Network security dynamic risk assessment method based on DDS system

Abstract

The invention relates to the technical field of network risk assessment, in particular to a dynamic risk assessment method for network security based on a DDS (Direct Digital Synthesizer) system. Comprising the steps of S1, building a DDS system network model, S2, building an equipment layer Bayesian attack graph to perform static and dynamic risk quantification, S3, building a business layer SIR model to perform dynamic risk propagation analysis, and S4, integrating multi-dimensional risks to perform dynamic assessment. According to the method, the Bayesian attack graph of the equipment layer and the SIR model of the service layer are organically fused, unified quantification and dynamic prediction of risks of the physical equipment and the service logic layer are achieved, the prior art is mostly limited to single-level analysis, and through the SIR propagation model and time sequence analysis, the risk of the physical equipment and the risk of the service logic layer can be predicted. According to the method, the propagation trend of attacks in the network and future node risk distribution can be predicted, the response speed and accuracy of risk assessment are remarkably improved, the online security protection requirement in a complex network environment is met, and the risk prediction accuracy and timeliness are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network risk assessment, and in particular to a method for dynamic network risk assessment based on a DDS system. Background Art

[0002] As the demand for real-time and reliable distributed real-time communications continues to increase in fields such as industrial control, intelligent manufacturing, and the Internet of Things, Data Distribution Service (DDS) has been widely adopted in scenarios such as robot formations, smart grids, and remote collaboration due to its efficient publish / subscribe mechanism and strict service quality assurance.

[0003] However, the network topology of the DDS system is highly dynamic, with heterogeneous node types, and communication relationships are dynamically mapped at the middleware layer through topics. Traditional static risk assessment based on CVSS vulnerability scores can only identify weaknesses at the device layer, but cannot reflect the propagation trend of attacks at the business logic layer. Although existing Bayesian attack graph methods can dynamically update node risks, they are mostly limited to a single field (such as the power system) and do not incorporate the logical dependencies under the publish / subscribe model, making it difficult to predict future risk distribution. Although the infectious disease (SIR) model can simulate risk propagation, it has only been applied to the device layer or general DCPS systems in existing research. It is not adapted to the topic-driven business layer environment of DDS and lacks cross-level fusion analysis.

[0004] Therefore, there is an urgent need for an end-to-end dynamic risk assessment method that can take into account both static and dynamic risks at the physical device layer and simulate the propagation characteristics of the publish / subscribe logical layer. To solve the above problems, we propose a dynamic risk assessment method for network security based on DDS system. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the present invention provides a dynamic risk assessment method for network security based on DDS system to solve the problems raised in the background technology.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions:

[0007] A dynamic risk assessment method for network security based on a DDS system, comprising:

[0008] S1. Build a DDS system network model to describe the physical connections and publish / subscribe topology of sensor nodes, controller nodes, and server nodes in the DDS system.

[0009] S2. Construct a device-level Bayesian attack graph for static and dynamic risk quantification, which is used to assess the risk of physical device nodes based on vulnerability scan results and inter-node connection probabilities.

[0010] S3. Build a business-layer SIR model to conduct dynamic risk propagation analysis, simulating the attack spread process in the publish / subscribe logic layer.

[0011] S4. Perform dynamic assessment of multi-dimensional risks to integrate device-layer and business-layer risks and output the comprehensive risk distribution of the system.

[0012] Furthermore, the step S1 includes:

[0013] Configure sensor nodes, controller nodes, and server nodes in the DDS system and establish physical connections through wired or wireless interfaces;

[0014] Install DDS middleware on each node and configure global data space parameters, domain participant parameters, and service quality policies;

[0015] Define data topics. Sensor nodes publish monitoring data topics. Controller nodes subscribe to monitoring data topics and publish control instruction topics. Server nodes subscribe to control instruction topics.

[0016] During the topology model construction process, the device layer model creates an N×N adjacency matrix to represent the physical connection relationships between nodes. A matrix element value of 1 indicates a physical connection, and a value of 0 indicates no connection. The model also records the interface configuration parameters and link performance parameters of each node.

[0017] Establish the physical connection topology between nodes and annotate the link bandwidth, latency, and message frequency;

[0018] The connectivity of the adjacency matrix and the correctness of the publish / subscribe matrix are verified respectively through ICMP protocol and DDS test messages;

[0019] Deploy a data collection agent on each node to periodically collect performance indicators such as CPU utilization, memory usage, network throughput, message delay, packet loss rate, and number of topic subscriptions.

[0020] Furthermore, the step S2 includes:

[0021] Use Nessus or OpenVAS to scan each physical node to obtain vulnerability information;

[0022] Based on the CVSS system, the attack difficulty (Exploitability) and attack benefit (Impact) of each vulnerability are calculated, and the node single attack probability (P) is calculated by the following formula:

[0023] Exploitability=8.22*AV*AC*PR*UI

[0024] Impact=6.42*[1-(1-C)*(1-I)*(1-A)]

[0025] P=[(Exploitability+Impact) / 10]*100%

[0026] Among them, Attack Vector (AV) is the attack vector, Attack Complexity (AC) is the attack complexity, PrivilegesRequired (PR) is the required permissions, User Interaction (UI) is the user interaction, Confidentiality (C) is the confidentiality, Integerity (I) is the integrity, and Availability (A) is the availability;

[0027] Based on the adjacency matrix and P, a directed Bayesian attack graph is constructed, and a conditional probability table CPT is assigned to each edge. The CPT can be given according to P. Given the initial attack node node0, node node j Static value at risk Calculation is as follows:

[0028]

[0029] represents the probability of an attack spreading from node0 to nodej, where P(node j =1|node0=1) is calculated through forward reasoning and combined with the Bayesian formula:

[0030]

[0031] Pa(node j ) is a node j The set of all parent nodes, P(node i ) is node i The probability of a state value, such as node i =1, the calculated probability is P, otherwise, it is 1-P;

[0032] The Bayesian network tool is used to reason about the attack graph and obtain the static risk value and dynamic risk value of each node.

[0033] Furthermore, the step S3 includes:

[0034] Set the initial state for each node. In the safe case, the state of all nodes is unattacked (S). The risk value is When a node is detected to be under attack, its state will change from S to the attacked state (I), and its risk value is 1;

[0035] Establish a time series array to record the risk value changes at each time step. At each time step, calculate the probability of the unattacked state (S) node being attacked. The following formula:

[0036]

[0037] Among them, β is the propagation rate, which can be selected according to the specific situation of network propagation message, N I is the number of nodes in the attacked state, N is the total number of subscribed neighbors of the node, and the risk value of the node in the unattacked state (S) is updated as:

[0038]

[0039] in and They represent the dynamic propagation risk values at time t and t+1 respectively;

[0040] Regardless of the node recovery situation, the risk value of the node in the attacked state (I) remains unchanged, and the risk value of the business layer node is Changes over time.

[0041] Furthermore, the step S4 includes:

[0042] Combining the Bayesian attack graph risk assessment results at the device layer with the SIR dynamic propagation analysis results at the service layer to build a comprehensive multi-dimensional risk assessment model;

[0043] Set the device layer weight w according to the actual situation d and business layer w s Weight, satisfying w d +w s =1, therefore, after a node is attacked, at any time t, node node j The comprehensive risk value

[0044]

[0045] in, Node calculated for the device layer j The dynamic risk value of Node calculated by the business layer j Dynamic propagation risk value at time t.

[0046] Furthermore, the performance indicator collection period T is configurable, and the collected indicators are used to dynamically adjust the node attack probability P and the propagation rate β.

[0047] Furthermore, the data acquisition agent also includes a real-time monitoring module for monitoring the dynamic status of network devices and feeding back the monitored dynamic information to the device layer Bayesian attack graph to dynamically adjust the attack graph structure and the probability values in the conditional probability table, thereby improving the timeliness and accuracy of risk assessment.

[0048] Furthermore, the conditional probability table CPT is generated by mapping the P values between nodes. The static risk is calculated by accumulating the product of all path probabilities from the initial attack node to the target node. The dynamic risk is set to 1 after the target node is attacked and is re-inferred and updated.

[0049] In summary, the present invention mainly has the following beneficial effects:

[0050] 1. A Bayesian attack graph is used to quantify the static risk value and post-attack dynamic risk value of potential attack paths. At the business layer, the SIR model is used to dynamically analyze the risk propagation between nodes in combination with the DDS publish / subscribe communication mode. Experiments verify the high adaptability of the SIR model in the publish / subscribe scenario, providing theoretical support for the diffusion law of attacks at the business layer.

[0051] 2. The present invention also introduces a real-time monitoring module, which continuously feeds back the dynamic status of network devices (such as node connectivity, vulnerability changes, and performance indicators) to the Bayesian attack graph, and dynamically updates the graph structure and conditional probability, thereby achieving the timeliness and accuracy of the evaluation model. At the same time, by calculating and sorting the risks of each node in real time, it provides a decision-making basis for priority warning and resource allocation of high-risk nodes. It also has good universality and is suitable for DDS and other distributed systems such as the Internet of Things and industrial control based on the publish / subscribe mechanism. Its practicality and reliability have been verified through empirical experiments involving five physical devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a flow chart of the network security dynamic risk assessment method of the present invention;

[0053] Figure 2 This is a throughput change diagram of three nodes under normal conditions of the present invention;

[0054] Figure 3 This is a graph showing the throughput changes of three nodes under the attack of the present invention;

[0055] Figure 4 is a graph showing the throughput of node 2 changing over time;

[0056] Figure 5 This is a diagram showing the node connections and reachability relationships at the device layer of the present invention;

[0057] Figure 6 This is a comprehensive risk assessment result diagram of node 1 being attacked in the present invention;

[0058] Figure 7 This is a comprehensive risk assessment result diagram of node 2 being attacked in the present invention;

[0059] Figure 8 This is a comprehensive risk assessment result diagram of the attack on node 3 of the present invention;

[0060] Figure 9 is the comprehensive risk assessment result of the attack on node 4 of the present invention;

[0061] Figure 10 This is a comprehensive risk assessment result diagram of the attack on node 5 of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the described embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The following examples are intended to illustrate the present invention but are not intended to limit the scope of protection of the present invention. The conditions in the examples may be further adjusted according to specific conditions. Simple improvements to the method of the present invention within the scope of the present invention are also within the scope of protection claimed in the present invention.

[0064] Example 1

[0065] refer to Figure 1 , demonstrating the complete technical implementation steps of dynamic risk assessment of distributed real-time systems based on the publish / subscribe model. The overall design is divided into two main parts: the device layer and the business layer. The whole process of dynamic risk assessment is completed through four core steps, including: building a network model, constructing a Bayesian attack graph at the device layer for risk assessment, building a SIR model at the business layer for dynamic risk propagation analysis, and conducting dynamic risk assessment in a comprehensive multi-dimensional manner. Among them, the device layer mainly conducts static and dynamic risk analysis on the connection relationship, reachability and vulnerability characteristics between physical devices, while the business layer focuses on the dynamic characteristics of attack propagation under the publish / subscribe relationship. Through multi-level and multi-dimensional comprehensive analysis, it finally generates real-time dynamic risk assessment results, which provide a basis for system security protection and decision-making.

[0066] A dynamic risk assessment method for network security based on a DDS system, comprising:

[0067] S1. Build a DDS system network model to describe the physical connections and publish / subscribe topology of sensor nodes, controller nodes, and server nodes in the DDS system.

[0068] First, configure a physical device network consisting of sensor nodes, controller nodes, and server nodes. Establish physical connections between nodes through wired or wireless communication interfaces. Then, install DDS middleware, such as OpenDDS, on each physical device. Configure the software environment, including global data space parameters, domain participant parameters, and data transmission quality of service policies. Define data topics during the communication relationship establishment phase: for example, sensor nodes act as publishers to publish environmental monitoring data topics, controller nodes subscribe to environmental monitoring data topics and publish control instruction topics, and server nodes subscribe to control instruction topics.

[0069] During the topology model construction process, the device layer model establishes an N×N adjacency matrix to represent the physical connection relationships between nodes. A matrix element value of 1 indicates a physical connection, and a value of 0 indicates no connection. The model also records the interface configuration parameters and link performance parameters of each node. The service layer model establishes a publish / subscribe relationship matrix to represent the relationship between topics and nodes, and annotates the transmission direction and frequency characteristics of each data topic.

[0070] During the model verification phase, device-layer connectivity tests and business-layer communication tests are performed. The physical connection is verified through the ICMP protocol, and the publish / subscribe function is verified by sending test messages. Finally, a data collection agent is deployed on each node, and the collection period (T) is configured to collect various performance indicators, including CPU utilization, memory occupancy, and network throughput at the device layer, and message delay, packet loss rate, and number of topic subscriptions at the business layer. This modeling method achieves the organic unity of physical connection and logical communication through a layered design, providing a reliable basic model for subsequent network security risk assessment.

[0071] S2. Construct a device-level Bayesian attack graph for static and dynamic risk quantification, which is used to assess the risk of physical device nodes based on vulnerability scan results and inter-node connection probabilities.

[0072] In device-level risk analysis, CVSS (Common Vulnerability Scoring System) is used to quantify the attack benefit and difficulty of each node vulnerability. A Bayesian attack graph is constructed based on node connectivity and reachability. By analyzing potential attack paths in the attack graph, the probability of an attack spreading from one node to other nodes, i.e., the risk value, is calculated. Static risk assessment is performed under safe conditions, and dynamic risk assessment is performed after a node is attacked. The specific steps and calculations are as follows:

[0073] 1. Vulnerability Information Collection and Quantification

[0074] Use vulnerability scanning tools (such as Nessus and OpenVAS) to scan the device and obtain the device vulnerability information. Combined with the physical connection and reachability of the network, an attack graph is constructed to reflect the possible attack paths. The vulnerability information of the device node is quantified based on CVSS (Common Vulnerability Scoring System), which provides the calculation formula for calculating the vulnerability attack difficulty Exploitability and attack benefit Impact, as shown in formulas (1) and (2):

[0075] Exploitability=8.22*AV*AC*PR*UI (1)

[0077] Impact=6.42*[1-(1-C)*(1-I)*(1-A)] (2)

[0079] Among them, Attack Vector (AV): attack vector; Attack Complexity (AC): attack complexity; Privileges Required (PR): required permissions; User Interaction (UI): user interaction; Confidentiality (C): confidentiality; Integerity (I): integrity; Availability (A): availability. These indicators of each vulnerability can be queried through the CVSS scoring system.

[0080] The attack difficulty Exploitability measures the difficulty for an attacker to exploit the vulnerability. The larger its value, the easier it is for an attacker to exploit the vulnerability, and the greater the probability of being attacked and the greater the risk. The attack benefit Impact measures the benefit that an attacker ultimately obtains by exploiting the vulnerability. The larger its value, the greater the benefit that an attacker ultimately obtains by exploiting the vulnerability, and the greater the probability of being attacked and the greater the risk. Therefore, considering these two key indicators, the attack probability P is calculated to provide input for the probability of the Bayesian attack graph, as shown in formula (3):

[0081] P=[(Exploitability+Impact) / 10]*100% (3)

[0083] 2. Bayesian attack graph construction

[0084] With the vulnerability attack probability P, we can build a local conditional probability table (CPT) for each node in the network, thereby building a complete Bayesian attack graph. The CPT can be given according to P. Given the initial attack node node0, node node j Static value at risk The calculation is as shown in formula (4), which means that the attack spreads from node0 to node j Probability of:

[0085]

[0086] Among them, P(node j =1|node0=1) is calculated through forward reasoning and combined with Bayesian formula (5):

[0087]

[0088] Here, Pa(node j ) is a node j The set of all parent nodes, P(node i ) is node i The probability of a state value, such as node i =1, this probability is the probability P calculated by formula (3), otherwise, it is 1-P;

[0089] Here, we can combine GeNle software to build and analyze the Bayesian attack graph. According to the network connection, we can draw the nodes, connection relationships and the attack probability P of each node (calculated by formula (5)) on the software. Then, through Bayesian network reasoning, we can automatically calculate the global risk value of the node, that is, the static risk value of the device layer node. At the same time, after a node is attacked, the risk value of the node in the Bayesian network can be updated to 1. The software can automatically combine the Bayesian dynamic reasoning formula to infer the dynamic risk values of other nodes.

[0090] S3. Build a business-layer SIR model to conduct dynamic risk propagation analysis, simulating the attack spread process in the publish / subscribe logic layer.

[0091] In business-layer analysis, this application uses the SIR model based on the publish / subscribe relationship to dynamically simulate the attack propagation process. This model divides business-layer nodes into three states: unattacked nodes, attacked nodes, and isolated nodes, which correspond to susceptible nodes (Susceptible), infected nodes (Infected), and recovered nodes (Recovered) in the SIR model. Based on the publish / subscribe relationship between nodes and key parameters such as propagation rate and recovery rate, the attack propagation process in the business layer is dynamically analyzed, and the risk distribution at different time points is predicted. This method can effectively characterize the spread of attacks in the business layer and provide theoretical support for dynamic risk assessment.

[0092] 1. Initialize node status and risk value

[0093] Set the initial state for each node. In the safe case, the state of all nodes is unattacked (S). The risk value is When a node is detected to be under attack, its state will change from S to the attacked state (I), and its risk value is 1, the dynamic risk propagation process begins;

[0094] 2. Dynamic risk propagation calculation

[0095] Establish a time series array to record the risk value changes at each time step. At each time step, calculate the probability of the unattacked state (S) node being attacked. As shown in formula (6):

[0096]

[0097] Among them, β is the propagation rate, which can be selected according to the specific situation of network propagation message, N I is the number of nodes in the attacked state, and N is the total number of subscribed neighbors of the node;

[0098] The risk value of the node in the unattacked state (S) is updated to:

[0099]

[0100] in and They represent the dynamic propagation risk values at time t and t+1 respectively;

[0101] Regardless of the node recovery situation, the risk value of the node in the attacked state (I) remains unchanged, and the risk value of the business layer node is Changes over time.

[0102] S4. Dynamically assess multi-dimensional risks to integrate device-layer and business-layer risks and output the system's comprehensive risk distribution.

[0103] The Bayesian attack graph risk assessment results of the device layer are combined with the SIR dynamic propagation analysis results of the business layer to build a comprehensive multi-dimensional risk assessment model. The device layer weight w is set according to the actual situation. d and business layer w s Weight, satisfying w d +w s =1, therefore, after a node is attacked, at any time t, node node j The comprehensive risk value

[0104]

[0105] in, Node calculated for the device layer j The dynamic risk value of Node calculated by the business layer j At the dynamic propagation risk value at time t, the technical solution of this application realizes the organic integration of device layer topology risk and business layer propagation risk through multi-dimensional data fusion technology, thereby completing a complete technical closed loop from basic network topology modeling to comprehensive risk assessment.

[0106] Example 2

[0107] The experimental plan supporting the feasibility of the technical solution of this application is as follows:

[0108] 1. Business layer SIR verification: This section mainly verifies the SIR model of the business layer. The experiment focuses on analyzing the change pattern of business layer node traffic under normal and attack conditions, and verifies the high adaptability of the publish / subscribe model to the SIR propagation model under attack scenarios. The experimental results show that the risk propagation characteristics under the publish / subscribe model are highly consistent with the propagation mechanism of the SIR model: under normal circumstances, business layer node traffic (such as throughput) is stable and almost unchanged; in attack situations, the change pattern of node traffic (such as throughput changes) is highly consistent with the propagation characteristics of the SIR model, further demonstrating the applicability and effectiveness of the SIR model in dynamic risk assessment of the business layer.

[0109] (1) Changes in business layer traffic under normal circumstances

[0110] Under normal circumstances, the communication model of the DDS business layer usually involves multiple publishers and multiple subscribers. The message interaction between nodes may form a complex network topology. However, to more intuitively observe the changes in the data flow of the business layer, this experiment simplifies the test scenario and selects only three nodes for experimental verification. Specifically, in the DDS system we built (consisting of 5 hosts), 3 hosts were selected as experimental nodes. These 3 nodes perform publish / subscribe communication within the same domain. The following is the business relationship and traffic configuration of the 3 nodes:

[0111] Table 1 Node business relationship

[0112]

[0113] Table 2 Specific traffic configuration for intra-domain communication

[0114]

[0115]

[0116] Under normal circumstances, the traffic indicators collected by the system include throughput, delay, peak traffic, etc. Since the change trend of throughput is obvious and quantifiable, this experiment mainly analyzes the throughput of the node, such as Figure 2 The figure shows the throughput changes of the three nodes in the time range of 0 to 5T. T is the time interval for system data collection. In this system, T = 15s. By analyzing the dynamic changes in throughput, the communication status and data flow characteristics of the nodes in the publish / subscribe mode can be intuitively reflected, providing a comparative benchmark for risk propagation analysis in subsequent attack scenarios.

[0117] from Figure 2 As can be seen from the figure, for a single node, its throughput remains stable over time, indicating that under normal circumstances, the communication behavior of the nodes is consistent. In addition, the histogram shows that the throughput of the publishing node Node1 is approximately twice that of the subscribing nodes Node2 or Node3. This phenomenon further verifies the data propagation relationship under the publish / subscribe model: the publishing node distributes data to multiple subscribing nodes simultaneously, so its throughput is significantly higher than that of a single subscribing node. This throughput distribution characteristic is completely consistent with the theoretical expectations of the publish / subscribe model, providing a reliable benchmark reference for subsequent analysis of abnormal traffic changes in attack scenarios.

[0118] (2) Traffic changes under business layer attacks

[0119] In an attack scenario, assuming a publisher is under a malicious attack, the attacker may implant malicious code, launch a large-volume attack (such as a DoS flood attack), or exploit misconfiguration, causing a sharp increase in the publisher's data publishing volume. At the same time, the publisher may publish information containing malicious code or viruses. Unlike traditional attack models, this attack does not cause a decrease in traffic. Instead, it causes subscribers to receive a large amount of data flow in a short period of time, showing a phenomenon of rapid growth in traffic over time. In addition, as subscribers continue to receive information from publishers, subscribing nodes will gradually be infected by viruses, becoming targets of external attackers, triggering further traffic attacks against subscribing nodes, and ultimately leading to the subscribing nodes being compromised.

[0120] By combining experimental data with the SIR propagation model, we can further analyze the impact of this attack mode. When a publishing node is attacked by traffic and begins to publish virus-carrying messages, the virus will spread in the network through subscription relationships. After receiving the infected data, the subscribing node will change from "susceptible" to "infected" and may further spread the virus to other nodes. The traffic changes of the subscribing nodes are consistent with the SIR propagation model. After multiple experiments, we have verified that in our system, when the virus propagation rate is set to 0.7, the time-varying pattern of the subscribing node traffic is most consistent with the predicted curve of the SIR propagation model.

[0121] In the experimental setting, we still use three nodes, and their business relationship is consistent with the normal communication situation. Under the normal communication environment, we implement a large-scale traffic attack on the publishing node Node1 and publish the worm virus through the publish-subscribe system to observe the changes in the traffic of the subscribing nodes Node2 and Node3 over time. Figure 3 As shown in Figure 2, the throughput of the three nodes changes over time. At t = 0, the three nodes are in normal communication state, and at t = 1T, Node1 is attacked.

[0122] Without considering the differences in subscription nodes, when the publishing node Node1 is attacked, the traffic change trends of the two subscription nodes Node2 and Node3 that subscribe to it are basically the same. As can be seen from the figure, the throughput changes of Node2 and Node3 are almost the same. In addition, the analysis results show that after Node1 is attacked, the throughput of subscription nodes Node2 and Node3 gradually increases over time. At t=2T, the sum of the throughput of the two subscription nodes is close to the throughput of the publishing node. However, since the subscription node receives the virus message, the increase in its throughput is not limited to this. At t=3T and thereafter, the throughput is still increasing. The spread of the virus causes the subscription node to be gradually attacked by external traffic, and its throughput also increases further. At a certain moment, it tends to be stable (in this experimental system, it tends to be stable at t=6T and thereafter), and is completely compromised.

[0123] Experimental results show that after Node1 is attacked, its data publishing volume increases significantly, causing Node2 and Node3 to receive a large amount of data flow in a short period of time. The traffic volume shows a rapid growth trend. Over time, Node2 and Node3 are gradually infected by the virus, and the traffic volume is further amplified, eventually causing the performance of the subscribing nodes to degrade or even be compromised.

[0124] In order to conduct a more in-depth analysis of the traffic changes of the subscription node, we select a subscription node Node2 and analyze its throughput in the [1T, 6T] time period. At 1T, Node1 is attacked, and at 6T, Node2 is completely breached, and the throughput tends to be stable. Figure 4 As shown in Figure 3, the normalized throughput curve is very consistent with the SIR propagation model when the propagation rate β = 0.7, which verifies the adaptation of the publish-subscribe system to the SIR model and further proves the applicability and effectiveness of the SIR model in dynamic risk assessment at the business layer.

[0125] 2. Generate comprehensive dynamic risk assessment results and support decision-making

[0126] Through the above analysis and experimental verification, combined with the specific network topology (including the reachability relationship of the device layer and the publish / subscribe logical relationship of the business layer), this application constructed a comprehensive multi-dimensional risk assessment model and conducted a specific assessment based on the distributed real-time system (DDS). During the assessment process, the DDS system consisting of 5 physical devices and the corresponding 5 business nodes based on the publish / subscribe relationship were used to integrate the Bayesian attack graph of the device layer and the SIR model results of the business layer to achieve cross-level dynamic risk assessment. The specific system has the following relationship between the device layer and the business layer nodes: Figure 5 As shown in Table 3, Figure 5 Table 3 shows the connection and reachability relationship of the device layer nodes. Table 3 shows the publish / subscribe relationship of the business layer nodes.

[0127] Assume that the device layer w d and the weight w of the business layer s The weighted average risk is 0.5. When a node is attacked, the dynamic risk value of the device layer and the propagation risk value of the business layer of other nodes are calculated. The weighted comprehensive risk value ranges from [0, 1]. The closer it is to 1, the greater the risk.

[0128] Table 3 Business layer node publish / subscribe relationship

[0129]

[0130] Figure 6 This example shows how the combined risk values of the other four network nodes (Node2, Node3, Node4, and Node5) change over time after Node 1 is attacked. Initially (time 0), the risk value of each node is calculated solely from the device-layer Bayesian dynamic attack graph. At this point, Node 1, as the attacked node, reaches its maximum risk value of 1, while the initial risk values of the other nodes are lower. The risk value at this point is primarily the dynamic risk value assessed at the device layer; risk propagation to the service-layer nodes has not yet begun, reflecting the importance of different nodes in device-layer risk assessment.

[0131] Over time, risk propagation at the business layer gradually becomes apparent. The publish / subscribe relationship between nodes further promotes the spread of risk. The figure shows that the risk values from Node2 to Node5 gradually increase over time. This growth trend indicates that risk propagates through the network, and the risk growth rates of different nodes vary significantly. For example, the risk value of Node3 increases rapidly, indicating its key position in the business layer; while the risk value of Node5 increases more slowly, indicating its secondary position in the risk propagation path. This dynamic change can help identify high-risk nodes in the network and provide a basis for prioritizing protection when resources are limited.

[0132] Furthermore, the combined device-layer and business-layer analysis is more comprehensive than traditional single-device-layer analysis methods. Traditional single-device-layer analysis methods only consider device vulnerability relationships to assess risk values, and can only assess risk values at a specific moment, failing to predict future risk values. This is a limitation of traditional methods. This solution, by combining the Bayesian attack graph with the SIR propagation model, not only considers device-layer risk values but also captures the dynamic process of risk propagation. The results in the figure further verify this. Compared with analysis that relies solely on static risk values, this combined approach can more accurately quantify and predict the risks of each node at future moments.

[0133] Overall, the analysis results in the figure show the significant advantages of dynamic risk assessment in terms of timeliness and accuracy. It can not only monitor the risk changes of each node in real time, but also predict the risk changes in the future. In practical applications, this method can help managers quickly identify key nodes and take targeted protection measures, effectively reducing the overall risk level of the network. The dynamic risk assessment results of the other four nodes after being attacked are as follows: Figure 7 、 8 , 9, 10.

[0134] The technical advantage of the present invention lies in the organic integration of the Bayesian attack graph of the device layer and the SIR model of the business layer, so as to realize the unified quantification and dynamic prediction of the risks of the physical device and business logic layer. The existing technologies are mostly limited to single-level analysis. Through the SIR propagation model and time series analysis, the propagation trend of attacks in the network and the future node risk distribution can be predicted. The traditional methods can usually only perform "after-the-fact" or static evaluation. According to the communication characteristics of DDS and other theme-driven systems, a model and verification experiment are specially designed, breaking through the applicability bottleneck of the existing methods in highly dynamic and heterogeneous topology environments, introducing device dynamic status monitoring and model parameter adaptation mechanism, significantly improving the response speed and accuracy of risk assessment, meeting the online security protection needs in complex network environments, and significantly improving the accuracy and timeliness of risk prediction.

[0135] Although the embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that, unless otherwise defined, the technical or scientific terms used in the present invention shall have the usual meanings understood by persons having ordinary skills in the field to which the present invention belongs, and the words "include" or "comprise" and the like used in the present invention mean that the elements or objects preceding the word include the elements or objects listed after the word and their equivalents. Although the embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention shall be defined by the appended claims and their equivalents.

Claims

1. A dynamic risk assessment method for network security based on DDS system, characterized in that: include: S1. Build a DDS system network model to describe the physical connections and publish / subscribe topology of sensor nodes, controller nodes, and server nodes in the DDS system. S2. Construct a device-level Bayesian attack graph for static and dynamic risk quantification, which is used to assess the risk of physical device nodes based on vulnerability scan results and inter-node connection probabilities. S3. Build a business-layer SIR model to conduct dynamic risk propagation analysis, simulating the attack spread process in the publish / subscribe logic layer. S4. Perform dynamic assessment of multi-dimensional risks to integrate device-layer and business-layer risks and output the comprehensive risk distribution of the system.

2. A method for dynamic risk assessment of network security based on a DDS system according to claim 1, characterized in that: The step S1 includes: Configure sensor nodes, controller nodes, and server nodes in the DDS system and establish physical connections through wired or wireless interfaces; Install DDS middleware on each node and configure global data space parameters, domain participant parameters, and service quality policies; Define data topics. Sensor nodes publish monitoring data topics. Controller nodes subscribe to monitoring data topics and publish control instruction topics. Server nodes subscribe to control instruction topics. During the topology model construction process, the device layer model creates an N×N adjacency matrix to represent the physical connection relationships between nodes. A matrix element value of 1 indicates a physical connection, and a value of 0 indicates no connection. The model also records the interface configuration parameters and link performance parameters of each node. Establish the physical connection topology between nodes and annotate the link bandwidth, latency, and message frequency; The connectivity of the adjacency matrix and the correctness of the publish / subscribe matrix are verified respectively through ICMP protocol and DDS test messages; Deploy data collection agents on each node to periodically collect CPU utilization and memory usage Performance indicators such as rate, network throughput, message delay, packet loss rate and number of topic subscriptions.

3. A method for dynamic risk assessment of network security based on a DDS system according to claim 1, characterized in that: The step S2 includes: Use Nessus or OpenVAS to scan each physical node to obtain vulnerability information; Based on the CVSS system, the attack difficulty (Exploitability) and attack benefit (Impact) of each vulnerability are calculated, and the node single attack probability (P) is calculated by the following formula: Exploitability=8.22*AV*AC*PR*UI Impact=6.42*[1-(1-C)*(1-I)*(1-A)] P=[(Exploitability+Impact) / 10]*100% Among them, Attack Vector (AV) is the attack vector, Attack Complexity (AC) is the attack complexity, Privileges Required (PR) is the required permissions, User Interaction (UI) is the user interaction, Confidentiality (C) is the confidentiality, Integerity (I) is the integrity, and Availability (A) is the availability; Based on the adjacency matrix and P, a directed Bayesian attack graph is constructed, and a conditional probability table CPT is assigned to each edge. The CPT can be given according to P. Given the initial attack node node0, node node j Static value at risk Calculation is as follows: represents the probability of an attack spreading from node0 to nodej, where P(node j =1|node0=1) is calculated through forward reasoning and combined with the Bayesian formula: Pa(node j ) is a node j The set of all parent nodes, P(node i ) is node i The probability of a state value, such as node i =1, the calculated probability is P, otherwise, it is 1-P; The Bayesian network tool is used to reason about the attack graph and obtain the static risk value and dynamic risk value of each node.

4. A method for dynamic risk assessment of network security based on a DDS system according to claim 1, characterized in that: The step S3 includes: Set the initial state for each node. In the safe case, the state of all nodes is unattacked (S). The risk value is When a node is detected to be under attack, its state will change from S to the attacked state (I), and its risk value is 1; Establish a time series array to record the risk value changes at each time step. At each time step, calculate the probability of the unattacked state (S) node being attacked. The following formula: Among them, β is the propagation rate, which can be selected according to the specific situation of network propagation message, N I is the number of nodes in the attacked state, N is the total number of subscribed neighbors of the node, and the risk value of the node in the unattacked state (S) is updated as: in and They represent the dynamic propagation risk values at time t and t+1 respectively; Regardless of the node recovery situation, the risk value of the node in the attacked state (I) remains unchanged, and the risk value of the business layer node is Changes over time.

5. A method for dynamic risk assessment of network security based on a DDS system according to claim 1, characterized in that: The step S4 includes: Combining the Bayesian attack graph risk assessment results at the device layer with the SIR dynamic propagation analysis results at the service layer to build a comprehensive multi-dimensional risk assessment model; Set the device layer weight w according to the actual situation d and business layer w s Weight, satisfying w d +w s =1, therefore, after a node is attacked, at any time t, node node j The comprehensive risk value in, Node calculated for the device layer j The dynamic risk value of Node calculated by the business layer j Dynamic propagation risk value at time t.

6. A method for dynamic risk assessment of network security based on a DDS system according to claim 2, characterized in that: The performance indicator collection period T is configurable, and the collected indicators are used to dynamically adjust the node attack probability P and the propagation rate β.

7. A method for dynamic risk assessment of network security based on a DDS system according to claim 2, characterized in that: The data acquisition agent also includes a real-time monitoring module for monitoring the dynamic status of network devices and feeding back the monitored dynamic information to the device layer Bayesian attack graph to dynamically adjust the attack graph structure and the probability values in the conditional probability table, thereby improving the timeliness and accuracy of risk assessment.

8. A method for dynamic risk assessment of network security based on a DDS system according to claim 3, characterized in that: The conditional probability table (CPT) is generated by mapping the P values between nodes. The static risk is calculated by accumulating the product of all path probabilities from the initial attack node to the target node. The dynamic risk is set to 1 after the target node is attacked and is re-inferred and updated.

Images