Ship network security risk assessment method, system, device and medium based on dynamic risk model

Abstract

The application provides a ship network security risk assessment method, system, device and medium based on a dynamic risk model, and relates to the technical field of ship network security. The method comprises the following steps: collecting ship asset attribute data sets and all-factor data required for ship network security risk assessment, and determining vulnerable items; identifying potential network security risk scenarios according to historical ship network security event types, and estimating the event influence degree and threat occurrence possibility of each risk scenario; calculating the unit risk initial value and the unit average risk value corresponding to each risk scenario according to the vulnerability severity, event influence degree and threat occurrence possibility of the vulnerable items in each risk scenario; constructing a dynamic risk model based on time factors and risk evolution double-factor weighting; calculating the risk value of each evaluation unit based on the dynamic risk model, and taking the maximum risk value as the network security risk assessment value of the current ship as a whole. The application realizes the optimized management of ship network security risks.

Description

Technical Field

[0001] This invention relates to the field of marine cybersecurity technology, specifically to a method, system, equipment, and medium for assessing marine cybersecurity risks based on a dynamic risk model. Background Technology

[0002] As the shipping industry becomes increasingly digitalized and intelligent, cybersecurity issues are becoming more prominent. From ship design and construction to operation and management, network interconnection has become a core foundation for improving efficiency and enabling innovative applications such as remote monitoring and autonomous driving. However, this high degree of interconnectivity has also greatly expanded the attack surface, posing serious threats to previously physically isolated OT (operational technology) systems: critical navigation equipment (such as ECDIS and AIS) may be attacked and rendered uncontrollable, ransomware can lock down management systems, forcing ships to stop, and sensitive data is easily leaked. These risks directly endanger navigation safety and ship assets, and may even lead to significant economic losses, environmental pollution, and reputational damage.

[0003] Ship cybersecurity issues mainly include the following: 1. System software and hardware vulnerabilities; 2. Plaintext transmission of ship industry system protocols; 3. Widespread weak passwords for ship equipment; 4. Remote operation and maintenance issues; 5. Lack of management of physical interfaces. To address ship cybersecurity, it is necessary to establish a ship cybersecurity risk assessment method that facilitates risk comparison, reflects dynamic risk changes, and allows for easy risk identification and rectification. This method should be combined with risk tolerance to develop clear countermeasures, conduct unit-based and scenario-based comprehensive analysis of risk dependencies, formulate risk handling priority recommendations, and implement risk handling measures after accurate assessment to ensure ship cybersecurity.

[0004] Existing ship cybersecurity assessment methods are based on labeling and extracting security elements such as assets, threats, and vulnerabilities to construct security element and risk assessment values. This technology has the following drawbacks:

[0005] (1) The full-element characteristics of ship network security risk assessment have not been fully considered, the role of assets, business and results in the actual network system has been ignored, and the comparison between risks has not been considered. A comprehensive risk assessment correlation analysis mechanism with full elements and dynamic updates has not been established.

[0006] (2) A unit-based and scenario-based comprehensive analysis dimension has not yet been established, and the dynamic impact of time factors and risk evolution conditions on risk has not been identified;

[0007] (3) The impact of the assessors' subjective work experience on the risk assessment conclusion has not been considered;

[0008] (4) There is no clear guidance on how risk assessment results can help organizations respond to risks in the order of response and subsequent resource allocation, and assist decision-makers in accurately identifying risks that need to be addressed first. This is insufficient for the dynamic stability of ship network security.

[0009] In summary, current ship safety risk assessment work is mainly based on relevant standards and theoretical management methods. However, this assessment method still relies on subjective human experience to assign values ​​to ship network security assessment data in the early stages. It cannot assess time factors and risk evolution conditions, and suffers from problems such as oversimplifying complex risk situations, strong subjectivity, heavy reliance on assessor experience, difficulty in handling multiple highly correlated risks, static analysis of single risks, inability to reflect dynamic changes in risks, and inaccurate assessment results. Summary of the Invention

[0010] In view of this, embodiments of this application provide a method, system, device and medium for assessing ship cybersecurity risks based on a dynamic risk model, which takes into account complex risk situations, more accurately assesses the quantitative risks of ships in cybersecurity incident scenarios, and accurately identifies risks that need to be addressed first.

[0011] This application provides the following technical solution: a method for assessing ship cybersecurity risks based on a dynamic risk model, comprising:

[0012] Based on the principle of network security zone division, the actual network area of ​​the ship is divided into multiple blocks, with each block serving as the evaluation unit.

[0013] Collect a ship asset attribute dataset to obtain an asset list. Collect all the data required for ship cybersecurity risk assessment from the asset list to obtain a ship cybersecurity assessment dataset. Determine a vulnerability list based on the ship cybersecurity assessment dataset and analyze and determine the vulnerability severity corresponding to each vulnerability.

[0014] Based on historical ship cybersecurity incidents, a ship cybersecurity risk scenario database is constructed. Based on the actual needs of current risk assessment, risk scenarios applicable to the current ship are selected from the ship cybersecurity risk scenario database to form a risk scenario database for current ship cybersecurity assessment. The impact of each risk scenario in the risk scenario database and the probability of threat occurrence are estimated.

[0015] Based on the severity of the vulnerability, the impact of the event, and the probability of the threat occurring in each risk scenario, calculate the initial unit risk value for each risk scenario, and calculate the average unit risk value for all risk scenarios corresponding to the assessment unit.

[0016] For each risk scenario, a time-weighted risk value is calculated by defining a time factor weight for the initial risk value of the unit. A risk evolution weight is then calculated by defining a risk evolution value based on a two-factor weight for the average risk value of the unit. The average of the time-weighted risk value and the risk evolution value is used as the risk value of the assessment unit, thus constructing a dynamic risk model based on a time factor and a risk evolution weight. The two risk evolution factors include the effectiveness of safety measures discovered during the assessment process and residual risk constants.

[0017] Calculate the risk value for each of the assessment units, and take the largest risk value as the current overall cybersecurity risk assessment value for the ship.

[0018] According to one embodiment of this application, the ship asset attribute dataset includes core shipboard control system assets, shipboard information technology system assets, ship fusion system assets, and infrastructure and logical assets, thereby obtaining the asset list.

[0019] According to one embodiment of this application, the event impact in the event impact degree includes security impact, environmental impact, compliance impact, and economic and reputational impact. When estimating the event impact degree of each risk scenario, the security impact, environmental impact, and compliance impact are used as core factors, and the economic and reputational impact is used as a superimposed correction factor. The event impact degree of each risk scenario is calculated using the following formula. :

[0020] .

[0021] According to one embodiment of this application, the factors in the probability of threat occurrence include historical event frequency, navigation status weight, and external threat level; the probability of threat occurrence P for each risk scenario is calculated using the following formula:

[0022] .

[0023] According to one embodiment of this application, the initial unit risk value corresponding to each risk scenario is calculated using the following formula:

[0024]

[0025] in, This represents the initial value of the unit risk for the j-th risk scenario. Indicates the severity of vulnerability. P indicates the degree of impact of the event, and P indicates the probability of the threat occurring.

[0026] According to one embodiment of this application, the time-weighted risk value is calculated using the following formula:

[0027]

[0028] in, This represents the time-weighted risk value. This represents the time factor weight for the j-th risk scenario. This represents the initial value of the unit risk for the j-th risk scenario.

[0029] According to one embodiment of this application, the risk evolution value is calculated using the following formula:

[0030]

[0031] in, Indicates the risk evolution value. This represents the average risk value of the unit. Indicates the effectiveness of safety measures. represents the residual risk constant, and t represents the time since the risk was discovered in the previous risk assessment.

[0032] This application also provides a ship cybersecurity risk assessment system based on a dynamic risk model, including:

[0033] The block division module is used to divide the actual network area of ​​the ship into multiple blocks according to the network security area division principle, with each block as an evaluation unit.

[0034] The vulnerability analysis module is used to collect a dataset of ship asset attributes to obtain an asset list, collect all the data required for ship cybersecurity risk assessment from the asset list to obtain a ship cybersecurity assessment dataset, determine a vulnerability list based on the ship cybersecurity assessment dataset, and analyze and determine the vulnerability severity corresponding to each vulnerability.

[0035] The risk scenario analysis module is used to build a ship cybersecurity risk scenario database based on historical ship cybersecurity incidents, select applicable risk scenarios for the current ship based on the actual needs of the current risk assessment, form a risk scenario database for the current ship cybersecurity assessment, and estimate the impact of each risk scenario in the risk scenario database and the probability of threat occurrence.

[0036] The initial risk value calculation module is used to calculate the initial unit risk value corresponding to each risk scenario based on the severity of the vulnerability, the impact of the event, and the probability of the threat occurring in each risk scenario, and to calculate the average unit risk value of all risk scenarios corresponding to the assessment unit.

[0037] The dynamic risk model construction module is used to define time factor weights for the initial risk value of the unit corresponding to each risk scenario, and calculate the time-weighted risk value; define risk evolution dual-factor weights for the average risk value of the unit, and calculate the risk evolution value; and use the average of the time-weighted risk value and the risk evolution value as the risk value of the assessment unit to construct a dynamic risk model based on time factor and risk evolution dual-factor weighting; wherein, the risk evolution dual factors include the effectiveness of safety measures and residual risk constants found during the assessment process;

[0038] The cybersecurity risk assessment module is used to calculate the risk value of each assessment unit and take the largest risk value as the current overall cybersecurity risk assessment value of the ship.

[0039] This application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method for assessing ship cybersecurity risks.

[0040] This application also provides a computer-readable storage medium storing a computer program that performs the above-described ship cybersecurity risk assessment method.

[0041] Compared with traditional methods, the beneficial effects achieved by at least one of the above-mentioned technical solutions adopted in the embodiments of this specification include at least the following: the embodiments of this invention solve the problems of relatively simple risk factors and insufficient correlation in the current assessment methods by using a full-element, dynamically updated risk correlation analysis mechanism; by establishing a time factor and risk evolution condition mechanism to change the current static analysis working mechanism, the influence of the assessor's subjective work experience on the risk assessment conclusion is weakened, so that the risk assessment results have a priority handling gradient, so as to obtain the optimal order of responding to risks and resource allocation, assist decision-makers in accurately identifying risks that need to be prioritized, and achieve optimized management of ship network security risks.

[0042] This invention establishes a suitable dynamic cybersecurity risk assessment model by integrating the characteristics of maritime affairs and ship operations, replacing the traditional general-purpose risk assessment model. It provides richer input parameter functions and can more accurately assess the quantitative risks of ships in cybersecurity incident scenarios. Whether used as a reference for cybersecurity compliance certification by classification societies or as an intuitive underwriting basis for insurance companies, it has better reference value and benefits. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of the process of the ship cybersecurity risk assessment method based on a dynamic risk model according to an embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram of the ship cybersecurity risk assessment process according to an embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of a ship network structure according to an embodiment of the present invention;

[0047] Figure 4 This is a schematic diagram of a ship cybersecurity risk assessment system according to an embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of the structure of the computer device of the present invention. Detailed Implementation

[0049] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0050] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] like Figure 1 As shown, this embodiment of the invention provides a method for assessing ship cybersecurity risks based on a dynamic risk model, including:

[0052] S101. In accordance with the principle of network security area division, the actual network area of ​​the ship is divided into multiple blocks, with each block serving as the evaluation unit;

[0053] S102. Collect a ship asset attribute dataset to obtain an asset list. Collect all the data required for ship cybersecurity risk assessment from the asset list to obtain a ship cybersecurity assessment dataset. Determine a vulnerability list based on the ship cybersecurity assessment dataset and analyze and determine the vulnerability severity corresponding to each vulnerability.

[0054] S103. Based on historical ship cybersecurity incidents, construct a ship cybersecurity risk scenario database. Based on the actual needs of the current risk assessment, select the applicable risk scenarios for the current ship from the ship cybersecurity risk scenario database to form a risk scenario database for the current ship cybersecurity assessment. Estimate the impact of each risk scenario in the risk scenario database and the probability of threat occurrence.

[0055] S104. Based on the severity of the vulnerability, the impact of the event, and the probability of the threat occurring in each risk scenario, calculate the initial unit risk value for each risk scenario, and calculate the average unit risk value for all risk scenarios corresponding to the assessment unit.

[0056] S105. Define time factor weights for the initial unit risk value corresponding to each risk scenario, and calculate the time-weighted risk value; define risk evolution dual-factor weights for the unit average risk value, and calculate the risk evolution value; use the average of the time-weighted risk value and the risk evolution value as the risk value of the assessment unit, and construct a dynamic risk model based on time factor and risk evolution dual-factor weighting; wherein, the risk evolution dual factors include the effectiveness of safety measures and residual risk constants discovered during the assessment process;

[0057] S106. Calculate the risk value of each of the assessment units, and take the largest risk value as the current overall cybersecurity risk assessment value of the ship.

[0058] This invention proposes a method for assessing ship cybersecurity risks based on a dynamic risk model. First, it collects full-element data from a ship asset attribute dataset and a ship cybersecurity assessment dataset. Then, it identifies potential cybersecurity risk scenarios based on common ship cybersecurity incident types. Next, it constructs a dynamic risk model weighted by two dimensions: time and risk evolution. Based on the dynamic risk model, it analyzes risk scenarios in the asset dataset and adjusts the model's accuracy. Then, it assesses different network areas of the ship based on the optimized dynamic risk model. Finally, it combines the regional assessment results to conduct a comprehensive ship cybersecurity risk assessment. This allows for a systematic approach to effectively prioritize risk responses and allocate resources, assisting decision-makers in accurately identifying risks that require priority handling.

[0059] According to some embodiments of the present invention, in S101, the actual network area of ​​the ship is divided into multiple blocks according to the network security area division principle. In the subsequent main assessment steps, each block network is used as the unit assessment object. Finally, all block networks are aggregated and analyzed to obtain the overall network security risk level of the ship.

[0060] According to some embodiments of the present invention, in S102, collecting all the necessary data for ship cybersecurity risk assessment includes:

[0061] (1) Collect a dataset of ship asset attributes through methods such as drawing verification, crew self-inspection, on-site inspection, service provider inspection, technical testing, and document review. The dataset mainly includes four categories: core shipboard control system (OT) assets, shipboard information technology system (IT) assets, shipboard integrated system assets, and infrastructure and logic assets, forming an asset list.

[0062] (2) Collect a ship network security assessment dataset from the above asset list through methods such as vulnerability scanning, penetration testing, document review, and on-site inspection. This dataset includes network architecture data, security configuration data, and vulnerability data. A vulnerability list is then created, and the severity of vulnerabilities in the ship's network is analyzed. .

[0063] According to some embodiments of the present invention, in S103, historically publicly available ship cybersecurity incidents are collected to construct a ship cybersecurity risk scenario database. Applicable risk scenarios are selected based on the actual needs of the current assessment, thereby forming the risk scenario database for this ship cybersecurity assessment, and the event impact value of each risk scenario is estimated. , probability of threat occurrence .

[0064] According to some embodiments of the present invention, in S104, the initial value of the unit risk under each risk scenario is calculated. and the average risk value of the unit .

[0065] According to some embodiments of the present invention, in S105, a dynamic risk model is constructed by introducing a dual-factor weighting of time and risk evolution. Calculations are performed based on this dual-factor weighted dynamic risk model to obtain the time-weighted risk and risk evolution values. Finally, the average of the two is taken as the risk value of the unit area network.

[0066] (1) Time factor: This factor considers the difference between marine engineering systems and traditional information system infrastructure. Once the systems, components, and related supporting infrastructure are officially put into use, they are not frequently iterated or modified, which directly leads to a significant extension of the repair cycle for vulnerabilities. Therefore, the derivative risks of vulnerability exposure time should be considered. Time factor weighting value. The schedule values ​​will be adjusted based on the assessor's subjective experience during the actual assessment process, taking into account the business continuity plan or vulnerability remediation management plan of the ship operator.

[0067] (2) Risk evolution factors, which aim to take into account the effectiveness of the safety measures actually implemented on the ship. However, since the risk cannot be completely eliminated, a residual risk constant needs to be subjectively defined by the assessors. This represents residual cybersecurity risks that cannot be completely eliminated even after implementing various security measures. Risk evolution factors include two important values: the residual risk constant will be adjusted by the assessor's subjective experience during the actual assessment process based on factors such as ship type, the severity of the risk scenario, and the impact of the event. The effectiveness of security measures is calculated by weighting the ratio of identified security measures to the security measures that should have been taken.

[0068] According to some embodiments of the present invention, in S106, the above calculation process is repeated for other unit area networks to obtain the risk values ​​of all unit area networks. The "maximum-minimum principle" (or "pessimistic criterion") is adopted, and the risk value of the largest unit area network is taken as the overall network security risk level of the ship.

[0069] like Figure 2 As shown, in one specific embodiment, the ship cybersecurity risk assessment method of this embodiment includes the following steps:

[0070] Step 1: Following the principles of network security zone division, the ship's actual network area is divided into multiple blocks. In subsequent major assessment steps, each individual block of the network will be used as the assessment object. Figure 3 For example, the following network blocks can be divided as evaluation objects: (1) integrated bridge network; (2) engine room control network; (3) crew entertainment network; (4) ship management network.

[0071] Step 2: Collect ship asset attribute data through methods such as drawing verification, crew self-inspection, on-site inspection, service provider inspection, technical testing, and document review. Collect a ship cybersecurity assessment dataset from the aforementioned asset list through methods such as vulnerability scanning, penetration testing, document review, and on-site investigation. This will identify multiple vulnerabilities, each with a corresponding vulnerability severity level. Each vulnerability may be exploited in multiple different risk scenarios simultaneously.

[0072] In practice, the vulnerability severity V can be directly mapped to the severity of the vulnerability, and is evaluated using the CVSS scoring standard, with a value range of [0,1]. The CVSS score ranges from 0 to 10. A higher score indicates a greater vulnerability threat, and V needs to be divided by 10 to keep it within the range of [0,1].

[0073] Step 3: Collect historical ship cybersecurity incidents from recent years through publicly available information channels such as incident reports from major classification societies worldwide (e.g., China Classification Society (CCS), American Bureau of Shipping (ABS), Det Norske Veritas (DNV), etc.) and media reports. This data will form a historical event database for analysis of risk scenarios. In specific assessment projects, applicable risk scenarios will be selected from the historical risk event database based on the ship's specific information. The impact level (I) and the probability of threat occurrence (P) for each risk scenario will be estimated. Detailed definitions and value methods are as follows:

[0074] (1) Risk scenarios. Risk scenarios are defined as threat factors in assets that may induce security incidents, such as: satellite communication interference, malicious software on crew terminals, unauthorized access to ship control systems, and tampering with ship IoT data.

[0075] (2) Impact Level I. The impact level is defined as the degree of negative impact that a security incident may cause. Further classifications and their value ranges, as well as examples, are as follows:

[0076] a. Safety impact [0,10], which directly affects the safety of ship navigation, such as personnel death / ship sinking (value 10), crew serious injury / ship out of control (value 9), partial function failure (value 6), non-critical equipment alarm (value 2), etc.

[0077] b. Environmental impact [0,10], negative impacts on the aquatic environment, mainly including pollution caused by cargo leakage in the cargo hold (value 9), ballast water pollution diffusion (value 7), and engine room waste oil diffusion pollution (value 4), etc.

[0078] c. Compliance impact [0,10], which may affect the issuance of compliance and safety certification by classification societies or other regulatory authorities, such as data / certification fraud (value 10), failure to implement safety measures (value 8), audit failure / classification society downgrade (value 6), etc.

[0079] d. Economic and reputational impact [0, 10], the economic and negative reputational losses caused by the safety incident, mainly including direct economic losses (e.g., 10 for a single incident involving tens of millions of US dollars, 5 for a single incident involving millions of US dollars). As well as accumulated losses from ship downtime (number of downtime days * 0.5) and reputational losses (8 for widespread global media coverage, 4 for notification and punishment within the maritime industry).

[0080] In estimating the impact of an event, safety impact, environmental impact, and compliance impact are the core factors, with economic and reputational impacts serving as additional correction factors. The calculation method is as follows:

[0081]

[0082] In practice, the values ​​of each factor are subjectively defined based on experience, and the measurable qualitative scales are referenced to three levels: high, medium, and low. For example, the subjective qualitative scales for safety impact are divided into: navigation interruption—high; reduced navigation efficiency—medium; navigation almost unaffected—low. Taking an incident of "oil tanker cargo control system being hacked and damaged, resulting in crude oil leakage" as an example, the calculation process for its safety event impact is as follows:

[0083] Safety impact: Damage to the cargo control system does not affect the overall navigation safety of the vessel, value 5;

[0084] Environmental impact: The crude oil spill caused serious marine water pollution, with a value of 9;

[0085] Compliance impact: Failure to take strict cybersecurity measures led to a security incident, with a value of 8;

[0086] Economic impact: Crude oil transportation is extremely valuable, and losses from cargo damage and accident handling are estimated in the tens of millions of US dollars, with a value of 10.

[0087] Reputational impact: The oil spill had a severe impact and was reported and exposed by global media, with a value of 8.

[0088] In summary, the calculation process is as follows: The result exceeded the limit, and the value was 10.

[0089] (3) Probability of Threat Occurrence P. The probability of a threat occurring is defined as the likelihood that a ship will face a threat. Further classifications and their ranges of values ​​(specific values ​​are subjectively defined based on experience) are shown in the following examples:

[0090] a. Historical event weight: The weight of the predicted probability of occurrence of security events based on historical events, i.e., [historical event frequency (such as IMO report data) * 0.4];

[0091] b. Navigation Status Weights: Navigation status affects the likelihood of a threat occurring, i.e., [0.2 for anchoring near shore, 0.6 for navigation on the high seas, and 0.8 for navigation in narrow waterways];

[0092] c. External threat level: For example, the US-CERT will issue relevant maritime alert levels, which can be used as a direct reference for the probability of external threats occurring, i.e. [External threat level (such as the activity level of maritime APT organizations) * 0.3].

[0093] After summing the above factors, P is normalized to (0,1) using the Sigmoid function. The calculation method is as follows:

[0094]

[0095] Step 4: Calculate the initial value of unit risk under each risk scenario. And the total risk value of the unit area. .

[0096] in, This represents the initial value of the unit risk for the j-th risk scenario. This indicates the severity of vulnerability. A vulnerability can correspond to multiple risk scenarios. In the calculation of a single risk scenario, the "maximum-minimum principle" can be adopted to select the highest vulnerability severity value for calculation. P indicates the degree of impact of the event, and P indicates the probability of the threat occurring. This represents the total risk value of a unit area. Within a unit area network, multiple risk scenarios can exist simultaneously, and their cumulative total value is used as the input parameter for subsequent dynamic two-factor weighted calculation.

[0097] Step 5: Introduce a weighted average of time and risk evolution factors to construct a dynamic risk model:

[0098] (1) The time factor weight is determined based on the existing BCP (Business Continuity Plan) or vulnerability management and remediation plan at the time of vessel assessment, and its value definition relies on the subjective experience of the assessors. Each unit risk initial value can correspond to a different time weight. Examples of the meanings represented by different predefined weight values ​​are as follows:

[0099] Time factor weighting value The value is (0,1). If the urgency of remediation is low, it can be considered as risk acceptance or discretionary handling, then it is defined as... =0.2; If the risk has a high urgency for repair and should be addressed as a priority, then define it as... =0.6, the risk urgency is the highest, the occurrence of a safety incident is almost inevitable, and it is defined as immediate handling before the ship sails. =1. The final time-weighted risk value can be obtained: .

[0100] (2) The weights of risk evolution factors include the effectiveness of safety measures identified during the assessment process. Residual risk constant C. Effectiveness of safety measures. This represents the ratio of implemented safety measures to required safety measures; the residual risk constant C represents the residual risk that cannot be completely eliminated regardless of the implemented safety measures. This is one of the fundamental characteristics of risk—that risk cannot be 100% eliminated. The value of the residual risk constant C also depends on the subjective experience of the assessors and is also an important factor used to adjust the accuracy of model calculations.

[0101]

[0102] The time-weighted risk and risk evolution values ​​are calculated based on a dynamic risk model that uses both time and risk evolution as weights, as follows:

[0103] Time-weighted risk value:

[0104] Risk evolution: Where C takes values ​​in the range of (0,1], and t is the time since the risk was discovered in the previous assessment, in months.

[0105] single area The dynamic two-factor weighted risk is:

[0106] in, This represents the time-weighted risk value. This represents the time factor weight for the j-th risk scenario. This represents the initial value of the unit risk for the j-th risk scenario. Indicates the risk evolution value. This represents the average risk value of the unit. Indicates the effectiveness of safety measures. represents the residual risk constant, and t represents the time since the risk was discovered in the previous risk assessment.

[0107] Step 6: Repeat the above calculation process for all other regional networks to obtain the dynamic two-factor weighted risk value of all regions. Adopt the "maximum-minimum principle" (or "pessimistic criterion") and take the maximum value as the overall risk value. This method also conforms to the "weakest link effect" in network security.

[0108] like Figure 4 As shown, this application also provides a ship cybersecurity risk assessment system 200 based on a dynamic risk model, comprising:

[0109] Block partitioning module 201 is used to divide the actual network area of ​​the ship into multiple blocks according to the network security area partitioning principle, with each block as an evaluation unit.

[0110] The vulnerability analysis module 202 is used to collect a ship asset attribute dataset to obtain an asset list, collect all the data required for ship cybersecurity risk assessment from the asset list to obtain a ship cybersecurity assessment dataset, determine a vulnerability list based on the ship cybersecurity assessment dataset, and analyze and determine the vulnerability severity corresponding to each vulnerability.

[0111] The risk scenario analysis module 203 is used to construct a ship network security risk scenario database based on historical ship network security incidents, select applicable risk scenarios for the current ship from the ship network security risk scenario database according to the actual needs of the current risk assessment, form a risk scenario database for the current ship network security assessment, and estimate the event impact and threat probability of each risk scenario in the risk scenario database.

[0112] The initial risk value calculation module 204 is used to calculate the initial unit risk value corresponding to each risk scenario based on the severity of the vulnerability, the impact of the event, and the probability of the threat occurring in each risk scenario, and to calculate the average unit risk value of all risk scenarios corresponding to the assessment unit.

[0113] The dynamic risk model construction module 205 is used to define time factor weights for the initial risk value of the unit corresponding to each risk scenario, and calculate the time-weighted risk value; define risk evolution dual-factor weights for the average risk value of the unit, and calculate the risk evolution value; and use the average of the time-weighted risk value and the risk evolution value as the risk value of the assessment unit to construct a dynamic risk model based on time factor and risk evolution dual-factor weighting; wherein, the risk evolution dual factors include the effectiveness of safety measures and residual risk constants found during the assessment process;

[0114] The cybersecurity risk assessment module 206 is used to calculate the risk value of each assessment unit and take the largest risk value as the current overall cybersecurity risk assessment value of the ship.

[0115] The ship cybersecurity risk assessment system of this invention applies the ship cybersecurity risk assessment method described above to construct a two-factor weighted dynamic risk model based on two dimensions, time factors, and risk evolution. By constructing a visual combination of the two dimensions of risk probability and impact, and combining time factors and risk evolution conditions to identify risks holistically, the system arranges risk response measures based on the ship cybersecurity risk assessment results. Risks and measures are linked through the dynamic risk model, assisting decision-makers in accurately identifying risks requiring priority handling and ensuring a relatively stable overall security risk status of the ship's network environment.

[0116] In one embodiment, a computer device is provided, such as Figure 5 As shown, it includes a memory 301, a processor 302, and a computer program stored on the memory 301 and executable on the processor 302. When the processor 302 executes the computer program, it implements the above-mentioned ship cybersecurity risk assessment method.

[0117] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0118] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that performs the above-described ship cybersecurity risk assessment method.

[0119] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0120] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0121] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for ship cyber security risk assessment based on dynamic risk model, characterized in that, The method comprises the following steps: According to the network security area division principle, the actual network area of the ship is divided into multiple blocks, and a single block is taken as an evaluation unit; Collecting a ship asset attribute data set, obtaining an asset list, collecting all-factor data required for ship network security risk assessment in the asset list, obtaining a ship network security evaluation data set, determining a list of vulnerable items according to the ship network security evaluation data set, and analyzing and determining the vulnerability severity corresponding to each vulnerable item; According to historical ship network security events, a ship network security risk scenario database is constructed, a risk scenario applicable to the current ship is screened out from the ship network security risk scenario database according to the actual needs of the current risk assessment, a risk scenario database for the current ship network security evaluation is formed, and the event impact degree and threat occurrence probability of each risk scenario in the risk scenario database are estimated; According to the vulnerability severity corresponding to each risk scenario, the event impact degree and the threat occurrence probability, the unit risk initial value corresponding to each risk scenario is calculated, and the unit average risk value of all risk scenarios corresponding to the evaluation unit is calculated; The time factor weight is defined for the unit risk initial value corresponding to each risk scenario respectively, and the time weighted risk value is calculated; The risk evolution double-factor weight is defined for the unit average risk value, and the risk evolution value is calculated; The mean value of the time weighted risk value and the risk evolution value is taken as the risk value of the evaluation unit, and a dynamic risk model based on time factor and risk evolution double-factor weighting is constructed; wherein the risk evolution double-factor includes the effectiveness of security measures found in the evaluation process and the residual risk constant; The risk value of each evaluation unit is calculated, and the maximum risk value is taken as the network security risk evaluation value of the current ship as a whole; The risk evolution value is calculated by the following formula: wherein, represents the risk evolution value, represents the unit average risk value, represents the security measure effectiveness, represents the residual risk constant, t represents the time since the last round of risk assessment found the risk.

2. The ship cyber security risk assessment method according to claim 1, characterized in that, The ship asset attribute data set includes core shipborne control system assets, airborne information technology system assets, ship integration system assets, and infrastructure and logic assets, and the asset list is obtained.

3. The ship cyber security risk assessment method of claim 1, wherein, The event influence in the event influence degree includes safety influence, environmental influence, compliance influence, economic and reputation influence; when estimating the event influence degree of each risk scenario, taking the safety influence, environmental influence and compliance influence as core factors, and taking the economic and reputation influence as superimposed correction factors, the event influence degree of each risk scenario is calculated by the following formula : 。 4. The ship cyber security risk assessment method of claim 1, wherein, The factors in the threat occurrence probability include historical event frequency, sailing state weight and external threat level; the threat occurrence probability P of each risk scenario is calculated by the following formula: 。 5. The ship cyber security risk assessment method of claim 1, wherein, The unit risk initial value corresponding to each risk scenario is calculated by the following formula: wherein, represents the unit risk initial value of the jth risk scenario, represents the vulnerability severity, represents the event impact degree, and P represents the threat occurrence possibility.

6. The ship cyber security risk assessment method of claim 1, wherein, The time weighted risk value is calculated by the following formula: wherein, represents a time-weighted risk value, represents a time factor weight of the jth risk scenario, represents a unit risk initial value of the jth risk scenario.

7. A ship cyber security risk assessment system based on dynamic risk model, characterized in that, The method comprises the following steps: The block division module is used for dividing the actual network area of the ship into multiple blocks according to the network security area division principle, and taking a single block as an evaluation unit; The vulnerable item analysis module is used for collecting a ship asset attribute data set, obtaining an asset list, collecting all-factor data required for ship network security risk assessment in the asset list, obtaining a ship network security evaluation data set, determining a list of vulnerable items according to the ship network security evaluation data set, and analyzing and determining the vulnerability severity corresponding to each vulnerable item; a risk scenario analysis module, configured to construct a ship network security risk scenario database according to historical ship network security events, to screen out a risk scenario applicable to a current ship from the ship network security risk scenario database according to actual requirements of a current risk assessment, to form a risk scenario database for the current ship network security assessment, and to estimate an event influence degree and a threat occurrence possibility of each risk scenario in the risk scenario database; a risk initial value calculation module, configured to calculate a unit risk initial value corresponding to each risk scenario according to a vulnerability severity of a vulnerable item corresponding to each risk scenario, the event influence degree and the threat occurrence possibility, and to calculate a unit average risk value of all risk scenarios corresponding to the assessment unit; a dynamic risk model construction module, configured to define a time factor weight for the unit risk initial value corresponding to each risk scenario, to calculate a time-weighted risk value, to define a risk evolution double-factor weight for the unit average risk value, to calculate a risk evolution value, and to construct a dynamic risk model based on time factor and risk evolution double-factor weighting by taking an average of the time-weighted risk value and the risk evolution value as a risk value of the assessment unit; wherein the risk evolution double-factor includes a security measure effectiveness found in an assessment process and a residual risk constant; a network security risk assessment module, configured to calculate a risk value of each assessment unit and to take a maximum risk value as a network security risk assessment value of the current ship as a whole; wherein the risk evolution value is calculated by the following formula: the processor implements the ship network security risk assessment method in any one of claims 1 to 6 when executing the computer program. the computer readable storage medium stores the computer program for implementing the ship network security risk assessment method in any one of claims 1 to 6. wherein, represents the risk evolution value, represents the unit average risk value, represents the security measure effectiveness, represents the residual risk constant, t represents the time since the last round of risk assessment found the risk.

8. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, the computer readable storage medium stores the computer program for implementing the ship network security risk assessment method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, ​

Images