Information security and function security integrated risk assessment system and method

Abstract

The invention relates to the technical field of risk assessment, and discloses an information security and function security integrated risk assessment system and method, which can integrate the cross influence between information security and function security and perform comprehensive risk assessment on the system. The system comprises a data acquisition module configured to obtain target data in a plurality of station subsystems, and a risk identification module configured to extract information security risk data by adopting an attack tree threat model, detect system vulnerabilities of the station subsystems according to the target data, obtain functional security risk data, and send the functional security risk data to the station subsystems. The risk assessment module is configured to optimize risk scores, obtain correlation between information security risk data and functional security risk data by adopting an Apriori algorithm, and predict risk changes by adopting an ARIMA model, the risk management module is configured to determine risk measures, and the risk reporting module is configured to generate a risk assessment report. The method has the characteristic of comprehensive and integrated risk assessment.

Description

Technical Field

[0001] The present invention relates to the technical field of risk assessment, and in particular to a risk assessment system and method integrating information security and functional safety. Background Art

[0002] As the automation level of cross-domain remote control station systems in oil and gas pipeline networks continues to increase, risk assessment of station-level information security and functional safety has become critical to ensuring system stability and security. However, current risk assessment technologies still have flaws and are unable to effectively meet the needs of the complex operating environments of oil and gas pipeline stations.

[0003] Current risk assessments for information security and functional safety treat them as two separate areas, evaluating and managing them separately. This independent assessment approach ignores the mutual impact between the two, making it difficult to fully capture dynamic changes and potential cross-influences. The lack of a unified assessment framework leads to blind spots in risk assessment and prevents comprehensive and integrated risk assessments. This hinders the accuracy of risk assessments, risk management, and the generation of integrated risk assessment reports, making it impossible to meet the requirements for integrated risk assessments for information security and functional safety at the site level of oil and gas pipeline networks.

[0004] Therefore, how to provide a risk assessment system and method that integrates information security and functional safety is a technical problem that technicians in this field urgently need to solve. Summary of the Invention

[0005] In view of this, the present invention proposes a risk assessment system and method that integrates information security and functional safety, aiming to solve the problems of being unable to integrate information security and functional safety, difficulty in fully capturing dynamic changes and potential cross-impacts, lacking a unified assessment framework, and being unable to achieve a comprehensive and integrated risk assessment.

[0006] In a first aspect, the present invention proposes an integrated information security and functional safety risk assessment system, comprising: a data acquisition module, a risk identification module, a risk assessment module, a risk management module, and a risk reporting module. The data acquisition module is configured to use a first tool, a second tool, and a third tool to obtain first data, second data, and third data, respectively, from multiple site subsystems, and preprocess the first data, second data, and third data to obtain target data. The risk identification module is configured to use an attack tree threat model to extract information security risk data from the target data; use a fourth tool to detect system vulnerabilities in the site subsystem based on the target data to obtain functional safety risk data; extract the site subsystem's system environment based on the functional safety risk data to obtain potential risk data; and determine the source of risk based on the information security risk data and the functional safety risk data. The risk assessment module is configured to evaluate the information security risk data, functional safety risk data, and potential risk data to obtain a risk score; generate risk assessment samples for the corresponding site subsystem based on the target data, count the number of risk assessment samples, set a scoring optimization factor for the risk score, and optimize the risk score based on the scoring optimization factor to obtain a comprehensive risk score. The risk assessment module is configured to use the Apriori algorithm, an association rule mining algorithm, to determine the correlation between information security risk data and functional safety risk data. Based on this correlation, the ARIMA model is used to predict risk trends. Risk priorities are determined based on the risk trends and the comprehensive risk score. The risk management module is configured to determine appropriate risk measures based on risk priorities. The risk reporting module is configured to generate a risk assessment report based on the risk source, comprehensive risk score, risk priority, and risk measures.

[0007] In one possible implementation, the first, second, and third tools are a network sniffing tool, an ELK Stack platform for log analysis, and a Supervisory Control and Data Acquisition (SCADA) system. The data acquisition module is specifically configured to: use the network sniffing tool to extract data packets from the station subsystem and parse them to obtain network traffic data; use the ELK Stack platform to obtain log data from the station subsystem; and use the SCADA system to obtain device status data and sensor data from the station subsystem. The network traffic data, log data, device status data, and sensor data are preprocessed to obtain target data. This preprocessing includes data cleaning, data standardization, and data deduplication.

[0008] In one possible implementation, the risk identification module is specifically configured to: use an attack tree threat model to obtain targets to be attacked in target data, where the targets include sensitive data, device operating status, and network communications; decompose the targets to the lower layer to obtain multiple sub-targets, where the sub-targets are directions to be attacked; connect multiple directions to be attacked through AND gates and OR gates of the attack tree threat model to obtain a path diagram to be attacked; and obtain information security risk data based on the path diagram to be attacked.

[0009] In one possible implementation, the risk identification module is further configured to use Nessus, a system vulnerability scanning and analysis tool, to configure network permissions for the site subsystem and perform a vulnerability scan on the site subsystem to obtain functional safety risk data. Network permissions include the site subsystem's IP address, host name, and network segment. The functional safety risk data is then matched against a vulnerability database to obtain vulnerable ports that could be exploited by attackers. The interaction relationships between each site subsystem in the network are then determined, and potential risk data is generated based on these interactions.

[0010] In one possible implementation, the risk assessment sample includes: a first sample, a second sample, and an irrelevant sample. The risk assessment module is specifically configured to: count the number of information security risk data, functional safety risk data, and potential risk data, and record them as information quantity, functional quantity, and potential quantity respectively; wherein the risk score satisfies the following formula Where M represents the risk score, u1, u2, and u3 are weight coefficients, J represents the amount of information, K represents the number of functions, and L represents the potential number. Standard target data corresponding to each station subsystem is determined and compared with the target data. If the target data is equal to or greater than the standard target data, a first sample is generated for the corresponding station subsystem. If the target data is less than the standard target data, a second sample is generated for the corresponding station subsystem. If any of the target data is equal to or greater than the standard target data, and any of the target data is less than the standard target data, an irrelevant sample is generated for the corresponding station subsystem.

[0011] In one possible implementation, the scoring optimization factor is any one of the following: a first scoring optimization factor, a second scoring optimization factor, a third scoring optimization factor, and a fourth scoring optimization factor. The risk assessment module is specifically configured to: count the number of first samples and record it as the first number, count the number of second samples and record it as the second number, determine the ratio of the first number to the second number and record it as P. When P is less than or equal to a first preset number threshold, the first scoring optimization factor is used as the scoring optimization factor for the risk score. When P is greater than the first preset number threshold and less than a second preset number threshold, the second scoring optimization factor is used as the scoring optimization factor for the risk score. When P is greater than or equal to the second preset number threshold, the third scoring optimization factor is used as the scoring optimization factor for the risk score. The number of data points greater than or equal to the standard target data in all irrelevant samples is counted and recorded as the valid number; the number of data points less than the standard target data in all irrelevant samples is counted and recorded as the invalid number. When the valid number is greater than the invalid number, the fourth scoring optimization factor is used as the scoring optimization factor for the risk score. The product of the scoring optimization factor and the risk score is used as the comprehensive risk score.

[0012] In one possible implementation, the risk priority is any of the following: a first risk priority, a second risk priority, and a third risk priority. The risk assessment module is specifically configured to: use the Apriori algorithm to collect information security risk data and functional safety risk data, establish a database of historical information security risk data and historical functional safety risk data, and obtain frequent combinations of the historical information security risk data and historical functional safety risk data; and determine the correlation between the information security risk data and the functional safety risk data based on the frequent combinations. Use the ARIMA model to construct a time series based on the correlations to obtain risk change trends, which include growth trends, decline trends, and stable trends. When the comprehensive risk score is greater than or equal to a preset risk score threshold and shows an growth trend or a stable trend, the risk priority is determined to be the first risk priority. When the comprehensive risk score is greater than or equal to the preset risk score threshold and shows a decline trend, or when the comprehensive risk score is less than the preset risk score threshold and shows an growth trend, the risk priority is determined to be the second risk priority. When the comprehensive risk score is less than the preset risk score threshold and shows a decline trend or a stable trend, the risk priority is determined to be the third risk priority.

[0013] In one possible implementation, the risk measures include a first risk measure, a second risk measure, and a third risk measure; the first risk measure corresponds to a first risk priority, the second risk measure corresponds to a second risk priority, and the third risk measure corresponds to a third risk priority. The urgency of the first, second, and third risk measures is ranked in descending order.

[0014] In one possible implementation, the risk assessment report is set in the form of a chart, which includes a pie chart, a line chart, a scatter chart and a bar chart. The risk source is set as a pie chart, the comprehensive risk score is set as a line chart, the risk priority is set as a scatter chart, and the risk measure is set as a bar chart.

[0015] In a second aspect, the present invention proposes a risk assessment method for integrated information security and functional safety, comprising: using a first tool, a second tool, and a third tool to obtain first data, second data, and third data, respectively, from multiple site subsystems; preprocessing the first data, second data, and third data to obtain target data; extracting information security risk data from the target data using an attack tree threat model; detecting system vulnerabilities of the site subsystems using a fourth tool based on the target data to obtain functional safety risk data; extracting the system environment of the site subsystems based on the functional safety risk data to obtain potential risk data; and determining the source of risk based on the information security risk data and the functional safety risk data. An assessment is performed based on the information security risk data, the functional safety risk data, and the potential risk data to obtain a risk score; generating risk assessment samples for the corresponding site subsystems based on the target data, counting the number of risk assessment samples and setting a risk score optimization factor; and optimizing the risk score based on the score optimization factor to obtain a comprehensive risk score. An association rule mining Apriori algorithm is used to determine the correlation between the information security risk data and the functional safety risk data. Based on the correlation, an autoregressive integrated moving average (ARIMA) model is used to predict risk trends. Risk priorities are determined based on the risk trends and the comprehensive risk score. Determine appropriate risk measures based on risk priority. Generate a risk assessment report based on risk sources, comprehensive risk scores, risk priorities, and risk measures.

[0016] In a third aspect, a risk assessment device for integrated information security and functional safety is provided, comprising a memory and a processor; the memory is used to store computer execution instructions, and the processor and the memory are connected via a bus; when the risk assessment device for integrated information security and functional safety is running, the processor executes the computer execution instructions stored in the memory, so that the risk assessment device for integrated information security and functional safety performs the risk assessment method for integrated information security and functional safety of the first aspect.

[0017] The integrated information security and functional safety risk assessment device can be a network device, or a portion of a network device, such as a chip system within the network device. The chip system is configured to support the network device in implementing the functions described in the first aspect and any possible implementation thereof, such as acquiring, determining, and transmitting data and / or information involved in the integrated information security and functional safety risk assessment method. The chip system includes a chip and may also include other discrete devices or circuit structures.

[0018] In a fourth aspect, a computer-readable storage medium is provided, which includes computer execution instructions. When the computer execution instructions are run on a computer, the computer executes the risk assessment method for integrating information security and functional safety according to the first aspect.

[0019] In a fifth aspect, a computer program product is also provided, which includes computer instructions. When the computer instructions are run on a risk assessment device for integrated information security and functional safety, the risk assessment device for integrated information security and functional safety executes the risk assessment method for integrated information security and functional safety as described in the first aspect above.

[0020] It should be noted that the aforementioned computer instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the integrated information security and functional safety risk assessment device, or may be packaged separately from the processor of the integrated information security and functional safety risk assessment device, and this is not limited in the present embodiment.

[0021] The description of the second, third, fourth and fifth aspects of this application can refer to the detailed description of the first aspect.

[0022] In the embodiments of this application, the name of the aforementioned integrated information security and functional safety risk assessment device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear by other names. For example, the receiving unit may also be called a receiving module, a receiver, etc. As long as the functions of each device or functional module are similar to those of this application, they are within the scope of the claims of this application and their equivalents.

[0023] Compared with the prior art, the beneficial effects of the present invention are: comprehensive collection and pre-processing of different data of the site subsystems through a variety of tools, thereby providing accurate and comprehensive target data, laying a data foundation for subsequent risk identification, assessment and management. The attack tree threat model is used to extract information security risk data, and functional safety risk data is obtained by detecting system vulnerabilities in the site subsystems. Combined with the potential risk data, the risk sources of each subsystem can be accurately determined. It ensures that the system can fully cover all types of risk data, improves the comprehensiveness of risk assessment, and combines the Apriori algorithm and ARIMA model to analyze the correlation between information security risk data and functional safety risk data, and predicts the trend of risk changes. Thereby, the foresight and responsiveness of risk assessment management are enhanced, corresponding risk measures are taken according to risk priority, and targeted measures are ensured for different risk priorities, effectively avoiding waste of resources and improving the processing efficiency of risk assessment, thereby generating a structured and intuitive risk assessment report, and improving the comprehensiveness, accuracy and decision-making support capabilities of risk assessment.

[0024] On the other hand, the present application also provides a risk assessment method for integrating information security and functional safety, which is used to apply the above-mentioned risk assessment system for integrating information security and functional safety, including:

[0025] Using a first tool, a second tool, and a third tool in a plurality of station subsystems to respectively obtain first data, second data, and third data, and preprocessing the first data, second data, and third data to obtain target data;

[0026] Use the attack tree threat model to extract information security risk data of the target data. Use the fourth tool to detect system vulnerabilities of the site subsystem based on the target data to obtain functional safety risk data. Based on the functional safety risk data, extract the system environment of the site subsystem to obtain potential risk data. Determine the source of risk based on the information security risk data and functional safety risk data.

[0027] A risk score is obtained by quantitatively evaluating information security risk data, functional safety risk data, and potential risk data. Risk assessment samples are generated for the corresponding station subsystems based on the target data. The number of risk assessment samples is counted and a scoring optimization factor is set for the risk score. The risk score is optimized based on the scoring optimization factor to obtain a comprehensive risk score.

[0028] The Apriori algorithm is used to obtain the correlation between information security risk data and functional safety risk data. Based on the correlation, the ARIMA model is used to predict the risk change trend. The risk priority is determined based on the risk change trend and the comprehensive risk score.

[0029] Determine appropriate risk measures based on risk priorities;

[0030] Generate risk assessment reports based on risk sources, comprehensive risk scores, risk priorities, and risk measures.

[0031] It is understandable that the above-mentioned risk assessment system and method for integrating information security and functional safety have the same beneficial effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0033] Figure 1 A functional block diagram of a risk assessment system integrating information security and functional safety provided by an embodiment of the present invention;

[0034] Figure 2 A flowchart of a risk assessment method for integrating information security and functional safety is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, unless there is a conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0036] In some embodiments of the present application, see Figure 1As shown, a risk assessment system integrating information security and functional safety includes: a data acquisition module, a risk identification module, a risk assessment module, a risk management module and a risk reporting module. The data acquisition module is configured to respectively obtain first data, second data and third data using a first tool, a second tool and a third tool in multiple site subsystems, and pre-process the first data, the second data and the third data to obtain target data. The risk identification module is configured to extract information security risk data of the target data using an attack tree threat model, and use a fourth tool to detect system vulnerabilities of the site subsystem according to the target data to obtain functional safety risk data. The system environment of the site subsystem is extracted according to the functional safety risk data to obtain potential risk data. The risk source is determined based on the information security risk data and the functional safety risk data. The risk assessment module is configured to The system is configured to obtain a risk score by conducting a quantitative assessment based on information security risk data, functional safety risk data and potential risk data, generate risk assessment samples for the corresponding site subsystems based on the target data, count the number of risk assessment samples and set a score optimization factor for the risk score, optimize the risk score based on the score optimization factor to obtain a comprehensive risk score, the risk assessment module is configured to use the Apriori algorithm to obtain the correlation between information security risk data and functional safety risk data, use the ARIMA model based on the correlation to predict the risk change trend, determine the risk priority based on the risk change trend and the comprehensive risk score, the risk management module is configured to determine the corresponding risk measures based on the risk priority, and the risk reporting module is configured to generate a risk assessment report based on the risk source, comprehensive risk score, risk priority and risk measures.

[0037] Specifically, the data acquisition module uses three specialized tools to collect real-time data from multiple subsystems across multiple dimensions. After collecting the first, second, and third data sets, the module preprocesses the acquired data, including data cleaning, standardization, and deduplication. This preprocessing improves data consistency and accuracy, resulting in target data and providing the necessary data support for subsequent analysis. The risk identification module extracts information security risk data and functional safety risk data from the target data, generating potential risk data. The target data is analyzed using an attack tree threat model, which decomposes attack paths layer by layer to identify information security risks that could impact subsystem security. A fourth tool scans and detects subsystem vulnerabilities, identifying functional defects and weaknesses in subsystems and generating functional safety risk data. By analyzing this functional safety risk data, detailed information about the subsystem environment is extracted and matched against a vulnerability database to identify potential risk data, ensuring comprehensive coverage of potential issues at the subsystem level. The information security and functional safety risk data are then used to identify risk sources, including external attacks, internal threats, malware, and exploit plugins. The risk assessment module quantitatively analyzes information security risk data, functional safety risk data, and potential risk data to generate a risk score reflecting their impact on the overall safety of the subsystem. Based on the target data, risk assessment samples are generated for each site subsystem, allowing for the establishment of scoring optimization factors and dynamic revision of the risk score to obtain a comprehensive risk score, ensuring the accuracy and reliability of the risk assessment results. The Apriori algorithm is used to identify potential correlations between information security risk data and functional safety risk data, revealing their interactions. This improves the consistency of the risk assessment system for information security and functional safety risk data. Time series forecasting using the ARIMA model based on correlations predicts future risk trends. The risk assessment module prioritizes risks based on risk trends and the comprehensive risk score, ensuring the rationality and reliability of the risk assessment system. The risk management module then implements appropriate risk measures based on the risk assessment module's risk priorities, ensuring that limited resources are allocated where needed and enhancing the flexibility and scientific nature of the risk assessment system. The risk reporting module converts risk sources, comprehensive risk scores, risk priorities, and risk measures into an easy-to-understand report, enabling users to quickly understand the subsystem's risk assessment status.

[0038] It is understandable that data collection through the site subsystem to obtain a comprehensive risk score improves the accuracy and reliability of the risk assessment system. Based on the correlation and predictive analysis between information security risk data and functional safety risk data, the integration of data processing in the risk assessment system is improved.

[0039] In some embodiments of the present application, the data acquisition module is configured to use a first tool, a second tool, and a third tool in multiple station subsystems to obtain first data, second data, and third data respectively, and preprocess the first data, second data, and third data to obtain target data, including: the first tool, the second tool, and the third tool are a network sniffing tool, an ELK Stack platform, and a SCADA system, respectively; the data acquisition module uses the network sniffing tool to extract data packets in the station subsystem, parses the data packets to obtain network traffic data, uses the ELK Stack platform to obtain log data in the station subsystem, uses the SCADA system to obtain equipment status data and sensor data in the station subsystem, preprocesses the network traffic data, log data, equipment status data, and sensor data, and the preprocessing includes data cleaning, data standardization, and data deduplication, and obtains the target data based on the preprocessing results.

[0040] Understandably, network sniffing tools are used to capture and parse data packets within the station subsystem to obtain network traffic data. This network traffic data provides information about the subsystem's communications, bandwidth, and data transmission, supporting subsequent risk assessment and analysis. The ELK Stack is responsible for collecting and analyzing log data from the station subsystem, which includes information about subsystem operations and user behavior. The SCADA system acquires device status and sensor data from the station subsystem, including device status and corresponding sensor data collected by various sensors. The collected network traffic data, log data, device status data, and sensor data undergo preprocessing to ensure the consistency and quality of the target data. Data cleansing removes erroneous or incomplete data. Data standardization ensures the consistency of the target data format. Data deduplication removes irrelevant or redundant data to avoid deviations in the target data, improving the clarity and accuracy of the target data and facilitating subsequent processing and analysis by the risk assessment system.

[0041] In some embodiments of the present application, the risk identification module is configured to use an attack tree threat model to extract information security risk data of the target data, including: using the attack tree threat model to obtain the target to be attacked in the target data, the target includes sensitive data, device working status and network communication, decomposing the target to the lower layer to obtain multiple sub-targets, the sub-targets are the directions to be attacked, connecting multiple directions to be attacked through the AND gate and OR gate of the attack tree threat model to obtain a path diagram to be attacked, and obtaining information security risk data based on the path diagram to be attacked.

[0042] Specifically, the attack tree threat model sets the target at the top level and gradually decomposes it downwards until a specific attack direction is reached. The target includes sensitive data, equipment operating status, and network communications within the station subsystem. The lower levels contain the target's sub-targets, each representing a different attack direction. Multiple attack directions are connected through AND and OR gates to form an attack path diagram. For example, an attacker wants to attack the supply equipment in the top-level subsystem. The first sub-target is the subsystem's control interface, the second sub-target is the physical protection of the equipment, and the third sub-target is to gain control through a network attack. The attacker gains control by attacking the physical protection of the equipment and the subsystem's control interface. AND gates indicate that the attacker must overcome multiple sub-targets to successfully attack, while OR gates indicate that the attacker only needs to breach one of the sub-targets to complete the attack. This helps clarify the attacker's attack path in different scenarios. Combining these structures generates an attack path diagram, which illustrates the attacker's potential attack path. This attack path diagram generates information security risk data, which includes data on the attack path from a target to its sub-targets.

[0043] It is understandable that through the structured processing of the attack tree threat model, the vulnerable parts can be identified and the attack paths can be obtained, which improves the reliability and rigor of obtaining information security risk data, facilitating the subsequent evaluation and integrated analysis of the risk assessment system.

[0044] In some embodiments of the present application, when using the fourth tool to detect system vulnerabilities of the site subsystem according to the target data, obtaining functional safety risk data, extracting the system environment of the site subsystem according to the functional safety risk data, and obtaining potential risk data, it includes: the risk identification module uses the Nessus tool to configure the network permissions of the subsystem, covering the IP address, host name and network segment of the subsystem, selecting a comprehensive scanning strategy to scan vulnerabilities in the subsystem, obtaining functional safety risk data according to the vulnerability scanning results, matching the functional safety risk data with the vulnerability database, obtaining the vulnerability port to be exploited by the attacker and obtaining the interaction relationship between each subsystem in the network, and obtaining potential risk data based on the interaction relationship.

[0045] Specifically, the Nessus tool configures network permissions for each subsystem to ensure it can fully scan every component and network device within the subsystem. It also employs a comprehensive scanning strategy to conduct in-depth and thorough scans of the subsystem, examining potential vulnerabilities within the subsystem, such as operating procedure vulnerabilities and application vulnerabilities. During the comprehensive scan, Nessus identifies and lists various vulnerabilities within the subsystem, assesses the severity of these vulnerabilities, and generates functional safety risk data based on the results of the comprehensive scan. This data describes the potential threat that the vulnerabilities may pose to the subsystem's functionality. This improves the accuracy of the risk assessment system's subsequent assessment of functional safety risk data. By comparing data with the vulnerability database, the vulnerability database contains extensive security vulnerability data, including vulnerability descriptions, attack methods, and the scope of impact.

[0046] As you can see, based on comprehensive scanning and matching against the vulnerability database, the risk assessment system can identify vulnerable ports that could be exploited by attackers. These ports are potential entry points for attackers to compromise subsystems. The communication paths and interactions between subsystems can provide additional attack opportunities. For example, if a subsystem frequently communicates with external networks or other subsystems, it could expose potentially vulnerable ports, leading to attacks. By analyzing network interactions, it can identify which connections between subsystems pose attack risks, thereby generating potential risk data. This improves the accuracy and reliability of the risk assessment system.

[0047] In some embodiments of the present application, the risk assessment module is configured to perform a quantitative assessment based on the information security risk data, the functional safety risk data, and the potential risk data to obtain a risk score. When generating a risk assessment sample for the corresponding site subsystem based on the target data, the risk assessment module includes: the risk assessment module counts the number of information security risk data, the functional safety risk data, and the potential risk data as the information quantity, the functional quantity, and the potential quantity, respectively. The risk score is obtained by the following formula:

[0048]

[0049] Among them, M represents the risk score, u1, u2 and u3 are weight coefficients, J represents the amount of information, K represents the number of functions, L represents the potential number, and the risk assessment samples include: the first sample, the second sample and the irrelevant sample. The standard target data corresponding to each station subsystem is determined, and the target data and the standard target data are compared. If the target data are equal to or greater than the standard target data, the first sample is generated for the corresponding station subsystem. If the target data are all less than the standard target data, the second sample is generated for the corresponding station subsystem. If one or more target data are equal to or greater than the standard target data, and one or more target data are less than the standard target data, an irrelevant sample is generated for the corresponding station subsystem.

[0050] It can be understood that by converting the amount of information, functions, and potential data into specific risk scores, the risk assessment system can quantitatively analyze information security risk data, functional safety risk data, and potential risk data, improving the accuracy of the integrated processing of information security risk data and functional safety risk data, thereby obtaining precise risk scores and enhancing the reliability of the risk assessment system. Standard target data and target data correspond one-to-one. Since the target data contains information security risk data, functional safety risk data, and potential risk data, the standard target data represents the standardized safety data for the subsystem. By comparing the target data with the standard target data, the risk assessment system can classify the site subsystem into the first sample, the second sample, and the irrelevant sample, facilitating subsequent optimization of risk scores.

[0051] In some embodiments of the present application, when the number of risk assessment samples is counted and a scoring optimization factor of the risk score is set, the risk score is optimized based on the scoring optimization factor to obtain a comprehensive risk score, including: counting the number of the first sample and recording it as the first number, counting the number of the second sample and recording it as the second number, determining the ratio of the first number to the second number and recording it as P, pre-setting the first scoring optimization factor, the second scoring optimization factor, the third scoring optimization factor and the fourth scoring optimization factor, when P is less than or equal to the first preset number threshold, the first scoring optimization factor is used as the scoring optimization factor of the risk score, and when P is greater than the first preset number threshold, the first scoring optimization factor is used as the scoring optimization factor of the risk score. When the quantity threshold is reached and is less than the second preset quantity threshold, the second scoring optimization factor is used as the scoring optimization factor for the risk score. When P is greater than or equal to the second preset quantity threshold, the third scoring optimization factor is used as the scoring optimization factor for the risk score. The number of all target data of all irrelevant samples that is greater than or equal to the standard target data is counted and recorded as the valid number. The number of all target data of all irrelevant samples that is less than the standard target data is counted and recorded as the invalid number. When the valid number is greater than the invalid number, the fourth scoring optimization factor is used as the scoring optimization factor for the risk score. The comprehensive risk score is the product of the scoring optimization factor and the risk score.

[0052] It should be understood that the first preset number threshold and the second preset number threshold are not limited in the embodiment of the present application. For example, the first preset number threshold may be 0.8, and the second preset number threshold may be 1.5.

[0053] It can be understood that the first scoring optimization factor is preferably 1.3, the second scoring optimization factor is preferably 1.1, the third scoring optimization factor is preferably 0.9, and the fourth scoring optimization factor is preferably 0.7. The corresponding scoring optimization factors are determined based on the quantity ratio to ensure that the collected data is multidimensional, reduce the abnormality of the risk score caused by accidental errors, thereby realizing dynamic optimization of the risk score, ensuring the optimization accuracy, and improving the reliability of the comprehensive risk score.

[0054] In some embodiments of the present application, the risk assessment module uses the Apriori algorithm to obtain the correlation between information security risk data and functional safety risk data, uses the ARIMA model to predict the risk change trend based on the correlation, and determines the risk priority according to the risk change trend and the comprehensive risk score, including: the risk assessment module uses the Apriori algorithm to collect information security risk data and functional safety risk data, establishes a database for historical information security risk data and historical functional safety risk data, obtains frequent combination items of historical information security risk data and historical functional safety risk data, determines the correlation between information security risk data and functional safety risk data according to the frequent combination items, and uses The ARIMA model constructs a time series based on the obtained correlation and predicts the changing trend of the correlation. The changing trends include growth trends, downward trends and stable trends. The risk priorities include first risk priority, second risk priority and third risk priority. When the comprehensive risk score is greater than or equal to the preset risk score threshold and is in a growth trend or a stable trend, it is determined to be the first risk priority. When the comprehensive risk score is greater than or equal to the preset risk score threshold and is in a downward trend, or when the comprehensive risk score is less than the preset risk score threshold and is in an growth trend, it is determined to be the second risk priority. When the comprehensive risk score is less than the preset risk score threshold and is in a downward trend or a stable trend, it is determined to be the third risk priority.

[0055] It should be understood that the embodiments of the present application do not limit the preset risk score threshold. For example, the preset risk score threshold may be 80.

[0056] Specifically, the Apriori algorithm collects information security risk data and functional safety risk data as item sets, and creates a database with all the collected historical information security risk data and historical functional safety risk data. The Apriori algorithm iteratively scans the data in the database to generate frequent combination items that meet the frequent item set conditions. For example, if a pattern of simultaneous occurrence of certain historical information security risk data and historical functional safety risk data is found, these historical information security risk data and historical functional safety risk data are used as frequent combination items. This generates association rules for historical information security risk data and historical functional safety risk data. For example, a system vulnerability in a subsystem will increase the risk of leakage of some sensitive data, and other correlation rules. Based on the correlation rules, the correlation between information security risk data and functional safety risk data is determined. By iteratively scanning all the historical information security risk data and historical functional safety risk data in the database, it is ensured that the obtained correlation rules conform to the patterns of all data, ensuring the integration of the risk assessment system and providing a basis for subsequent risk assessment and prediction.

[0057] It is understandable that the ARIMA model is used to construct a time series based on the obtained correlations. The time series starts at the current moment and spans every three days. The ARIMA model is used to predict the changing trends of the correlations. The changing trends include an upward trend, indicating that the correlation data is gradually increasing, which means that the relationship between information security risk data and functional safety risk data is becoming closer, indicating that new risks are increasing; a downward trend, which means that the correlation data is gradually decreasing, indicating that the association between the two risk data is weakening, indicating that certain risk hazards are being effectively alleviated; and a stable trend, which means that the relationship between the two remains stable, indicating that the risks of the subsystem have not changed significantly. The risk priorities of the first risk priority, the second risk priority, and the third risk priority are reduced in sequence. By dividing the risk priorities into the first risk priority, the second risk priority, and the third risk priority, a data foundation is laid for subsequent risk management to focus on high priorities.

[0058] In some embodiments of the present application, the risk management module is configured to determine corresponding risk measures based on the risk priority, including: the risk measures include a first risk measure, a second risk measure and a third risk measure, and the risk management module determines them as the first risk measure, the second risk measure and the third risk measure according to the first risk priority, the second risk priority and the third risk priority respectively, and the urgency of the first risk measure, the second risk measure and the third risk measure decreases in sequence.

[0059] It is understandable that taking corresponding risk measures for different risk priorities avoids waste of resources, can reasonably allocate resources according to different risk priorities, optimize the subsequent emergency response and processing procedures for risk assessment, and enhance the risk prevention and control capabilities of the risk assessment system for the site subsystem.

[0060] In some embodiments of the present application, the risk reporting module is configured to generate a risk assessment report based on the risk source, comprehensive risk score, risk priority and risk measures, including: the risk reporting module generates a risk assessment report, the risk assessment report is set in a chart form, the chart form includes a pie chart, a line chart, a scatter chart and a bar chart, the risk source is set to a pie chart, the comprehensive risk score is set to a line chart, the risk priority is set to a scatter chart, and the risk measure is set to a bar chart, and the format of the risk assessment report output by the risk reporting module is a standard output format.

[0061] It is understandable that presenting risk sources, comprehensive risk scores, risk priorities, and risk measures in graphical form allows the risk assessment report to intuitively demonstrate the risk assessment results. Standard output formats are PDF and Excel, ensuring the uniformity and standardization of risk assessment reports. The graphical and structured presentation improves the efficiency of risk assessment report communication and enhances the visibility of risk assessment reports generated by the risk assessment system. Furthermore, the comprehensive assessment of information security risk data and functional safety risk data enhances the accuracy of the risk assessment system's comprehensive data processing and integration.

[0062] In summary, the beneficial effects of the present invention are: comprehensive collection and pre-processing of different data of the site subsystems are carried out through a variety of tools, thereby providing accurate and comprehensive target data, laying a data foundation for subsequent risk identification, assessment and management. The attack tree threat model is used to extract information security risk data, and functional safety risk data is obtained by detecting system vulnerabilities in the site subsystems. Combined with potential risk data, the risk sources of each subsystem can be accurately determined. It ensures that the system can fully cover all types of risk data, improves the comprehensiveness of risk assessment, and combines the Apriori algorithm and ARIMA model to analyze the correlation between information security risk data and functional safety risk data, and predicts the trend of risk changes. Thereby, the foresight and responsiveness of risk assessment management are enhanced, corresponding risk measures are taken according to risk priority, and targeted measures are ensured for different risk priorities, effectively avoiding waste of resources, and improving the processing efficiency of risk assessment, thereby generating a structured and intuitive risk assessment report, and improving the comprehensiveness, accuracy and decision-making support capabilities of risk assessment.

[0063] In another preferred embodiment based on the above embodiment, refer to Figure 2As shown, this embodiment provides a risk assessment method for integrating information security and functional safety, which is used to apply the above-mentioned risk assessment system for integrating information security and functional safety, including:

[0064] S201. Use a first tool, a second tool, and a third tool in multiple station subsystems to respectively obtain first data, second data, and third data, and pre-process the first data, second data, and third data to obtain target data.

[0065] It should be understood that the station subsystems in the embodiments of the present application may be station subsystems in different regions, such as different provinces, different cities, different districts and counties, etc. The station subsystems may also be simply referred to as subsystems, which is not limited in the embodiments of the present application.

[0066] Exemplarily, the first data may be network traffic data, the second data may be log data, and the third data may be device status data and sensor data.

[0067] In an embodiment of the present application, preprocessing includes at least one of the following: data cleaning, data standardization, and data deduplication.

[0068] S202. Use the attack tree threat model to extract information security risk data of the target data; use the fourth tool to detect system vulnerabilities of the site subsystem based on the target data to obtain functional safety risk data; extract the system environment of the site subsystem based on the functional safety risk data to obtain potential risk data; determine the source of risk based on the information security risk data and the functional safety risk data.

[0069] In one possible implementation, an attack tree threat model can be used to identify targets within target data. These targets include sensitive data, device operating status, and network communications. This target is then decomposed into multiple sub-targets, each representing a target attack direction. The attack tree threat model then uses AND and OR gates to connect these multiple targets to create an attack path graph. Information security risk data is then generated based on this attack path graph. This information security risk data includes information about the attack path from a target to its sub-targets.

[0070] In one possible implementation, Nessus, a system vulnerability scanning and analysis tool, is used to configure network permissions for the subsystem. This vulnerability scan is then performed to obtain functional safety risk data. Network permissions include the subsystem's IP address, host name, and network segment. This functional safety risk data is then matched against a vulnerability database to identify vulnerable ports that could be exploited by attackers. The network interactions between subsystems are then analyzed, and potential risk data is derived based on these interactions.

[0071] S203. Evaluate the information security risk data, functional safety risk data, and potential risk data to obtain a risk score. Generate risk assessment samples for the corresponding site subsystems based on the target data, count the number of risk assessment samples, and set a scoring optimization factor for the risk score. Optimize the risk score based on the scoring optimization factor to obtain a comprehensive risk score.

[0072] S204. Use the association rule mining Apriori algorithm to obtain the correlation between information security risk data and functional safety risk data, use the autoregressive integrated moving average (ARIMA) model based on the correlation to predict the risk change trend, and determine the risk priority based on the risk change trend and the comprehensive risk score.

[0073] S205. Determine corresponding risk measures based on risk priorities.

[0074] S206. Generate a risk assessment report based on risk sources, comprehensive risk scores, risk priorities and risk measures.

[0075] It can be understood that first, in multiple site subsystems, different types of data are acquired and preprocessed using the first, second, and third tools to obtain target data. This improves the accuracy and reliability of the target data. An attack tree threat model is used to extract information security risk data from the target data. Vulnerability scanning is performed using the fourth tool to obtain functional safety risk data, which is then analyzed to obtain potential risk data, improving the comprehensiveness and accuracy of the risk assessment. Then, a quantitative assessment is performed based on the information security risk data, functional safety risk data, and potential risk data to obtain a risk score. The risk score is then optimized based on the score optimization factor to obtain a comprehensive risk score. This demonstrates the dynamic optimization and scientific nature of the risk assessment. Next, the Apriori algorithm is used to analyze the correlation between information security risk data and functional safety risk data, combined with the ARIMA model to predict risk trends. Risk priorities are then determined based on the risk trends and the comprehensive score. This improves the accuracy, foresight, and responsiveness of the risk assessment. Corresponding risk measures are formulated according to priorities, which improves the pertinence of risk assessment results and the rationality of resource allocation. Finally, a risk assessment report is generated, which comprehensively considers information security and functional safety aspects, and improves the comprehensiveness, transparency and decision-making support capabilities of risk assessment.

[0076] The system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be further decomposed or combined. For example, the modules in the above embodiment can be combined into one module or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the modules or steps and are not to be regarded as improper limitations of the present invention.

[0077] The embodiments of the present application also provide a computer program product that can be directly loaded into a memory and contains software code. After being loaded and executed by a computer, the computer program product can implement the data acquisition method provided in the above embodiments. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solutions of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

[0078] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or a combination of software and hardware embodiments. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0079] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0080] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A risk assessment system integrating information security and functional safety, characterized in that: include: Data collection module, risk identification module, risk assessment module, risk management module and risk reporting module; The data acquisition module is configured to respectively obtain first data, second data, and third data using a first tool, a second tool, and a third tool in a plurality of station subsystems, and pre-process the first data, the second data, and the third data to obtain target data; The risk identification module is configured to extract information security risk data of the target data using an attack tree threat model; Using a fourth tool to detect system vulnerabilities of the station subsystem according to the target data to obtain functional safety risk data; Extracting the system environment of the station subsystem according to the functional safety risk data to obtain potential risk data; determining a risk source based on the information security risk data and the functional safety risk data; The risk assessment module is configured to perform an assessment based on the information security risk data, the functional safety risk data, and the potential risk data to obtain a risk score; generating risk assessment samples for the corresponding station subsystem according to the target data, counting the number of the risk assessment samples and setting a score optimization factor for the risk score, and optimizing the risk score based on the score optimization factor to obtain a comprehensive risk score; The risk assessment module is configured to use an association rule mining Apriori algorithm to obtain a correlation between the information security risk data and the functional safety risk data, use an autoregressive integrated moving average (ARIMA) model based on the correlation to predict a risk change trend, and determine a risk priority based on the risk change trend and the comprehensive risk score; The risk management module is configured to determine corresponding risk measures according to the risk priority; The risk reporting module is configured to generate a risk assessment report based on the risk source, the comprehensive risk score, the risk priority and the risk measures.

2. The risk assessment system for integrated information security and functional safety according to claim 1, characterized in that: The first tool, the second tool, and the third tool are respectively a network sniffing tool, a log analysis platform ELK Stack platform, and a data acquisition and supervisory control system SCADA system; the data acquisition module is specifically configured as follows: The network sniffing tool is used to extract data packets in the station subsystem, and the data packets are parsed to obtain network traffic data; the ELK Stack platform is used to obtain log data in the station subsystem, and the SCADA system is used to obtain device status data and sensor data in the station subsystem; The network traffic data, the log data, the device status data and the sensor data are preprocessed to obtain target data, wherein the preprocessing includes: data cleaning, data standardization and data deduplication.

3. The risk assessment system integrating information security and functional safety according to claim 1, characterized in that: The risk identification module is specifically configured to: The attack tree threat model is used to obtain targets to be attacked in the target data, wherein the targets include sensitive data, device working status and network communication; the targets are decomposed to the lower layer to obtain multiple sub-targets, and the sub-targets are directions to be attacked; multiple directions to be attacked are connected through the AND gate and OR gate of the attack tree threat model to obtain a path diagram to be attacked; and the information security risk data is obtained according to the path diagram to be attacked.

4. The risk assessment system integrating information security and functional safety according to claim 1, characterized in that: The risk identification module is further configured to: Using the system vulnerability scanning and analysis tool Nessus to configure the network permissions of the station subsystem, and perform vulnerability scanning on the station subsystem to obtain the functional safety risk data; The network permissions include: the IP address, host name and network segment of the station subsystem; The functional safety risk data is matched with a vulnerability database to obtain the vulnerability port to be exploited by the attacker, and the interaction relationship between each of the station subsystems in the network is obtained, and potential risk data is obtained based on the interaction relationship.

5. The risk assessment system integrating information security and functional safety according to claim 1, characterized in that: The risk assessment samples include: a first sample, a second sample, and an irrelevant sample; the risk assessment module is specifically configured to: The number of the information security risk data, the functional safety risk data, and the potential risk data is counted and recorded as information quantity, functional quantity, and potential quantity, respectively; wherein the risk score satisfies the following formula: Wherein, M represents the risk score, u1, u2 and u3 are weight coefficients, J represents the amount of information, K represents the number of functions, and L represents the potential amount; Determine standard target data corresponding to each of the station subsystems, and compare the target data with the standard target data; if the target data are all equal to or greater than the standard target data, generate the first sample for the corresponding station subsystem; if the target data are all less than the standard target data, generate the second sample for the corresponding station subsystem; If data equal to or greater than the standard target data exists in the target data, and data less than the standard target data exists in the target data, the irrelevant sample is generated for the corresponding station subsystem.

6. The risk assessment system integrating information security and functional safety according to claim 5, characterized in that: The scoring optimization factor is any one of the following: a first scoring optimization factor, a second scoring optimization factor, a third scoring optimization factor, and a fourth scoring optimization factor; the risk assessment module is specifically configured as follows: Counting the number of the first samples and recording it as a first number, counting the number of the second samples and recording it as a second number, and determining a ratio of the first number to the second number and recording it as P; When P is less than or equal to a first preset number threshold, the first score optimization factor is used as the score optimization factor of the risk score; When P is greater than a first preset number threshold and less than a second preset number threshold, the second score optimization factor is used as the score optimization factor of the risk score; When P is greater than or equal to a second preset number threshold, the third score optimization factor is used as the score optimization factor of the risk score; Counting the number of data in all the irrelevant samples that are greater than or equal to the standard target data, and recording it as a valid number; counting the number of data in all the irrelevant samples that are less than the standard target data, and recording it as an invalid number; When the valid number is greater than the invalid number, the fourth score optimization factor is used as the score optimization factor of the risk score; The product of the score optimization factor and the risk score is used as the comprehensive risk score.

7. The risk assessment system integrating information security and functional safety according to claim 6, characterized in that: The risk priority is any one of the following: first risk priority, second risk priority, and third risk priority; the risk assessment module is specifically configured to: The Apriori algorithm is used to collect the information security risk data and the functional safety risk data, and a database is established for the historical information security risk data and the historical functional safety risk data to obtain frequent combination items of the historical information security risk data and the historical functional safety risk data; and a correlation between the information security risk data and the functional safety risk data is determined based on the frequent combination items. Using the ARIMA model to construct a time series based on the correlation to obtain the risk change trend, where the risk change trend includes an increasing trend, a decreasing trend, and a stable trend; When the comprehensive risk score is greater than or equal to a preset risk score threshold and is in the increasing trend or the stable trend, determining the risk priority as the first risk priority; When the comprehensive risk score is greater than or equal to the preset risk score threshold and is on a downward trend, or when the comprehensive risk score is less than the preset risk score threshold and is on an upward trend, determining the risk priority to be the second risk priority; When the comprehensive risk score is less than the preset risk score threshold and is in the downward trend or the stable trend, the risk priority is determined to be the third risk priority.

8. The risk assessment system integrating information security and functional safety according to claim 7, characterized in that: The risk measures include first risk measures, second risk measures and third risk measures; The first risk measure corresponds to the first risk priority, the second risk measure corresponds to the second risk priority, and the third risk measure corresponds to the third risk priority; The urgency levels of the first risk measure, the second risk measure, and the third risk measure decrease in sequence.

9. The risk assessment system integrating information security and functional safety according to claim 8, characterized in that: The risk assessment report is set in the form of a chart, which includes a pie chart, a line chart, a scatter chart and a bar chart. The risk source is set as the pie chart, the comprehensive risk score is set as the line chart, the risk priority is set as the scatter chart, and the risk measure is set as the bar chart.

10. A risk assessment method for integrating information security and functional safety, for applying the risk assessment system for integrating information security and functional safety according to any one of claims 1 to 9, characterized in that: include: Using a first tool, a second tool, and a third tool in a plurality of station subsystems to respectively obtain first data, second data, and third data, and preprocessing the first data, the second data, and the third data to obtain target data; Extracting information security risk data of the target data using an attack tree threat model; Using a fourth tool to detect system vulnerabilities of the station subsystem according to the target data to obtain functional safety risk data; Extracting the system environment of the station subsystem according to the functional safety risk data to obtain potential risk data; determining a risk source based on the information security risk data and the functional safety risk data; Performing an assessment based on the information security risk data, the functional safety risk data, and the potential risk data to obtain a risk score; generating risk assessment samples for the corresponding station subsystem according to the target data, counting the number of the risk assessment samples and setting a score optimization factor for the risk score, and optimizing the risk score based on the score optimization factor to obtain a comprehensive risk score; Using an association rule mining Apriori algorithm to obtain the correlation between the information security risk data and the functional safety risk data, using an autoregressive integrated moving average (ARIMA) model based on the correlation to predict the risk change trend, and determining the risk priority based on the risk change trend and the comprehensive risk score; Determine appropriate risk measures based on the risk priorities; A risk assessment report is generated based on the risk source, the comprehensive risk score, the risk priority, and the risk measures.

Images