Information and communication technology (ICT) supply chain security assessment method based on expanded multi-layer Bayesian attack graph

Abstract

The invention relates to an ICT supply chain security assessment method based on an expanded multilayer Bayesian attack graph, and the method comprises the steps: firstly analyzing an ICT supply chain, recognizing potential vulnerabilities, and constructing an attack graph from a multilayer cross-domain perspective; according to the Bayesian theory, by means of a general vulnerability scoring system (CVSS), the atomic attack probability is quantified from vulnerability utilization difficulty and influence degree, and the state node accessibility probability is determined according to the node relation; finally, the overall risk state of the target supply chain is evaluated, the false alarm and missing alarm conditions of an intrusion detection system are fully considered, the risk can be dynamically updated according to attack behaviors, the risk can be comprehensively identified, accurate quantitative evaluation and real-time dynamic monitoring can be realized, multiple layers of clear protection targets can be provided, security resources are scientifically configured, and complex cross-domain attacks can be effectively coped. And powerful support is provided for safety guarantee of the ICT supply chain.

Description

Technical Field

[0001] The present invention belongs to the field of information and communication technology (ICT) supply chain security, and specifically relates to an ICT supply chain security assessment method based on an extended multi-layer Bayesian attack graph. Background Art

[0002] ICT products are widely used in various fields, from consumer electronics like smartphones and computers to core systems in key industries like electricity, finance, and communications. However, supply chain attacks are frequent, and the ICT product supply chain faces severe security challenges.

[0003] Traditional vulnerability detection tools often rely on known vulnerability signatures, with limited detection capabilities for new or unknown vulnerabilities, making them prone to missed and false positives. While network security protection technologies can defend against external attacks to a certain extent, their effectiveness is significantly reduced in the face of increasingly sophisticated attack vectors, such as advanced persistent threats (APTs). In terms of supply chain management, existing supplier evaluation and management methods primarily focus on suppliers' product quality and delivery capabilities, lacking comprehensive and in-depth assessments of security risks and failing to effectively address complex cross-domain security threats within the supply chain, including cyber and physical domains. Furthermore, existing methods mostly address security issues within a single link or specific information domain, lacking the ability to comprehensively assess and dynamically monitor the overall security risks of the ICT supply chain, particularly under cross-domain attack threats. Currently, quantitative analysis and security assessment methods for the ICT supply chain fail to provide a clear and intuitive method for observing system vulnerability analysis results. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides an ICT supply chain security assessment method based on an extended multi-layer Bayesian attack graph, focusing on the difficult problems of ICT supply chain security assessment, and is committed to comprehensively and systematically analyzing the security risks in the supply chain. It constructs a model based on the extended multi-layer Bayesian attack graph, comprehensively considering the information domain and physical domain, accurately assessing the possibility and impact of risks, and dynamically updating the risk assessment results according to the real-time monitored attack behaviors, so as to achieve accurate assessment and dynamic monitoring of supply chain security risks, effectively respond to complex and changing security threats, and provide a comprehensive and reliable security assessment solution for ensuring the security of the ICT supply chain.

[0005] In order to solve the above technical problems, the technical solution provided by the present invention is:

[0006] An ICT supply chain security assessment method based on an extended multi-layer Bayesian attack graph includes the following steps:

[0007] S1. Analyze the ICT supply chain, determine the state nodes in the information and physical domains, identify security event nodes, identify potential security vulnerabilities in the supply chain, determine attack nodes and observation nodes, and establish an extended multi-layer Bayesian attack graph model;

[0008] S2. Quantify the extended attack graph model constructed in S1 based on Bayesian theory. Determine quantitative assessment indicators for ICT supply chain threats based on the difficulty and impact of the vulnerability. Calculate the corresponding atomic attack probabilities and conditional probabilities of state nodes. Connect these probabilities with the security state nodes of the ICT supply chain in the form of conditional transition probabilities to obtain the static reachability probability of each node. Calculate the dynamic reachability probability when an attack is detected, and provide the confidence level of the observed node.

[0009] S3. Based on the atomic attack probability and the static reachability probability of the node calculated in S2, the static risk status of the target supply chain under the cross-domain attack is evaluated, and the dynamic risk status of the system is evaluated and updated based on the observed attack behavior.

[0010] Preferably, the specific process of S1 establishing the extended multi-layer Bayesian attack graph model is:

[0011] S1.1 Identify potential vulnerabilities in the ICT supply chain that could be exploited by attackers, as well as the attacker's initial information and possible attack behaviors, and add them to the attack queue;

[0012] S1.2 checks whether the attack queue described in S1.1 is empty. If not, proceed to S1.3. If it is empty, obtain the final extended multi-layer Bayesian attack graph.

[0013] S1.3 Scan the attack queue described in S1.1 to check the prerequisites and required resources for each attack behavior;

[0014] If there is no attack behavior that meets the prerequisites, then update the current attacker's information and attack queue and return to S1.2. If there is an attack behavior that meets the prerequisites, simulate the attacker to perform the attack behavior, obtain new attack conditions and resources, add the new resources as nodes, and connect them to the existing expanded attack graph.

[0015] S1.5 repeats S1.2 to S1.4 to obtain the final extended multi-layer Bayesian attack graph model.

[0016] Preferably, the S2 quantifies the extended multi-layer Bayesian attack graph based on Bayesian theory, specifically:

[0017] S2.1 Probability of atomic attack on nodes

[0018] Quantify ICT supply chain risks using a vulnerability scoring system based on the ease of exploitation and impact of vulnerabilities;

[0019] The difficulty of vulnerability exploitation is divided into access vector AV, access complexity AC and required permissions PR, and the impact level includes confidentiality C, integrity I and availability A. Based on the above indicators, the formula for calculating the vulnerability score is:

[0020] BaseScore=min(Exp+Impact,10) (1)

[0021] Exp=8.22×AC×AV×PR (2)

[0022] Impact=6.42×(1-(1-C)×(1-I)×(1-A)) (3)

[0023] Calculate atomic attack node α based on BaseScore i The probability of εA is:

[0024]

[0025] S2.2 State Node Reachability Probability

[0026] For any state node, it can be in one of two states, 1 means that the attacker has exploited the corresponding state node, and 0 means that the node has not been successfully exploited. Calculate the conditional probability P(S) that the state node is exploited by the attacker under the influence of the parent node. i |Par(S i ));

[0027] If it is an OR relationship, that is, the child node S i As long as one of the parent nodes is exploited, it will be exploited. The calculation formula is:

[0028]

[0029] If it is an AND relationship, that is, the child node S i It will be exploited only when all parent nodes are exploited. The calculation formula is:

[0030]

[0031] After determining the conditional probability of the state node, calculate the static reachability probability of the node. The formula is:

[0032]

[0033] For an interdependent network, assuming that the attacker successfully executes a specific atomic attack, the corresponding state node S j =1, calculate its parent state node S i The dynamic reachability probability is:

[0034] P(Si |S j )=P(S j |S i )×P(S i ) / P(S j ) (8)

[0035] S2.3 Confidence of observation nodes

[0036] In the extended multi-layer Bayesian attack graph, each attack node α i Single connection to the corresponding observation node o i , that is, the observation node o i The parent node is the only attack node α i ; Once the atom attacks α i is detected, the corresponding observation node will be activated, i.e. i =1;

[0037] Considering the existence of false positives and false negatives in the intrusion detection system, suppose an attack α is detected. i The false negative rate is γ i , the false alarm rate is β i , then o i The local conditional probability distribution of can be defined as:

[0038]

[0039] Among them, the observation node o i The confidence level is defined as the probability that the evidence o i Time attack α i The probability of occurrence is calculated as follows:

[0040]

[0041] Among them, P(α i ) represents the atomic attack α in the extended attack graph i Probability of occurrence.

[0042] Preferably, S3 evaluates the overall risk status of the target supply chain under a cross-domain attack, specifically:

[0043] S3.1 Risk assessment indicators

[0044] According to the probability distribution of reachability of each node, combined with the value attributes of each node, the risk assessment index is defined, expressed as R c 、R p 、R e , which are the information domain security risks, physical domain functional safety risks, and security incident risks of the ICT supply chain:

[0045]

[0046] Among them, V(S i ) represents the value of the state node, V(e i ) represents the value of the security event node, which is used to evaluate the overall risk status of different domains; for each status node within the domain, the status node risk assessment index is defined, expressed as R i , used to distinguish the risk levels of different nodes within the domain:

[0047] R i =P(S i |S j )×V(S i ) (14)

[0048] S3.2 Static risk assessment

[0049] When the ICT supply chain system has not been actually attacked, the risk value is calculated by substituting the static reachability probability of each state node obtained from S2 into the risk assessment index calculation formula. The risk of the state nodes in different domains as a whole and within the domains is ranked according to the risk value to achieve static risk assessment of the ICT supply chain.

[0050] S3.3 Dynamic risk assessment

[0051] Once the intrusion detection system detects the corresponding atomic attack α i , the corresponding observation node will be activated o i , 取置信度 The given value is 95%. If the observation node o i If the confidence level exceeds a given value, it is considered that an atomic attack has occurred, and the corresponding state node S j =1, use formula (8) to calculate its parent state node S i The dynamic reachability probability of each node in the Bayesian attack graph is updated based on the dynamic reachability probability of the affected state nodes. After the update, the dynamic reachability probability of each node in different domains is substituted into the risk assessment index calculation formula to calculate the risk value of the entire domain and each node in the domain, and give a risk ranking. Once a new atomic attack is successful, the dynamic reachability probability of each node is updated to achieve dynamic risk assessment of the ICT supply chain.

[0052] The beneficial effects of the present invention are:

[0053] 1. The method of this invention can comprehensively analyze the ICT supply chain, deeply dissect supply chain links, and accurately construct attack paths, providing clear and accurate security protection targets for subsequent security protection work, effectively countering advanced persistent threats (APTs). By introducing physical domain status nodes and security event nodes based on the traditional Bayesian attack graph, it achieves cross-domain attack modeling from the information domain to the physical domain, and establishes logical relationships between nodes based on the penetration process to resist cross-domain attacks in the information and physical domains.

[0054] 2. The quantitative method based on Bayesian theory considers quantitative indicators of multiple factors and fully considers the dependencies between security risks. It can accurately calculate the probability of the vulnerability triggering an atomic attack, providing precise data support for risk assessment, and can provide an accurate and reliable basis for security decision-making, helping to rationally allocate security resources and give priority to protecting key nodes with high risks and high values.

[0055] 3. Incorporating false positives and missed negatives into the risk assessment process enhances the authenticity and reliability of risk assessment results. This method makes security decisions based on the confidence level of real-time observed attack behaviors, dynamically updates risk status, responds to attack behaviors in a timely manner, predicts risk trends in advance, and takes preventive measures in advance, effectively improving the security and stability of the information and physical domains of the ICT supply chain.

[0056] The advantages of the ICT supply chain security assessment method based on the extended multi-layer Bayesian attack graph described in this invention over traditional ICT supply chain security assessment methods are mainly shown in the following table:

[0057]

[0058]

[0059] BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0061] Figure 1 This is the overall framework diagram of the ICT supply chain security assessment method based on the expanded multi-layer Bayesian attack graph of the present invention.

[0062] Figure 2 To expand the multi-layer Bayesian attack graph example.

[0063] Figure 3 Extended multi-layer Bayesian attack graph for supply chain security assessment.

[0064] Figure 4A quantitative graph of the probability of atomic attack. DETAILED DESCRIPTION

[0065] The following describes preferred embodiments of the present invention in conjunction with the accompanying drawings. It should be understood that the following embodiments are provided for illustrative purposes only and are not intended to limit the scope of the present invention. Those skilled in the art may make various modifications and substitutions to the present invention without departing from the purpose and spirit of the present invention.

[0066] like Figure 1 As shown, the present invention provides an ICT supply chain security assessment method based on an extended multi-layer Bayesian attack graph, comprising the following steps:

[0067] S1. Analyze the ICT supply chain, sort out the raw material supply, product research and development, production and manufacturing, system integration, warehousing and logistics, and product use and maintenance stages of the ICT supply chain, determine the status nodes under the information domain and physical domain, determine the security event nodes, identify potential security vulnerabilities in the supply chain, collect the attacker's attack methods, resources and target information, form the potential vulnerabilities and attack information into an initial attack queue, determine the attack nodes and observation nodes, and establish an extended attack graph model.

[0068] Conduct an in-depth analysis of each attack behavior in the attack queue to determine whether the conditions and resources required for its implementation are met. For attacks that require specific permissions to be implemented, check whether the current attacker has such permissions; for attacks that rely on a specific network environment, confirm whether the corresponding network connection exists. If the attack conditions are met, simulate the attacker to perform the attack behavior, record the new resources obtained after the attack, including sensitive information obtained and elevated permissions, and add these new resources as nodes to the attack graph. At the same time, establish connections between the new nodes and the relevant nodes in the existing attack graph to represent the attack path. If the attack conditions are not met, update the attacker's capabilities and resource information, as well as the priority and feasibility of the attack behaviors in the attack queue based on the newly obtained information, including vulnerability repair status and changes in system protection measures.

[0069] The specific process of S1 establishing the extended attack graph model is as follows:

[0070] S1.1 Identify potential vulnerabilities in the ICT supply chain that could be exploited by attackers, as well as the attacker's initial information and possible attack behaviors, and add them to the attack queue;

[0071] S1.2 checks whether the attack queue described in S1.1 is empty. If not, proceed to S1.3. If it is empty, obtain the final extended multi-layer Bayesian attack graph.

[0072] S1.3 Scan the attack queue described in S1.1 to check the prerequisites and required resources for each attack behavior;

[0073] If there is no attack behavior that meets the prerequisites, then update the current attacker's information and attack queue and return to S1.2. If there is an attack behavior that meets the prerequisites, simulate the attacker to perform the attack behavior, obtain new attack conditions and resources, add the new resources as nodes, and connect them to the existing expanded attack graph.

[0074] S1.5 repeats S1.2 to S1.4 to obtain the final extended multi-layer Bayesian attack graph model.

[0075] S2. Quantify the extended attack graph model constructed in S1 based on Bayesian theory. Determine quantitative assessment indicators for supply chain threats based on the difficulty and impact of the vulnerability. Calculate the corresponding atomic attack node probabilities and state node conditional probabilities. Connect these probabilities to the security state nodes of the ICT supply chain using conditional transition probabilities. Calculate the static reachability probability of each state node. After detecting an attack, calculate the dynamic reachability probability. Provide the confidence level of the observed node to reflect the credibility of the detected atomic attack.

[0076] The specific method of quantifying the extended attack graph model based on Bayesian theory is as follows:

[0077] S2.1 Probability of atomic attack nodes: Utilize a vulnerability scoring system to quantify ICT supply chain risks based on the difficulty and impact of vulnerability exploitation. The difficulty of vulnerability exploitation is divided into access vector (AV), access complexity (AC), and required permissions (PR). The impact is divided into confidentiality (C), integrity (I), and availability (A). Based on these indicators, the formula for calculating the vulnerability score is:

[0078] BaseScore=min(Exp+Impact,10) (1)

[0079] Exp=8.22×AC×AV×PR (2)

[0080] Impact=6.42×(1-(1-C)×(1-I)×(1-A)) (3)

[0081] Calculate atomic attack node α based on BaseScore i The probability of εA is:

[0082]

[0083] S2.2 State node reachability probability: For any state node, it is in one of two states, 1 means that the attacker has successfully exploited the corresponding state node, and 0 means that the node has not been successfully exploited. Calculate the conditional probability P(S) that the state node is successfully exploited by the attacker under the influence of the parent node. i |Par(S i)),

[0084] If it is an OR relationship, that is, the child node S i As long as one of the parent nodes is exploited, it will be exploited. The calculation formula is:

[0085]

[0086] If it is an AND relationship, that is, the child node S i It will be exploited only when all parent nodes are exploited. The calculation formula is:

[0087]

[0088] After determining the conditional probability of the state node, calculate the static reachability probability of the node. The formula is:

[0089]

[0090] For an interdependent network, assuming that the attacker successfully executes a specific atomic attack, the corresponding state node S j =1, calculate its parent state node S i The dynamic reachability probability is:

[0091] P(S i |S j )=P(S j |S i )×P(S i ) / P(S j ) (8)

[0092] S2.3 Confidence of observation nodes:

[0093] In the extended attack graph, each attack node α i Single connection to the corresponding observation node o i , that is, the observation node o i The parent node is the only attack node α i ; Once the atom attacks α i is detected, the corresponding observation node will be activated, i.e. i =1; Considering the existence of false positives and false negatives in the intrusion detection system, let the attack detected be α i The false negative rate is γ i , the false alarm rate is β i , then o i The local conditional probability distribution of is defined as:

[0094]

[0095] Among them, the observation node o i The confidence level is defined as the probability that the evidence oi Time attack α i The probability of occurrence is calculated as follows:

[0096]

[0097] Among them, P(α i ) represents the atomic attack α in the extended attack graph i Probability of occurrence.

[0098] S3. Based on the atomic attack probability and the static reachability probability of the node calculated in S2, the static risk status of the target supply chain under the cross-domain attack is evaluated, and the dynamic risk status of the system is evaluated and updated based on the observed attack behavior.

[0099] Static risk assessment: Based on the Bayesian attack graph model constructed by S1, combined with the quantified atomic attack probability (such as Figure 4 A comprehensive assessment of the static risk status of the ICT supply chain is conducted based on the static accessibility probability of the target node and the static accessibility probability of the node. Risk values are calculated based on the target node's accessibility probability and node value. Risk ranking is then performed to identify which nodes are more vulnerable to attack in their current state, as well as the scope and severity of the impact of these attacks. For critical business nodes, if their accessibility probability is high and a successful attack could lead to supply chain disruption or the leakage of important data, they should be given special attention and appropriate protective measures should be implemented.

[0100] Dynamic risk assessment and update: During the actual operation of the ICT supply chain, once an intrusion detection system detects an attack, the corresponding observation node is activated. Simultaneously, the intrusion detection system considers both false positives and false negatives and determines whether an attack has occurred based on the confidence level of the observation node. Using a dynamic reachability probability formula, the probabilities of relevant status nodes are updated to reassess the supply chain risk status. If a successful attack is detected on a node, the model rapidly calculates and updates the risk probabilities of associated nodes based on their relationships with other nodes, and updates the risk ranking, thus achieving dynamic risk assessment.

[0101] The specific process of assessing the overall risk status of the target supply chain under cross-domain attacks is as follows:

[0102] S3.1 Risk assessment indicators

[0103] According to the probability distribution of reachability of each node, combined with the value attributes of each node, the risk assessment index is defined, expressed as R c 、R p 、R e , which are the information domain security risks, physical domain functional safety risks, and security incident risks of the ICT supply chain:

[0104]

[0105] Among them, V(S i ) represents the value of the state node, V(e i ) represents the value of the security event node, which is used to evaluate the overall risk status of different domains; for each status node within the domain, the status node risk assessment index is defined, expressed as R i , used to distinguish the risk levels of different nodes within the domain:

[0106] R i =P(S i |S j )×V(S i ) (14)

[0107] S3.2 Static risk assessment

[0108] When the ICT supply chain system has not suffered actual attacks, the risk value is calculated by substituting the static reachability probability of each state node obtained from S2 into the risk assessment index calculation formula. The state nodes in different domains and within domains are ranked according to the risk value. The nodes that are vulnerable to attacks in the current state and the possible scope and severity of the impact are clearly identified, so that corresponding protective measures can be taken to achieve static risk assessment of the ICT supply chain.

[0109] S3.3 Dynamic risk assessment

[0110] Once the intrusion detection system detects the corresponding atomic attack α i , the corresponding observation node will be activated o i , take the confidence value as 95%, if the observation node o i If the confidence level exceeds a given value, it is considered that an atomic attack has occurred, and the corresponding state node S j =1, use formula (8) to calculate its parent state node S i The dynamic reachability probability of each affected state node in the Bayesian attack graph is updated based on the dynamic reachability probability. After the update, the dynamic reachability probability of each node in each domain is substituted into the risk assessment indicator calculation formula to calculate the risk value of each domain as a whole and for each node within the domain, and then a risk ranking is given. If a new atomic attack is successful, the dynamic reachability probability of each node is updated to achieve dynamic risk assessment of the ICT supply chain.

[0111] The risk assessment results, calculated by combining different domains with their node values, are promptly fed back to security managers, allowing them to adjust security policies and take effective preventative measures, prioritizing the protection of key nodes in critical domains with higher risk values to ensure the secure and stable operation of the ICT supply chain. This allows for accurate and dynamic risk assessment of the ICT supply chain.

[0112] like Figure 2The figure below shows an example of an expanded multi-layer Bayesian attack graph, including information, physical, and security event domains. First, we analyze system vulnerabilities, add attack sequences, and add attack nodes to the attack graph. We then add a unique observation node to each attack node and determine the status nodes and logical relationships of each domain based on the attack resources of the attack node.

[0113] like Figure 3 As shown in Figure 1, it is an extended multi-layer Bayesian attack graph for supply chain security assessment. The specific process of constructing the attack graph is as follows:

[0114] A comprehensive analysis of the ICT supply chain, encompassing every stage from raw material supply to product development, reveals exploitable security vulnerabilities in the information domain. Attackers could potentially launch malicious intrusions, such as impersonating or posing as unqualified suppliers to forge documents and related information, gain backdoor access to information systems and steal internal network information, or implant malware to tamper with supply information and gain backdoor access to hardware. In the physical domain, physical attacks could involve maliciously damaging product components, stealing confidential production data, and altering supply quantities and amounts. Ultimately, this could lead to security incidents that disrupt the supply chain.

[0115] Gather the attacker's initial information, including their basic network access capabilities and some weak system passwords. Organize this potential vulnerability and attack information into an initial attack queue. Based on the supply chain characteristics and attack scenarios, perform the following steps to identify each node.

[0116] Check the attack queue: At the beginning, check whether the initial attack queue is empty. If the queue is not empty, proceed to the next step.

[0117] Scan for attack behavior conditions: Scan each attack behavior in the attack queue and examine its prerequisites and required resources. For example, for the attack behavior "Gaining backdoor access to an information system," its prerequisite might be an unpatched vulnerability in the system, and the required resources might include network scanning tools and personnel with vulnerability exploitation skills.

[0118] Simulating Attacks and Adding Nodes: If an attack behavior meets the prerequisites, such as a system with an exploitable vulnerability and the attacker possessing the corresponding tools and techniques, simulate the attacker executing that attack behavior. After executing the "Gain Backdoor Access to Information Systems" attack, the attacker gains new resources, such as sensitive system information or enhanced access rights. These new resources are added as nodes to the attack graph and connected to the information domain state nodes associated with the "Gain Backdoor Access to Information Systems" attack node in the existing expanded attack graph to represent the attack path and the logical relationship between nodes.

[0119] Update and loop: If no attack behavior meets the prerequisites, based on newly acquired information (e.g., if the system administrator has fixed some vulnerabilities, temporarily preventing the attack behavior from being carried out), the current attacker's information is updated (e.g., reducing their ability to exploit specific vulnerabilities) and the attack queue (adjusting the priority and feasibility of the attack behavior). The algorithm then returns to the attack queue check step and continues the loop. After multiple iterations, the attack queue is empty, resulting in the final extended multi-layer Bayesian attack graph.

[0120] Node relationship determination and risk assessment preparation: In the constructed attack graph, the OR or AND relationship between status nodes is clearly defined. This is used to subsequently calculate the reachability probability of the status nodes, laying the foundation for risk assessment and thus achieving a quantitative assessment of ICT supply chain security risks.

[0121] like Figure 4 As shown in the figure, the probability distribution data of 6 atomic attack nodes is calculated based on the logical relationship between each node to perform static risk assessment. Once a valid attack is detected, the dynamic reachability probability is calculated to update the risk status, give a clear risk ranking, and provide key protection targets.

[0122] In summary, the method of the present invention can achieve comprehensive risk identification, accurate quantitative assessment, real-time dynamic monitoring of the ICT supply chain, provide multi-layer clear protection targets, scientifically allocate security resources, effectively respond to complex cross-domain attacks, and provide strong support for the security of the ICT supply chain.

[0123] The above embodiments are only used to illustrate the present invention, and are not intended to limit the present invention. Ordinary technicians in the relevant technical field may make various changes and modifications without departing from the essence and scope of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the present invention. The scope of patent protection of the present invention should be defined by the claims.

[0124] The contents not described in detail in this specification belong to the prior art known to those skilled in the art.

Claims

1. An ICT supply chain security assessment method based on an extended multi-layer Bayesian attack graph, characterized by: The steps include: S1. Analyze the ICT supply chain, determine the state nodes in the information and physical domains, identify security event nodes, identify potential security vulnerabilities in the supply chain, determine attack nodes and observation nodes, and establish an extended multi-layer Bayesian attack graph model; S2. Quantify the extended multi-layer Bayesian attack graph model constructed in S1 based on Bayesian theory. Determine quantitative assessment indicators for ICT supply chain threats based on the difficulty and impact of the vulnerability. Calculate the corresponding atomic attack probabilities and conditional probabilities of state nodes. Connect these probabilities with the security state nodes of the ICT supply chain in the form of conditional transition probabilities to obtain the static reachability probability of each node. Calculate the dynamic reachability probability when an attack is detected, and provide the confidence level of the observed node. S3. Based on the atomic attack probability and the static reachability probability of the node calculated in S2, the static risk status of the target supply chain under the cross-domain attack is evaluated, and the dynamic risk status of the system is evaluated and updated based on the observed attack behavior.

2. The ICT supply chain security assessment method based on the extended multi-layer Bayesian attack graph according to claim 1 is characterized in that: The specific process of establishing the extended multi-layer Bayesian attack graph model in S1 is as follows: S1.1 Identify potential vulnerabilities in the ICT supply chain that could be exploited by attackers, as well as the attacker's initial information and possible attack behaviors, and add them to the attack queue; S1.2 checks whether the attack queue described in S1.1 is empty. If not, proceed to S1.3; If it is empty, the final extended multi-layer Bayesian attack graph is obtained; S1.3 Scan the attack queue described in S1.1 to check the prerequisites and required resources for each attack behavior; If there is no attack behavior that meets the prerequisites, then update the current attacker's information and attack queue and return to S1.

2. If there is an attack behavior that meets the prerequisites, simulate the attacker to perform the attack behavior, obtain new attack conditions and resources, add the new resources as nodes, and connect them to the existing expanded attack graph. S1.5 repeats S1.2 to S1.4 to obtain the final extended multi-layer Bayesian attack graph model.

3. The ICT supply chain security assessment method based on the extended multi-layer Bayesian attack graph according to claim 1 is characterized in that: The S2 quantifies the extended multi-layer Bayesian attack graph based on Bayesian theory, specifically: S2.1 Probability of atomic attack on nodes Quantify ICT supply chain risks using a vulnerability scoring system based on the ease of exploitation and impact of vulnerabilities; The difficulty of vulnerability exploitation is divided into access vector AV, access complexity AC and required permissions PR, and the impact level includes confidentiality C, integrity I and availability A. Based on the above indicators, the formula for calculating the vulnerability score is: BaseScore=min(Exp+Impact,10) (1) Exp=8.22×AC×AV×PR (2) Impact=6.42×(1-(1-C)×(1-I)×(1-A)) (3) Calculate atomic attack node α based on BaseScore i The probability of εA is: S2.2 State Node Reachability Probability For any state node, it can be in one of two states, 1 means that the attacker has exploited the corresponding state node, and 0 means that the node has not been successfully exploited. Calculate the conditional probability P(S) that the state node is exploited by the attacker under the influence of the parent node. i |Par(S i )); If it is an OR relationship, that is, the child node S i As long as one of the parent nodes is exploited, it will be exploited. The calculation formula is: If it is an AND relationship, that is, the child node S i It will be exploited only when all parent nodes are exploited. The calculation formula is: After determining the conditional probability of the state node, calculate the static reachability probability of the node. The formula is: For an interdependent network, assuming that the attacker successfully executes a specific atomic attack, the corresponding state node S j =1, calculate its parent state node S i The dynamic reachability probability is: P(S i |S j )=P(S j |S i )×P(S i ) / P(S j ) (8) S2.3 Confidence of observation nodes In the extended multi-layer Bayesian attack graph, each attack node α i Single connection to the corresponding observation node o i , that is, the observation node o i The parent node is the only attack node α i ; Once the atom attacks α i is detected, the corresponding observation node will be activated, i.e. i =1; Considering the existence of false positives and false negatives in the intrusion detection system, suppose an attack α is detected. i The false negative rate is γ i , the false alarm rate is β i , then o i The local conditional probability distribution of can be defined as: Among them, the observation node o i The confidence level is defined as the probability that the evidence o i Time attack α i The probability of occurrence is calculated as follows: Among them, P(α i ) represents the atomic attack α in the extended attack graph i Probability of occurrence.

4. The ICT supply chain security assessment method based on the extended multi-layer Bayesian attack graph according to claim 3 is characterized in that: The S3 evaluates the overall risk status of the target supply chain under cross-domain attacks, specifically: S3.1 Risk assessment indicators According to the probability distribution of reachability of each node, combined with the value attributes of each node, the overall risk assessment index is defined, expressed as R c 、R p 、R e , which are the information domain security risks, physical domain functional safety risks, and security incident risks of the ICT supply chain: Among them, V(S i ) represents the value of the state node, V(e i ) represents the value of the security event node and is used to evaluate the overall risk status of different domains; For each state node in the domain, define the state node risk assessment index, expressed as R i , used to distinguish the risk levels of different nodes within the domain: R i =P(S i |S j )×V(S i ) (14) S3.2 Static risk assessment When the ICT supply chain system has not been actually attacked, the static reachability probability of each state node obtained from S2 is substituted into the risk assessment index calculation formula to calculate the risk value. The state nodes of different domains as a whole and within the domain are ranked according to the risk value to evaluate the static risk of the ICT supply chain. S3.3 Dynamic risk assessment Once the intrusion detection system detects the corresponding atomic attack α i , the corresponding observation node will be activated o i , take the confidence value as 95%, if the observation node o i If the confidence level exceeds a given value, it is considered that an atomic attack has occurred, and the corresponding state node S j =1, use formula (8) to calculate its parent state node S i The dynamic reachability probability of each affected state node in the Bayesian attack graph is updated based on the dynamic reachability probability. After the update, the dynamic reachability probability of each node in different domains is substituted into the risk assessment index calculation formula to calculate the risk value of each domain as a whole and for each node within the domain, and then a risk ranking is given. If a new atomic attack is successful, the dynamic reachability probability of each node is updated again to achieve dynamic risk assessment of the ICT supply chain.

Images