexity algorithm. Potential vulnerability density refers to the number of potential vulnerabilities per line of static code. The number of unauthorized access interfaces refers to the number of unauthorized access interfaces exposed in the static code.

[0073]

[0074] Among them, V1 is the first vulnerable point value of the jth potential vulnerable point, CC is the code complexity of the jth potential vulnerable point, e is the exponential function, ln is the logarithmic function, B j is the total number of potential vulnerabilities in the static code of the jth potential vulnerability point, M j is the total number of lines of static code for the jth potential vulnerability point, is the potential vulnerability density in the static code of the jth potential vulnerability point, UAI j is the number of unauthorized access interfaces of the static code of the jth potential vulnerability point, a is the influence coefficient of code complexity, b is the influence coefficient of potential vulnerability density, and γ is the influence coefficient of the number of unauthorized access interfaces.

[0075] When assessing the security of shipboard computer systems, code complexity is often directly correlated with the difficulty of understanding and maintaining the system, thereby increasing the likelihood of introducing security vulnerabilities. Therefore, it is assigned the highest weight, a = 0.5. Secondly, potential vulnerability density, or the number of potential vulnerabilities per unit of code, reflects the quality of code development and the rigor of code review. It has a significant, but slightly less significant, impact on system security than code complexity. Therefore, it is assigned a medium importance level, with a weight of b = 0.3. Finally, while the number of unauthorized access interfaces is also a significant security risk, it is relatively easy to identify and remediate due to the development of modern security practices and tools. Therefore, its impact is assigned the lowest weight, γ = 0.2. This weighting method allows for more accurate calculation of the first vulnerability value for each potential vulnerability, providing strong support for risk assessment.

[0076] Dynamic behavior monitoring and analysis includes: calling the resource usage rate, abnormal behavior frequency and alarm value of each potential vulnerability point in the operating system monitoring record, and comprehensively analyzing the second vulnerability point value of each potential vulnerability point.

[0077] Resource utilization refers to the system's usage of resources such as CPU, memory, and disk during operation. This data can be obtained through operating system monitoring tools such as Prometheus and Grafana.

[0078] Abnormal behavior frequency refers to the number of times abnormal behavior occurs in the system. This data can be obtained through tools such as intrusion detection systems (IDS) and security information and event management (SIEM) systems.

[0079] Use log parsing tools to extract alarm information and assign alarm levels (emergency alarm, serious alarm, warning alarm) according to the severity of the alarm information. According to existing technologies, the severity of alarm levels is ranked as follows: emergency alarm > serious alarm > warning alarm. Therefore, the alarm value of the emergency alarm level is defined as 1.0, the alarm value of the serious alarm level is defined as 0.8, the alarm value of the warning alarm level is defined as 0.5, and the alarm values of alarm levels other than emergency alarm, serious alarm, and warning alarm are all defined as 0.2.

[0080]

[0081] Among them, V2 is the second vulnerability value of the jth potential vulnerability point, max is the maximum value operation, resource occupancy includes CPU occupancy, memory occupancy and network bandwidth occupancy, CPU occupancy j is the CPU usage and memory usage of the jth potential vulnerability point jis the memory usage and network bandwidth usage of the jth potential vulnerability point j is the network bandwidth occupancy rate of the jth potential vulnerability point, ABF j is the abnormal behavior frequency of the jth potential vulnerability point, LA j is the alarm value of the jth potential vulnerability point, δ is the impact coefficient of resource utilization, ε is the impact coefficient of abnormal behavior frequency, and τ is the impact coefficient of the alarm value.

[0082] The threat attack risk analysis includes: obtaining a potential threat list, calculating similarity scores between potential threats in the potential threat list and threats in a historical threat intelligence database, defining potential threats in the potential threat list with similarity scores greater than or equal to 0.7 as key threats, defining potential threats in the potential threat list with similarity scores greater than 0 and less than 0.7 as non-key threats, and mapping key threats and / or non-key threats to each potential threat vulnerability point in a potential threat vulnerability point matrix to obtain a mapping matrix; defining similarity scores between key threats and / or non-key threats and threats in a historical threat intelligence database as a matching degree, defining the square of the similarity score as an activity degree, and comprehensively analyzing the matching degree and the activity degree to obtain a third vulnerability point value for each potential vulnerability point.

[0083] The historical threat intelligence database stores historical threats that have occurred to the shipboard computer system of this embodiment. The potential threat list is generated using a rule-based system. This system uses predefined rules to detect known types of threats. These rules are typically based on the knowledge and experience of security experts and are designed to target specific attack patterns or abnormal behavior. For example, if a specific IP address attempts to log in more than five times within one minute, an alarm is triggered. Log entries that meet these criteria are marked as potential threats.

[0084] V3=ζ·arctan(S)+k·S 2 ;

[0085] V3 is the third vulnerability value of the jth potential vulnerability point, S is the matching degree of the jth potential threat vulnerability point, S 2 is the activity of the jth potential threat vulnerability point, ζ is the influence coefficient of matching degree, and κ is the influence coefficient of activity degree.

[0086] A comprehensive vulnerability point value is obtained according to the first vulnerability point value, the second vulnerability point value and the third vulnerability point value; a vulnerability threshold is preset, and potential vulnerabilities corresponding to comprehensive vulnerability point values greater than the vulnerability threshold are regarded as threat vulnerabilities.

[0087] v j =ω1·V1+ω2·V2+ω3·V3;

[0088] v jis the comprehensive vulnerability value of the jth potential vulnerability point, ω1 is the weight of the first vulnerability value, ω2 is the weight of the second vulnerability value, and ω3 is the weight of the third vulnerability value.

[0089] Obtain resource usage, abnormal behavior frequency, and system log alarm values of multiple potential vulnerability points in the past for each security event, normalize them, calculate the standard deviation and mean of the normalized data, and use the mean ± 2 times the standard deviation + 0.3 as the vulnerability threshold. k The number of is k, k>1.

[0090] Therefore, the comprehensive vulnerability value of each security event after screening according to the vulnerability threshold is:

[0091]

[0092] H i Represents the comprehensive vulnerability value of the i-th security event, v k It represents the comprehensive vulnerability value of the kth threat vulnerability point after screening by the vulnerability threshold, and m is the total number of threat vulnerability points.

[0093] The non-threat vulnerability points and the mapped potential threat vulnerability points in the mapping matrix are eliminated, and the key threat points and the mapped potential threat vulnerability points are retained to obtain the threat vulnerability matrix.

[0094] On the other hand, the threat severity of each threat vulnerability point is obtained based on the impact scope, duration, and recoverability of the shipboard computer system failure at each threat vulnerability point and the physical access control score of the shipboard computer system.

[0095] The scope of influence refers to the degree of influence of the shipboard computer system failure on the threat vulnerability point. The threat vulnerability points where the shipboard computer system failure occurred are collected from past failure events, and the total number of associated devices connected to the failure threat vulnerability point is obtained, and the abnormal number of associated devices is determined, and the ratio of the abnormal number / total number is used as the scope of influence. The time between the occurrence of the failure of the failure vulnerability point in the past failure event and the completion of the failure repair is used as the duration of this embodiment. Recoverability refers to the ability to recover to normal operating conditions after the failure occurs. In past failure events, the length of time between the start of the repair and the completion of the repair is calculated as the recovery time, and the success rate after repair in the past failure events is again counted. By normalizing the recovery time to a dimensionless value, the normalized recovery time and success rate are added together as recoverability.

[0096] The acquisition of physical access control scores includes:

[0097] Get whitelisted devices and define a calibration effectiveness score;

[0098] Whitelist devices: devices that have been clearly identified and allowed to access the ship's computer system. The information of these devices (such as MAC address, IP address, device ID, etc.) will be recorded in a whitelist.

[0099] Define a calibration effectiveness score that includes:

[0100] The whitelist device list of the shipboard computer system is called to obtain the number of devices allowed to access; the historical access records are called to obtain the number of historical access devices; based on the number of devices allowed to access and the number of historical access devices, the whitelist device coverage ratio C is obtained. w .

[0101] Retrieve a pre-configured whitelist of devices from the onboard computer system.

[0102] Whitelist device coverage ratio C w This is an indicator that measures the completeness of the device whitelist mechanism. Its value is between 0 and 1, indicating the ratio of the number of devices included in the whitelist to the total number of possible connected devices:

[0103] C w = Number of devices allowed to access / Number of devices previously connected

[0104] Call the whitelist device update frequency in the historical access record, filter out the maximum update frequency of the whitelist device; according to the whitelist device coverage ratio C w and the maximum update frequency R of whitelist devices w Get the basic coverage score W0:

[0105] Whitelist device update frequency: refers to the frequency at which the device information in the whitelist (such as MAC address, IP address, device ID, etc.) is regularly checked or updated.

[0106] Define a time period Δt, and determine the change in the number of devices allowed to access within the time period based on the number of devices allowed to access And determine the success rate of whitelist device adjustment; obtain the basic coverage score at each time point in the time period based on the historical access records, and average all time points appearing in the historical access records to obtain the time point average, average the basic coverage scores of all time points to obtain the basic coverage score average, and obtain the correction value based on the basic coverage score at each time point, the time point average, and the basic coverage score average. According to the correction value, the change in allowed access devices, and the success rate of whitelist device adjustment, obtain the whitelist device adjustment rate score;

[0107]

[0108] U w Represents the rate score of the whitelist device adjustment, w1 represents the adjustment coefficient of the change in the amount of allowed access devices, w2 represents the adjustment coefficient of the success rate of the whitelist device adjustment, and w3 represents the adjustment coefficient of the correction value. represents the correction value, represents the mean of the time points, t represents the time points within the time period, W 0，t represents the base coverage score at time point t, represents the mean of basic coverage score, W0 represents the basic coverage score, Represents the amount of change in the device allowed to be accessed. Indicates the success rate of adjusting whitelist devices.

[0109] Collect relevant data from the past period, including the historical changes in the number of devices allowed to access and the historical adjustment success rate. Use statistical methods (such as regression analysis and principal component analysis) to analyze the impact of various factors and use the analysis results as the impact coefficient.

[0110] Whitelist device adjustment success rate Correctly adjust the whitelist ratio for your system:

[0111]

[0112] Number of correct adjustments: refers to the number of times the system accurately adds or removes devices based on historical access records. Total number of adjustments: refers to the total number of times the system attempts to adjust the whitelist.

[0113] Define the maximum tolerated number of unauthorized access attempts, and obtain the number of unauthorized access attempts and threat frequency. Based on the whitelist device adjustment rate score, whitelist device coverage ratio, whitelist device maximum update frequency, maximum tolerated number of unauthorized access attempts, unauthorized access attempts and threat frequency, obtain the correction item, correct the basic coverage score, and obtain the corrected effectiveness score.

[0114] Define the maximum number of unauthorized access attempts allowed within a specific timeframe, typically based on historical statistical analysis. Unauthorized access attempt counts can be obtained by monitoring system logs, using intrusion detection systems (IDS), and analyzing firewall and proxy server logs. Threat frequency can be determined by counting unauthorized access attempts within a fixed or sliding time window.

[0115]

[0116] W represents the calibration validity score, Δw represents the calibration value, and A wRepresents the number of unauthorized access attempts, M w represents the maximum tolerated number of unauthorized access attempts, Y represents the threat frequency, ψ represents the adjustment coefficient between the whitelist device coverage ratio and the maximum update frequency of whitelist devices, ε represents the logarithmic adjustment coefficient, and λ represents the exponential decay coefficient.

[0117] Define a coverage score based on the coverage level of the automatic scanning function.

[0118] The coverage score primarily reflects the automated scanning tool's ability to detect threat vulnerabilities. It measures the proportion of threat vulnerabilities that the scanning tool can discover and identify to the total number of threat vulnerabilities.

[0119] G = Threat vulnerabilities identified by automatic scanning tools / total threat vulnerabilities.

[0120] The physical access control score is obtained based on the correction effectiveness score and the coverage score.

[0121]

[0122] In the above formula, Q k represents the severity of the threat of the kth vulnerability, ω k Represents the weight coefficient of the kth threat vulnerability point, R k represents the impact range of the shipboard computer system failure at the kth threat vulnerability point, S k represents the recoverability of the shipboard computer system failure at the kth threat vulnerability point, T k represents the duration of the shipborne computer system failure at the kth threat vulnerability point, P represents the physical access control score of the shipborne computer system, G represents the coverage score, α represents the power term of the impact range, β represents the power term of recoverability, and α=β=2.

[0123] By analyzing historical attack event data, the frequency of exploitation of each threat vulnerability is counted and used as the weight coefficient.

[0124] Step 3: Determine the network boundary protection capability. Based on the comprehensive threat vulnerability value of the threat vulnerability, the network boundary protection capability, and the threat severity, determine the threat quantification value of each security incident.

[0125] Determine the network perimeter protection capabilities of shipboard computer systems, including:

[0126] The detection rate of the intrusion system is used as the basic network boundary protection capability. According to the basic network boundary protection capability and the threat severity of each security incident, the network boundary protection capability of each security incident is obtained.

[0127] The intrusion system is a core component of network perimeter protection, responsible for detecting and preventing potential threats, which directly impacts the system's security and real-time response capabilities. Therefore, this embodiment uses the sum of the intrusion system's detection rates for each type of threat as the baseline network perimeter protection capability.

[0128]

[0129] K represents the network boundary protection capability of the shipborne computer system, and N0 represents the network boundary protection capability of the shipborne computer system.

[0130]

[0131] Where y i Represents the quantitative threat value of the i-th security event.

[0132] Step 4: Obtain the probability of a key threat exploiting a threat vulnerability to trigger a security incident. Perform a risk assessment based on the probability of a key threat exploiting a threat vulnerability to trigger a security incident, the comprehensive threat vulnerability value, and the threat quantification value to obtain a risk assessment value.

[0133] The feasibility score of each key threat is determined based on the historical threat intelligence database. Based on the feasibility score of the key threat, the network boundary protection capability and the threat severity, the probability of each key threat exploiting the threat vulnerability to trigger a security incident is obtained.

[0134] The number of successful attacks and attempted attacks for each key threat is obtained from the historical threat intelligence database. The feasibility score is obtained by dividing the number of successful attacks by the number of attempted attacks.

[0135]

[0136] Where, F i represents the risk assessment value of the i-th security event, represents the probability that the Lth key threat exploits the kth threat vulnerability to trigger the ith security incident, H i represents the comprehensive threat vulnerability value of the i-th security event, m represents the total number of threat vulnerability points, G L Represents the feasibility score of the Lth key threat.

[0137] like Figure 2 As shown, this embodiment also discloses a risk assessment system for a shipboard computer system, which is used to execute the above-mentioned risk assessment method for a shipboard computer system, and includes the following modules:

[0138] Security event classification module: used to classify the shipboard computer system into three security events according to the impact of the shipboard computer system failure on the ship's operating status;

[0139] Multi-level analysis module: connected to the security event classification module, used to perform multi-level analysis on each security event, identify threat vulnerabilities and obtain the comprehensive threat vulnerability value of the threat vulnerability point; determine the threat severity of each threat vulnerability point;

[0140] Threat Quantification Value Determination Module: This module is connected to the multi-level analysis module and is used to determine the network boundary protection capability. It determines the threat quantification value of each security event based on the comprehensive threat vulnerability value of the threat vulnerability point, the network boundary protection capability, and the threat severity.

[0141] Risk assessment module: connected to the threat quantification value determination module, used to obtain the probability of key threats using threat vulnerabilities to trigger security incidents, and perform risk assessment based on the probability of key threats using threat vulnerabilities to trigger security incidents, the comprehensive threat vulnerability value and the threat quantification value to obtain the risk assessment value.

Claims

1. A risk assessment method for a shipboard computer system, characterized in that: include: Step 1: Classify the shipboard computer system into three safety events based on the impact of the shipboard computer system failure on the ship's operating status; Step 2: Perform multi-level analysis on each security incident to identify threat vulnerabilities and obtain a comprehensive threat vulnerability value for each threat vulnerability; determine the threat severity of each threat vulnerability; Step 3: Determine the network boundary protection capability of the shipboard computer system and determine the threat quantification value of each security event based on the comprehensive threat vulnerability value, network boundary protection capability and threat severity of the threat vulnerability point; Step 4: Obtain the probability of a key threat exploiting a threat vulnerability to trigger a security incident. Perform a risk assessment based on the probability of a key threat exploiting a threat vulnerability to trigger a security incident, the comprehensive threat vulnerability value, and the threat quantification value to obtain a risk assessment value.

2. The risk assessment method for a shipboard computer system according to claim 1, characterized in that: Security incidents include: monitoring and information management security incidents, alarm and monitoring control security incidents, and propulsion and manipulation control security incidents.

3. The risk assessment method for a shipboard computer system according to claim 2, characterized in that: Conduct multi-level analysis on each security incident, including static code analysis, dynamic behavior monitoring analysis, and threat attack risk analysis; Build a potential vulnerability matrix for each security incident. The potential vulnerability matrix includes the potential vulnerability type, potential vulnerability location, and associated devices of the potential vulnerability; Among them, static code analysis includes: determining the code complexity, potential vulnerability density and number of unauthorized access interfaces by calling the static code of each security event, and comprehensively analyzing to obtain the first vulnerability value of each potential vulnerability point; Dynamic behavior monitoring and analysis, including: calling the resource usage rate, abnormal behavior frequency and alarm value of each potential vulnerability in the operating system monitoring record, and comprehensively analyzing to obtain the second vulnerability value of each potential vulnerability; Threat attack risk analysis includes: obtaining a potential threat list, calculating similarity scores between potential threats in the potential threat list and threats in a historical threat intelligence database, defining potential threats in the threat list with similarity scores greater than or equal to 0.7 as critical threats, defining threats in the threat list with similarity scores greater than 0 and less than 0.7 as non-critical threats, and mapping critical threats and / or non-critical threats to each potential threat vulnerability in a potential threat vulnerability matrix to obtain a mapping matrix; defining similarity scores between critical threats and / or non-critical threats and threats in a historical threat intelligence database as a matching degree, defining the square of the similarity score as an activity degree, and comprehensively analyzing the matching degree and the activity degree to obtain a third vulnerability value for each potential vulnerability; A comprehensive vulnerability point value is obtained based on the first vulnerability point value, the second vulnerability point value, and the third vulnerability point value; a vulnerability threshold is preset, and potential vulnerabilities corresponding to comprehensive vulnerability point values greater than the vulnerability threshold are regarded as threat vulnerabilities; The non-threat vulnerability points and the mapped potential threat vulnerability points in the mapping matrix are eliminated, and the key threat points and the mapped potential threat vulnerability points are retained to obtain the threat vulnerability matrix.

4. The risk assessment method for a shipboard computer system according to claim 3, characterized in that: Based on the impact scope, duration, and recoverability of the shipboard computer system failure at each threat vulnerability point, and determining the physical access control score of the shipboard computer system, the threat severity of each threat vulnerability point is obtained; The acquisition of physical access control scores includes: Get whitelisted devices and define a calibration effectiveness score; Define a coverage score based on the coverage level of the automatic scanning function; The physical access control score is obtained based on the correction effectiveness score and the coverage score.

5. The risk assessment method for a shipboard computer system according to claim 4, characterized in that: The process for defining calibration effectiveness scores includes: The whitelist device list of the shipboard computer system is called to obtain the number of devices allowed to access; the historical access records are called to obtain the number of historical access devices; based on the number of devices allowed to access and the number of historical access devices, the coverage ratio of whitelist devices is obtained; The update frequency of whitelist devices in historical access records is called and the maximum update frequency of whitelist devices is obtained through screening. The basic coverage score is obtained based on the whitelist device coverage ratio and the maximum update frequency of whitelist devices. Define a time period, determine the change in the number of devices allowed to access within the time period based on the number of devices allowed to access, and determine the success rate of adjusting the whitelist devices; obtain the basic coverage score at each time point in the time period, and average all time points to obtain the time point mean; average the basic coverage scores at all time points to obtain the basic coverage score mean; obtain a correction value based on the basic coverage score at each time point, the time point mean, and the basic coverage score mean; obtain the whitelist device adjustment rate score based on the correction value, the change in the number of devices allowed to access, and the whitelist device adjustment success rate; Define the maximum tolerated number of unauthorized access attempts and the threat frequency; adjust the rate score of whitelist devices, the coverage ratio of whitelist devices, the maximum update frequency of whitelist devices, and the maximum tolerated number of unauthorized access attempts to obtain the number of unauthorized access attempts and the threat frequency, obtain the correction item, correct the basic coverage score, and obtain the correction effectiveness score.

6. The risk assessment method for a shipboard computer system according to claim 5, characterized in that: Determine network perimeter protection capabilities, including: The detection rate of the intrusion system is used as the basic network boundary protection capability. According to the basic network boundary protection capability and the threat severity of each security incident, the network boundary protection capability of each security incident is obtained.

7. The risk assessment method for a shipboard computer system according to claim 6, characterized in that: The feasibility score of each key threat is determined based on the historical threat intelligence database. Based on the feasibility score of the key threat, the network boundary protection capability and the threat severity, the probability of each key threat exploiting the threat vulnerability to trigger a security incident is obtained.

8. The risk assessment method for a shipboard computer system according to claim 7, characterized in that: The formula for calculating the risk assessment value is: Where, F i represents the risk assessment value of the i-th security event, represents the probability that the Lth key threat exploits the kth threat vulnerability to trigger the ith security incident, H i Represents the comprehensive threat vulnerability value of the i-th security event, y i represents the threat quantification value of the i-th security event, and m represents the total number of threat vulnerabilities.

9. The risk assessment method for a shipboard computer system according to claim 8, characterized in that: The formula for the threat severity of each threat vulnerability is: In the above formula, Q k represents the severity of the threat of the kth vulnerability, ω k Represents the weight coefficient of the kth threat vulnerability point, R k represents the impact range of the shipboard computer system failure at the kth threat vulnerability point, S k represents the recoverability of the shipboard computer system failure at the kth threat vulnerability point, ln is a logarithmic function, T k represents the duration of the shipborne computer system failure at the kth threat vulnerability point, P represents the physical access control score of the shipborne computer system, e is an exponential function, W represents the correction effectiveness score, G represents the coverage score, and C w Represents the coverage ratio of whitelist devices, R w represents the maximum update frequency of the whitelist device, Δw represents the correction value, A w Represents the number of unauthorized access attempts, M w Represents the maximum number of unauthorized accesses tolerated. Represents the amount of change in the device allowed to be accessed. represents the success rate of whitelist device adjustment, t represents the time point within the time period, and W 0，t represents the base coverage score at time point t, represents the mean of basic coverage score, W0 represents the basic coverage score, represents the mean value at each time point, U w represents the adjustment rate score of the whitelist device, Y represents the threat frequency, w1 represents the adjustment coefficient of the change in the amount of allowed access devices, w2 represents the adjustment coefficient of the whitelist device adjustment success rate, and w3 represents the adjustment coefficient of the correction value. represents the correction value, λ represents the exponential decay coefficient, ψ represents the adjustment coefficient between the whitelist device coverage ratio and the maximum update frequency of whitelist devices, ε represents the logarithmic adjustment coefficient, α represents the power term of the impact range, and β represents the power term of recoverability, where α=β=2.

10. The risk assessment method for a shipboard computer system according to claim 9, characterized in that: The formula for calculating the threat quantification value is: Where K represents the network boundary protection capability of the shipborne computer system.

Images