Cross-domain threat prediction method based on vulnerability analysis and related equipment

Abstract

The invention discloses a cross-domain threat prediction method based on vulnerability analysis and related equipment, and the method comprises the steps: obtaining a network connection graph and first vulnerability information, carrying out the integration of the network connection graph and the first vulnerability information, and generating the input data of an attack graph generation tool; obtaining a PLC control logic, and generating a target dependency graph according to the PLC control logic; obtaining a logic node according to the target dependency graph; mapping the logic node to a field device in an industrial control system to obtain an attack target; generating an attribute attack graph through the attack graph generation tool according to a preset initial position of an attacker, the attack target and the input data; and extracting a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result. The method can improve the accuracy of cross-domain threat prediction, and can be widely applied to the technical field of network security and industrial control system security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security and industrial control system security, and in particular to a cross-domain threat prediction method based on vulnerability analysis and related equipment. BACKGROUND

[0002] Industrial control systems are generally composed of upper computers such as engineering stations, industrial control devices such as controllers, bottom layer devices such as sensors and brakes, and industrial control networks. In the system, the industrial control devices undertake the task of receiving instructions and codes from the upper computers, and cyclically execute the control logic preset by the user, and finally deliver the processed instructions to the bottom layer devices to perform corresponding operations. Traditional industrial control systems are often physically isolated from the external environment, making it difficult for attackers to penetrate into the industrial control network, so security measures are not fully considered in the initial design.

[0003] With the gradual access of industrial control systems to the Internet and other communication networks, and the evolution from the traditional closed and isolated state to the new stage of intelligentization and networking, the industrial control system infrastructure gradually covers the information domain and the function domain, and there is a spatial and logical association between different information systems and between the information domain and the control system. This association makes the security threats to industrial control assets exhibit cross-domain propagation characteristics.

[0004] Attacks on industrial control systems mainly focus on the process monitoring layer, the field control layer, and the field device layer. The academic community's research on these attacks mainly focuses on the internal network environment of industrial control systems, and the vulnerability and threat analysis is also mainly carried out in the isolated information domain, without fully considering the cross-domain threats caused by the vulnerabilities of each domain, and lacking the mining of the correlation between vulnerabilities, making it difficult to effectively discover potential attack risks. Traditional scholars often consider industrial control protection from the perspective of the defender, and defend by detecting abnormalities in specific parameters and configurations of industrial control systems, such as establishing models based on traffic statistical characteristics, time series, etc., performing anomaly analysis from the perspectives of programmable logic controller (PLC) key parameters, sensor data, protocols, etc., and setting rules based on system behavior, physical watermark, etc., forming a unique device fingerprint from the host side, and then performing anomaly analysis on the current device and behavior. The above defense methods all use the characteristics of attacks that have occurred to detect unknown attacks, and are helpless when facing highly customized attacks. SUMMARY

[0005] Therefore, the embodiments of the present application mainly aim to provide a cross-domain threat prediction method based on vulnerability analysis and related equipment, in order to solve at least one of the problems in the prior art, and the present application can improve the accuracy of cross-domain threat prediction.

[0006] To achieve the above object, one aspect of the embodiment of the present application provides a cross-domain threat prediction method based on vulnerability analysis, which comprises the following steps:

[0007] obtaining a network connection graph and first vulnerability information, and integrating the network connection graph and the first vulnerability information to generate input data of an attack graph generation tool;

[0008] obtaining PLC control logic and generating a target dependency graph according to the PLC control logic;

[0009] obtaining a logic node according to the target dependency graph;

[0010] mapping the logic node to a field device in an industrial control system to obtain an attack target;

[0011] generating an attribute attack graph by the attack graph generation tool according to a pre-set starting position of an attacker, the attack target and the input data;

[0012] extracting a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result.

[0013] In some embodiments, the step of obtaining the network connection graph and the first vulnerability information comprises the following steps:

[0014] extracting first network topology information of a network management infrastructure by a firewall management tool;

[0015] obtaining second network topology information and device information by active scanning and passive listening;

[0016] fusing and associating the first network topology information and the second network topology information to generate the network connection graph;

[0017] configuring a vulnerability scanning tool according to the network connection graph and the device information;

[0018] obtaining a scanning report by the vulnerability scanning tool;

[0019] completing the scanning report to obtain the first vulnerability information.

[0020] In some embodiments, the step of completing the scanning report to obtain the first vulnerability information comprises the following steps:

[0021] analyzing the scanning report to obtain a vulnerability item list;

[0022] extracting initial vulnerability items in the vulnerability item list when the vulnerability item list is not empty;

[0023] Parallel query is performed on the CVE number and the NVD database to obtain second vulnerability information;

[0024] According to the initial vulnerability item and the second vulnerability information, it is judged whether there is a vulnerability information conflict, if there is a vulnerability information conflict, third vulnerability information is output, and the third vulnerability information is processed by removing duplication and removing redundant information, and the target vulnerability item of the first vulnerability information is output, if there is no vulnerability information conflict, the initial vulnerability item is processed by removing duplication and removing redundant information, and the target vulnerability item of the first vulnerability information is output.

[0025] In some embodiments, the PLC control logic is obtained, including the following steps:

[0026] An XML file of the PLC programming language in the industrial control system is obtained;

[0027] The XML file is parsed to obtain an XML tag;

[0028] According to the XML tag, a logic element tag corresponding to the PLC programming language of different types is identified;

[0029] The PLC control logic in the logic element tag is extracted.

[0030] In some embodiments, the target dependency graph is generated according to the PLC control logic, including the following steps:

[0031] An XML file of the PLC programming language in the industrial control system is obtained;

[0032] The accessed program variables in the XML file are obtained;

[0033] Through the taint analysis method, the sensor variable of the PLC control logic is taken as a source point of a taint, and the brake variable of the PLC control logic is taken as a sink point of the taint;

[0034] According to the source point and the sink point, the propagation process of the taint between the program variables is tracked to obtain a dependency relationship between the program variables;

[0035] According to the dependency relationship, a data dependency graph is generated;

[0036] According to the type of the PLC programming language, the PLC control logic is converted into a target code block;

[0037] According to the execution relationship between the target code blocks, a control dependency graph is generated;

[0038] The target dependency graph comprises the data dependency graph and the control dependency graph.

[0039] In some embodiments, the acquiring the logic node according to the target dependency graph comprises the following steps.

[0040] constructing a dependency subgraph of each of the sink points according to the data dependency graph;

[0041] acquiring a stable dependency path of each of the dependency subgraphs according to device historical operation data;

[0042] acquiring a required brake node for the attack according to the device historical operation data, the attack purpose and the control dependency graph;

[0043] acquiring a required sensor node for the attack according to the dependency subgraph;

[0044] The logic node comprises the required brake node for the attack and the required sensor node for the attack.

[0045] In some embodiments, the extracting the target attack path according to the attribute attack graph to obtain the cross-domain threat prediction result comprises the following steps.

[0046] acquiring a vulnerability value, an attack cost, an attack benefit and a vulnerability age decay factor of an attack node of the attribute attack graph;

[0047] acquiring an atomic attack probability value of the attack node according to the vulnerability value, the attack cost, the attack benefit and the vulnerability age decay factor;

[0048] performing structural conversion on the attribute attack graph containing a loop through a least privilege set and a depth-first traversal method to obtain a loop-free attack graph;

[0049] acquiring a path probability of an initial attack path in the loop-free attack graph according to the atomic attack probability value;

[0050] selecting the initial attack path corresponding to the maximum path probability as the target attack path to obtain the cross-domain threat prediction result.

[0051] To achieve the above object, another aspect of the embodiment of the present application proposes a cross-domain threat prediction device based on vulnerability analysis, which comprises:

[0052] a first attack graph construction module, configured to acquire a network connection graph and first vulnerability information, integrate the network connection graph and the first vulnerability information, and generate input data of an attack graph generation tool;

[0053] A dependency graph construction module is configured to acquire PLC control logic and generate a target dependency graph according to the PLC control logic;

[0054] A dependency graph processing module is configured to acquire a logic node according to the target dependency graph;

[0055] A node mapping module is configured to map the logic node to a field device in an industrial control system to obtain an attack target;

[0056] A second attack graph construction module is configured to generate an attribute attack graph according to a pre-set starting position of an attacker, the attack target and the input data by using the attack graph generation tool;

[0057] An attack graph processing module is configured to extract a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result.

[0058] To achieve the above object, another aspect of the embodiment of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0059] To achieve the above object, another aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0060] To achieve the above object, another aspect of the embodiment of the present application provides a computer program product or a computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute the method described above.

[0061] The embodiments of the present application at least have the following beneficial effects: the present application provides a cross-domain threat prediction method based on vulnerability analysis and related equipment, the scheme obtains a network connection graph and first vulnerability information, integrates the network connection graph and the first vulnerability information, generates input data of an attack graph generation tool, obtains PLC control logic, and generates a target dependency graph according to the PLC control logic, realizing cross-domain threat analysis from a dependency graph to an attack graph, according to the target dependency graph, obtains a logic node, maps the logic node to a field device in an industrial control system to obtain an attack target, through the attack graph generation tool, generates an attribute attack graph according to a pre-set starting position of an attacker, the attack target and the input data, realizes effective association of cross-domain data, and overcomes the limitation of the prior art of analyzing only in a single domain, according to the attribute attack graph, extracts a target attack path to obtain a cross-domain threat prediction result, and improves the accuracy of cross-domain threat prediction. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced, and obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the premise of the drawings.

[0063] Figure 1 is a flowchart of the cross-domain threat prediction method based on vulnerability analysis provided by the embodiments of the present application;

[0064] Figure 2 is a schematic diagram of a vulnerability information completion process provided by the embodiments of the present application;

[0065] Figure 3 is a schematic diagram of a dependency graph processing and logic node obtaining process provided by the embodiments of the present application;

[0066] Figure 4 is a schematic diagram of an attack graph processing and cross-domain attack path identification process provided by the embodiments of the present application;

[0067] Figure 5 is a schematic diagram of a cross-domain threat prediction model based on vulnerability analysis provided by the embodiments of the present application;

[0068] Figure 6 is a hardware structure schematic diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0069] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application, but are only examples of devices and methods consistent with some aspects of the embodiments of the present application as described in the appended claims.

[0070] It should be noted that although the functional modules are divided in the system schematic diagram, the logical sequence is shown in the flowchart, but in some cases, the steps shown or described can be performed in a manner different from the module division in the system or the sequence in the flowchart. The terms "first / S100", "second / S200" in the specification and claims and the above drawings can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information, without departing from the scope of the embodiments of the present application. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0071] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0073] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0074] Attack graph, a graphical analysis tool, is widely used to describe possible vulnerabilities of computer systems and strategies taken by attackers to invade systems.

[0075] MulVAL (multihost, multistage, vulnerability analysis) is a multi-host, multi-stage attack graph generation tool based on logical reasoning. It can simulate the process of attackers exploiting vulnerabilities and identify potential security risks in network systems.

[0076] Vulnerability refers to weaknesses or flaws in a system that can be exploited by attackers, posing a threat to the system's security. Vulnerability correlation refers to the relationship or causality between different vulnerabilities. Vulnerabilities in a system are not isolated and may interact with each other.

[0077] Nmap (Network Mapper) is a network security scanning tool. It can be used for network host discovery, port scanning, service version detection, and operating system detection.

[0078] SNMP (Simple Network Management Protocol) is an application layer protocol used for remote monitoring and management of network devices such as routers, switches, and servers.

[0079] GRASSMARLIN is an industrial control system (ICS) passive network mapping tool. It identifies SCADA / ICS devices such as PLCs and HMIs by listening to network traffic (rather than active scanning), draws network topology diagrams, and analyzes industrial protocols such as Modbus and DNP3.

[0080] Nessus is a professional vulnerability scanning and analysis tool, mainly used to identify security vulnerabilities, misconfigurations, and potential threats in network devices, operating systems, and applications.

[0081] CVE (Common Vulnerabilities and Exposures) is a global vulnerability identifier system that assigns a standardized number to each publicly disclosed security vulnerability.

[0082] CVSS (Common Vulnerability Scoring System) is a vulnerability risk quantification standard that assesses the severity of vulnerabilities through scores (0.0-10.0) and levels (low / medium / high / severe).

[0083] NVD (National Vulnerability Database) is a national vulnerability database and one of the most authoritative vulnerability information libraries in the world.

[0084] Datalog is a declarative query language based on logic programming, which is a subset of Prolog designed for database reasoning and knowledge representation. The fact statement of Datalog language refers to the direct declaration of atomic facts that are unconditionally true, similar to static data records in a database. The logical rule of Datalog language refers to the generation of new facts from existing facts through logical derivation, in the form of conclusion predicate (X):-condition predicate 1(X), condition predicate 2(X), which means that if 2(X) is true, then 1(X) is true.

[0085] PLC (Programmable Logic Controller) is the core equipment of industrial automation control system, designed for industrial environment, used to control machinery, production line and manufacturing process.

[0086] XML (eXtensible Markup Language) is a markup language used to store and transmit structured data, with the core features of customizable tags and cross-platform compatibility.

[0087] Attack path refers to the sequence set formed by attackers targeting specific targets by exploiting all assets and vulnerabilities in the system, which can clearly reveal the attack dependency relationship between asset nodes.

[0088] The existing technology has the following main shortcomings in the prediction of attack path of industrial control system (ICS):

[0089] (1) Insufficient cross-domain

[0090] The prior art is mainly focused on single-domain analysis, limited to information domain or function domain, and lacks the ability to analyze cross-domain attack paths from the Internet to the internal environment of industrial control systems, resulting in the inability to fully predict the complete penetration path of attackers. Among them, the method of using Bayesian network to quantify the nodes and paths in the constructed attack graph to predict the probability of attack path only considers the information domain, and the data sources are mainly based on the network topology graph obtained by host scanning (Nessus) and the vulnerability information in NVD (National Vulnerability Database). The attack graph formed by this method is suitable for attack path prediction in the Internet, but lacks analysis of complex data interaction of network devices in industrial control environment, and is difficult to perform defense tasks for industrial control network, and the prediction accuracy of potential attack paths in industrial control environment is insufficient. The existing industrial control system attack detection method based on state awareness identifies the state, state transition and dependency relationship of state variables of ICS through static analysis, mines code-level invariant templates, and identifies system state based on the invariant templates to determine attack behavior. The problem is that this method is from the perspective of the defender, only analyzes the state of PLC devices and the dependency relationship between variables in the function domain, and can only detect attack behavior but cannot predict attack path, and cannot backtrack the attack means of the attacker.

[0091] (2) The depth of industrial process analysis is insufficient

[0092] The prior art lacks in-depth analysis of industrial processes in industrial control system security analysis. The existing method of generating an attack graph based on network topology and device vulnerability information to evaluate the security of the system, however, does not involve analysis of the industrial process itself, especially the control logic in PLC. This lack results in the inability to fully assess the impact of attacks on physical processes, which are often the ultimate goal of industrial control system attacks. Attackers may interfere with production processes by manipulating control logic, causing safety incidents or economic losses. Therefore, the security measurement results may not accurately reflect the true risk of system operation integrity, limiting their application value in actual industrial environments.

[0093] (3) Difficulty in code analysis

[0094] Existing technologies for analyzing PLC control logic mostly rely on compiled binary programs, which are then disassembled into assembly code for further analysis. However, this reverse engineering method suffers from high analysis time costs and complex processes due to the lack of relevant comments and complete system information. Furthermore, in complex industrial control environments, control logic programs often need to be written in multiple languages, including both graphical and text-based languages. Existing source code-based analysis methods only support a limited number of PLC programming languages, making it difficult to analyze complex PLC code in practical applications.

[0095] In view of this, such as Figure 1 As shown, this embodiment of the invention provides a cross-domain threat prediction method based on vulnerability analysis, which may include, but is not limited to, steps S100 to S600:

[0096] Step S100: Obtain the network connection diagram and the first vulnerability information, and integrate the network connection diagram and the first vulnerability information to generate input data for the attack diagram generation tool;

[0097] Step S200: Obtain the PLC control logic and generate a target dependency graph based on the PLC control logic;

[0098] Step S300: Obtain logical nodes based on the target dependency graph;

[0099] Step S400: Map the logical node to the field device in the industrial control system to obtain the attack target;

[0100] Step S500: Using an attack graph generation tool, an attribute attack graph is generated based on the preset attacker's starting position, attack target, and input data.

[0101] Step S600: Extract the target attack path based on the attribute attack graph to obtain the cross-domain threat prediction result.

[0102] In steps S100 to S600 of some embodiments, by combining attack graph construction technology based on vulnerability association and dependency graph construction method for programmable control logic, an attack graph covering information systems and control systems is constructed, establishing the relationship between vulnerabilities inside and outside the domain. At the same time, a dependency graph is constructed using a programmable control logic program analysis method based on taint analysis, establishing data and control dependencies in industrial field operations, realizing cross-domain attack path analysis from the Internet to the inside of the industrial control system, thereby improving the ability to respond to network security and industrial control system security threats.

[0103] In step S100 of some embodiments, based on the vulnerability association, input data of the attack graph generation tool is generated, mainly by integrating network topology and vulnerability information, realizing information domain threat prediction, and then generating an attack graph covering the information system and the control system in the subsequent process.

[0104] In some embodiments, in the step of acquiring the network connection graph and the first vulnerability information, steps S101 to S106 can be included, but are not limited to:

[0105] In step S101, network topology information extraction operation is performed on the network management infrastructure through the firewall management tool to obtain the first network topology information.

[0106] In step S102, the second network topology information and the device information are acquired through active scanning and passive listening.

[0107] In step S103, the first network topology information and the second network topology information are fused and associated to generate a network connection graph.

[0108] In step S104, the vulnerability scanning tool is configured according to the network connection graph and the device information.

[0109] In step S105, the scanning report is acquired through the vulnerability scanning tool.

[0110] In step S106, the scanning report is completed to obtain the first vulnerability information.

[0111] In step S101 of some embodiments, based on the network topology extraction of the firewall management tool, the first network topology information is extracted from the existing network management infrastructure to reduce the demand for active detection of the network. Optionally, the firewall configuration is acquired securely through the management interface (API and SSH), the security policy rule set is parsed, the network interconnection relationship is constructed, and the first network topology information is obtained.

[0112] In step S102 of some embodiments, since the firewall rules may have problems such as rule invalidation, real-time second network topology information needs to be acquired to solve such problems. For the characteristics of the industrial control system, a non-intrusive and low-load scanning method is designed, i.e., Nmap and SNMP are used for scanning during periods of low load of the industrial control system, avoiding key production cycles. At the same time, the GRASSMARLIN tool is deployed at key network nodes to passively detect and monitor the topology of the industrial control system in real time, and the second network topology information and the device information are adaptively acquired by combining active scanning and passive listening methods.

[0113] In some optional embodiments, for the convenience of subsequent configuration of the Nessus vulnerability scanning tool, successful acquisition of vulnerability information also needs to read the host scanning results and device information in the system configuration file, extract the device type, device model and system version. At the same time, the firewall configuration is read through the management interface and the system configuration file is obtained. The firewall configuration and the system configuration file are fused to build a network management strategy.

[0114] In step S103 of some embodiments, the first network topology information in the firewall rule, the scanning results of Nmap and SNMP and the detection results of the GRASSMARLIN tool are fused and associated, that is, the first network topology information and the second network topology information are fused and associated, so as to obtain complete network reachability information and build a complete network connection graph. Exemplarily, G net = (V net , E net ) represents a network connection graph, V net represents a node set, and E net represents a connection relationship.

[0115] In steps S104 to S105 of some embodiments, according to the network connection graph and the obtained system device information, the Nessus vulnerability scanning tool is configured, and a security scanning strategy is performed on each node in the network connection graph, that is, different scanning means are taken according to different device types, and the collection of vulnerability information is completed. For industrial control system devices, the vulnerability scanning takes measures such as avoiding key industrial process time periods, reducing scanning concurrency and avoiding sending detection packets that may trigger abnormal industrial control devices, while for general Internet devices, normal vulnerability scanning is performed, and finally a scanning report containing CVE number, vulnerability description and CVSS score is obtained.

[0116] In step S106 of some embodiments, the vulnerability information in the scanning report is mapped and matched with CVE and NVD, to ensure the consistency of the vulnerability identification and to complete the supplement of the vulnerability related information.

[0117] In some embodiments, step S106 can include but is not limited to steps S1061 to S1064:

[0118] Step S1061, the scanning report is parsed to obtain a vulnerability item list;

[0119] Step S1062, when the vulnerability item list is not empty, the initial vulnerability item in the vulnerability item list is extracted;

[0120] Step S1063, the CVE number is queried in parallel with the NVD database to obtain second vulnerability information;

[0121] Step S1064, according to the initial vulnerability item and the second vulnerability information, it is judged whether there is a conflict of vulnerability information, if there is a conflict of vulnerability information, the third vulnerability information is output, and the third vulnerability information is processed to remove the redundant information, and the target vulnerability item of the first vulnerability information is output, if there is no conflict of vulnerability information, the initial vulnerability item is processed to remove the redundant information, and the target vulnerability item of the first vulnerability information is output.

[0122] As shown in the step of supplementing the complete vulnerability related information, Figure 2 the Nessus generated scan report is analyzed first, and the initial vulnerability item list M={V1, V2, …, V n} is extracted. Then the initial vulnerability item V i is extracted in a loop until the initial vulnerability item list is empty, and the extraction of the initial vulnerability item is stopped. For each extracted initial vulnerability item V i , subsequent processing is performed respectively, and the target vulnerability item of each first vulnerability information is generated, and finally the uniform first vulnerability information set M ′ is output according to the set composed of each target vulnerability item. In the process of subsequent processing of the initial vulnerability item, the CVE number and the NVD database are queried in parallel to obtain detailed second vulnerability information, and according to the initial vulnerability item and the second vulnerability information, it is judged whether there is a conflict of vulnerability information, if there is a conflict of vulnerability information, the maximum value of the CVSS (V i ) score is taken, and the third vulnerability information with NVD description as the main part and additional CVE description is output, and the third vulnerability information is processed to remove the redundant information, and the third vulnerability information processed to remove the redundant information is output as the target vulnerability item of the first vulnerability information, if there is no conflict of vulnerability information, the initial vulnerability item is processed to remove the redundant information, and the initial vulnerability item processed to remove the redundant information is output as the target vulnerability item of the first vulnerability information. Optionally, in the actual execution process, if any of the following conditions exists, it is considered that there is a conflict of vulnerability information:

[0123] CVSS score inconsistency: the CVE database gives the CVSS v3 base score as 7.5, and the NVD is 8.1;

[0124] The initial vulnerability item and the second vulnerability information have obvious differences in the vulnerability description content: the expressions of the attack path, the utilization condition, the affected component and other fields in the two descriptions are inconsistent;

[0125] The vulnerability classification (such as “buffer overflow” and “privilege escalation”) or the vulnerability affected component list has field conflict or omission.

[0126] In some embodiments, the network connection graph and the first vulnerability information are integrated to generate input data of an attack graph generation tool. Illustratively, the network connection graph, the network management policy and the first vulnerability information are obtained and converted into fact statements or logical rules in Datalog language as input data of the attack graph generation tool (MulVAL).

[0127] The input data is then passed to a reasoning engine built in the MulVAL tool for derivation analysis of attack paths. After the derivation process is completed, a visualization module receives attack tree data generated by the reasoning engine to generate an attack graph covering the information system and the control system.

[0128] In step S200 of some embodiments, in a target dependency graph construction method for programmable control logic, to solve the problem of unclear internal data relationship of an industrial control system, data dependency and control dependency relationship of the PLC control logic are obtained through analysis of the PLC control logic to construct a corresponding dependency graph.

[0129] In some embodiments, the step of obtaining the PLC control logic can include but is not limited to steps S201 to S204:

[0130] Step S201, obtaining an XML file of a PLC programming language in an industrial control system;

[0131] Step S202, parsing the XML file to obtain XML tags;

[0132] Step S203, identifying logical element tags corresponding to different types of PLC programming languages according to the XML tags;

[0133] Step S204, extracting the PLC control logic in the logical element tags.

[0134] In step S201 of some embodiments, first, an XML file of a PLC programming language including multiple different types of PLC programming languages in an industrial control system is obtained. Common PLC programming languages in an industrial control system usually include sequential function chart (SFC), ladder diagram (LD), structured text (ST) and function block diagram (FBD) four main types. These project files written by different types of programming languages can be exported as standard XML format files.

[0135] In steps S202 to S204 of some embodiments, after completing the XML file parsing, the XML tags representing programs and routines such as Program and Routine are identified, and then according to different PLC programming language types, corresponding logical element tags are identified, and PLC control logic including variable names, operators, instruction types, etc. is extracted from these logical element tags, which will serve as the basis data for building the dependency graph.

[0136] In some embodiments, the step of generating a target dependency graph according to PLC control logic can include but is not limited to steps S211 to S217:

[0137] Step S211, obtaining an XML file of a PLC programming language in an industrial control system;

[0138] Step S212, obtaining accessed program variables in the XML file;

[0139] Step S213, using the taint analysis method, taking sensor variables of the PLC control logic as source points of taint, and taking actuator variables of the PLC control logic as sink points of taint;

[0140] Step S214, tracking the propagation process of taint between program variables according to the source points and sink points to obtain the dependency relationship between the program variables;

[0141] Step S215, generating a data dependency graph according to the dependency relationship;

[0142] Step S216, converting the PLC control logic into target code blocks according to the type of the PLC programming language;

[0143] Step S217, generating a control dependency graph according to the execution relationship between the target code blocks;

[0144] The target dependency graph includes the data dependency graph and the control dependency graph.

[0145] In step S211 of some embodiments, the XML file of the industrial control system includes multiple different types of PLC programming languages.

[0146] In step S212 of some embodiments, after extracting the PLC control logic, the accessed program variables in the XML file are mapped to nodes in the data dependency graph. The program variable information includes variable definition and variable reference. The variable definition is usually located under the Tags or Variables tag and contains variable name, data type, initial value, etc. The variable reference is scattered in each control logic element.

[0147] In steps S213 to S215 of some embodiments, the extracted PLC control logic is parsed using a taint analysis method to construct a corresponding data dependency graph. The taint analysis method is a widely used security detection technique in the field of code analysis, and its main purpose is to track the propagation path and processing method of sensitive data within a program in detail, so as to identify potential security vulnerabilities and related risks.

[0148] Exemplarily, in the framework of the PLC control logic program, the input and output can generally be divided into two categories: sensor variables and actuator variables. By implementing the taint analysis method, the sensor variables can be used as the source of the taint, and the actuator variables can be used as the sink of the taint. The propagation process of the taint between the program variables can be tracked effectively, and the propagation path of the taint can be analyzed in depth to obtain the dependency relationship between the program variables. The dependency relationship between the program variables usually presents two different association forms, which correspond to the so-called explicit flow and implicit flow in the field of program analysis. The explicit flow is a strong influence relationship, which usually represents that the value of one variable directly affects another variable through direct assignment or operation. Therefore, a strong link is created for this type of node using a solid arrow, such as the output of one function block connected to the input of another function block in a function block diagram, which is similar to an assignment operation. The implicit flow is a weak influence relationship, which usually represents that the execution condition of one variable depends on the value of another variable, which is similar to a control statement or function call relationship. Therefore, a weak link is created for this type of node using a dashed arrow, such as the contact state of the same ladder input coil indirectly affecting the value of the output coil in a ladder diagram, which is a weak influence relationship. According to this characteristic, the codes of four major PLC programming languages (sequential function chart, ladder diagram, structured text, and function block diagram) are analyzed respectively, and the corresponding data dependency graphs are generated based on the explicit flow and implicit flow operations.

[0149] In steps S216 to S217 of some embodiments, by obtaining the program organization information contained in the Routine tag of the XML file, the extracted PLC control logic is converted into code blocks for each subroutine, and a control dependency graph is generated according to the execution order of the code blocks. For example, the control dependency graph uses code blocks as basic elements, and the control logic written in different programming languages ​​is represented in text form within the code blocks. After extracting the PLC control logic, it needs to be converted into code blocks according to the PLC programming language type. For example, for a ladder diagram program, each ladder level will be a basic code block; similarly, for a function block diagram, each function block will be a code block; for structured text, its functions will be a code block; and for a sequential function chart, operations (Actions) and transition conditions (Transitions) will be used as basic code blocks. Next, directed edges are constructed according to the execution relationship between the code blocks. These directed edges represent the control dependency relationship between the code blocks, meaning that the execution of one code block is controlled by the execution result of another code block. Typically, the execution relationship between code blocks is mainly reflected in sequential execution or control paths defined by control flow structures such as conditional branches, loops, and jumps. Therefore, the construction of directed edges between code blocks depends on the different execution relationships, and a corresponding control dependency graph can be generated accordingly.

[0150] In steps S300 to S600 of some embodiments, during the attack path analysis process based on attack graphs and dependency graphs, by establishing the mapping relationship between sensor variables and real devices in the dependency graph, data association analysis from the functional domain to the information domain is realized, thereby conducting in-depth research on cross-domain attack paths.

[0151] In some embodiments, such as Figure 3 As shown, step S300 may include, but is not limited to, steps S301 to S304:

[0152] Step S301: Based on the data dependency graph, construct a dependency subgraph for each aggregation point;

[0153] Step S302: Obtain the stable dependency paths of each dependency subgraph based on the historical operating data of the device;

[0154] Step S303: Based on the device's historical operating data, the attack objective, and the control dependency graph, obtain the actuator node required for the attack;

[0155] Step S304: Obtain the sensor nodes required for the attack based on the dependency subgraph;

[0156] The logical nodes include the actuator nodes required for the attack and the sensor nodes required for the attack.

[0157] In step S301 of some embodiments, based on the generated data dependency graph, all sinks in the graph are added to a queue, and the sinks are traversed forward until the sources, obtaining dependency subgraphs with each sink as the root. Exemplarily, the generated dependency subgraph is generally G=(V∪E), where the set V is a set of device nodes in the dependency subgraph, and the set E is a set of directed edges in the dependency subgraph, including strong links E strong corresponding to explicit flows and weak links E weak corresponding to implicit flows, and is expressed as E=(E strong ∪E weak ).

[0158] In some embodiments, while the dependency subgraph is being constructed, historical running data of each device collected by the host computer is obtained. For example, for a node v i , the output value sequence in one scan cycle is , and the output value sequence in N scan cycles can be expressed as K(v i )={M1(v i ),M2(v i ),...,M N (v i )}, and then the historical running data is processed and divided using a method of identifying the state of a node based on the type of variable, to identify the state of the node in each dependency subgraph. The variable value of the node can be discrete or continuous. For a discrete variable, such as a Boolean variable, the state of the node is directly defined by the inherent discrete value. For a continuous variable, such as a physical quantity such as temperature, the method divides the continuous range of the variable into multiple discrete intervals by setting one or more threshold values, and each interval corresponds to a specific state. The selection of the threshold value can be based on multiple criteria, such as the average value of the variable, the target point set by the system, or engineering experience.

[0159] In step S302 of some embodiments, the brake sink of each dependency subgraph is searched forward to the corresponding sensor source, and the directed edges thereof constitute a dependency path P(V source ,V sink )={v1,v2,...,v k}, where V source represents the sensor source, and V sink represents the brake sink, and the stability of the path dependency is calculated in combination with the value sequence of the nodes in the path. First, starting from the sensor source of the path, the directed edge type of the current node and the next node is obtained, and if it is a strong link, it is skipped; if it is a weak link, the value sequence K(v i ) of the current node and the value sequence K(v i+1 ) of the next node are obtained, and the Pearson correlation coefficient between the nodes is calculated. Exemplarily, for N scan cycles, the Pearson correlation coefficient between the nodes v i and vi+1 Pearson correlation coefficient r between the output value sequences of the two nodes k The calculation formula is as follows:

[0160]

[0161] Wherein, is the average value of the output sequence of node v i , is the average value of the output sequence of node v i+1 , represents the jth output value of node v i in the kth cycle.

[0162] For the path from the sensor source node V source to the brake sink node V sink , let the path length be L, which contains w weak links, and the path-dependent stability Y source,sink is defined as:

[0163]

[0164] Wherein, r i represents the Pearson correlation coefficient of the ith weak link in the path.

[0165] Generally, in an industrial control system, there can be multiple paths between a sensor and a brake, so the path with the highest path-dependent stability index is extracted as the stable dependence path of the brake node.

[0166] In steps S303 to S304 of some embodiments, the output value sequences of all brakes in multiple scanning cycles are read, and the values in each cycle are combined as a system state. At the same time, all different states observed are summarized and arranged in chronological order, and a finite state machine (FSM) of the system is constructed. At this time, the finite state machine generated has the problem of too large state space, and to solve this problem, the Hamming distance between binary vectors can be defined as a similarity measure, and combined with the agglomerative hierarchical clustering method to simplify it into a smaller scale state machine, thereby significantly compressing the state space. Exemplarily, this step is as follows:

[0167] Step one: read all state nodes in the original FSM in time sequence [s1, s2,..., s T ], where each state variable D is the total number of brakes, and T is the total number of time steps. Then, all repeated state vectors in the sequence are removed to obtain the set S={u1,..., y N}, N≤T.

[0168] Step two: calculate the Hamming distance between any two vectors up and u q The Hamming distance between u H and u H is defined as: where 1(·) is an indicator function that takes value 1 when the condition inside the parentheses is true, and 0 otherwise. The Hamming distance d p ∈ [0, D], the smaller the more similar the states are.

[0169] Step three: obtain the set of Hamming distances F = {d q (u p , u q ) | u (P) , u (P) ∈ S, p < q}, and sort F in ascending order, compute the p-th percentile d p , take p = 0.15, then set the threshold δ = d q .

[0170] Step four: apply the agglomerative hierarchical clustering method to S, initially each u i is a separate cluster, when the minimum Hamming distance between two clusters is less than δ, then merge the two cluster vectors, iterate until the minimum distance between all clusters is greater than or equal to δ. By clustering, we get K clusters {c1,..., c k}, at this time for each original vector in the cluster c i , select the most frequently occurring vector as the representative state Accordingly, we can get the simplified time series where i t ∈ {1,..., K}, at this point the time series can be used as the new node set of the FSM.

[0171] Then determine the target system state according to the attack purpose, for example, some brake needs to be in the start state, locate this target state in the generated FSM finite state machine model, and deduce the brake to be controlled and its target value in reverse. Then traverse forward according to the dependence subgraph of the brake to find the related dependence path, and determine the most likely sensor node according to the stability order of the path dependence, such as v sink_1 = {v source_3 ∨ v source_5} indicates that any one sensor tampering can stably affect the brake v sink_1 .

[0172] After determining the possible sensor nodes, the generated control dependency graph is analyzed to identify the actual values of the corresponding sensors in the stable dependency path that affect the brake value. The analysis process can be simply described as follows: first, determine the location of the brake node in the control dependency graph, and find the corresponding sensor nodes according to the stable dependency path, then search the code blocks in which these nodes are located in the control dependency graph, analyze the code in the code blocks to determine the values of the sensor variables and how they are passed to the brake variables, and finally obtain the sensors and their values required for the target system state determined by the attack purpose.

[0173] In step S400 of some embodiments, the logical nodes analyzed in the target dependency graph are mapped to field devices in the industrial control system, thereby realizing joint analysis and judgment of the function domain and the information domain, and realizing cross-domain requirements. Illustratively, first, the sensor combination and its value range required to achieve a specific attack purpose in the target dependency graph are obtained. In general, the number of sensors affecting a single brake is not unique, and the number of brakes controlled by the target state is also not unique, so a set of sensors must be determined, which is the intersection of all sensors required by the controlled brakes to ensure that all these brakes can be affected at the same time. That is, define such a set of sensor combinations {v source_1 ∨v source_2 ∨...∨v source_k} here indicates that tampering with any optional sensor can achieve the attack effect, and the most likely attack point needs to be analyzed in the information domain attack graph. Then, the mapping relationship between the sensor nodes and the physical devices is established through systematic device research methods such as consulting engineer technical documents, analyzing device configuration lists, and field device investigation, thereby obtaining the mapping relationship matrix wherein represents the set of sensor nodes in the dependency graph, represents the set of field devices. At this time, the attack target can be set as the corresponding field device mapped by the sensor combination.

[0174] In step S500 of some embodiments, the attacker starting position and possible attack targets are obtained and set. The attacker starting position, possible attack targets, and input data obtained by integrating the network connection graph and the first vulnerability information are input into MulVAL, and the attribute attack graph generated by MulVAL can be obtained.

[0175] In some embodiments, step S600 can include but is not limited to steps S601 to S605:

[0176] Step S601, obtaining the vulnerability value, attack cost, attack benefit, and vulnerability age decay factor of the attack node of the attribute attack graph;

[0177] Step S602, according to the vulnerability value, attack cost, attack benefit and vulnerability age attenuation factor, the atomic attack probability value of the attack node is obtained;

[0178] Step S603, the structure of the ring-containing attribute attack graph is converted by the minimum permission set and the depth-first traversal method, and a loop-free attack graph is obtained;

[0179] Step S604, according to the atomic attack probability value, the path probability of the initial attack path in the loop-free attack graph is obtained;

[0180] Step S605, the initial attack path corresponding to the maximum path probability is selected as the target attack path, and the cross-domain threat prediction result is obtained.

[0181] In steps S601 to S602 of some embodiments, each attack node is valued based on the atomic attack probability value. Illustratively, based on the vulnerability value, attack cost, attack benefit and vulnerability age attenuation factor of the attack node of the attribute attack graph, the atomic attack probability value of the attack node is obtained, thereby accurately reflecting the tendency of the attacker to each vulnerability exploitation action.

[0182] In some embodiments, the vulnerability value refers to the preference of the attacker when exploiting the attack vulnerability, which is related to the severity of the vulnerability, and usually needs to consider the exploitability and impact of the vulnerability, and is calculated according to the basic quantitative standard given by the Common Vulnerability Scoring System (CVSS). The vulnerability value Value(v i ) is obtained by normalizing the vulnerability score score(v i ) in CVSS, Value(v i ) = score(v i ) / 10, and for the vulnerability v i , the calculation expression of score(v i ) is:

[0183]

[0184] In the formula, the value range of score(v i ) is [0, 10]; round(·) represents a function that can be rounded to two decimal places; Exp is the vulnerability exploitability index; Imp is the vulnerability impact index; scope indicates whether the impact range of the vulnerability has changed; U is unchanged; C is changed.

[0185] The vulnerability exploitability index Exp can be obtained by calculating the CVSS 3.0 calculator, and the calculation expression is:

[0186] Exp = 8.22 × AV × AC × PR × UI

[0187] In the formula, AV represents the attack vector; AC represents the attack complexity; PR represents the permissions required for the attack; and UI represents user interaction, all of which are sub-item values ​​defined in CVSS 3.0.

[0188] The impact metrics of the Imp vulnerability were also calculated using the CVSS 3.0 calculator, and the calculation expression is as follows:

[0189]

[0190] In the formula, ISCbase = 1 - [(1-R) ​​× (1-I) × (1-A)]; where ISCbase is a temporary variable; R represents the confidentiality impact; I represents the integrity impact; and A represents the availability impact.

[0191] In some embodiments, attack cost refers to the total investment required by the attacker during the exploitation of the vulnerability. This invention primarily focuses on time cost. Skill Cost and resource costs The attack cost (cost(s)) is calculated from three aspects. i ) Through vulnerability v i Complete an atomic attack e i,j The calculation expression is:

[0192]

[0193] In the calculation formula, The default weights are [0.4, 0.3, 0.3], but in practice they need to be determined based on experience. This is the time cost, which represents the time score required for an attacker to debug vulnerabilities and develop a Proof of Concept (POC). It is mainly divided into three levels, with higher levels resulting in higher costs. The low level ranges from 0 to 0.3, the medium level ranges from 0.3 to 0.7, and the high level ranges from 0.7 to 1. This is the skill cost, representing the skill level that the attacker needs to master. The higher the skill level, the higher the cost, and the value ranges from [0-1]. This represents the resource cost, which indicates the software, hardware, and human resources required for the attack, and its value ranges from [0-1].

[0194] In some embodiments, attack gain refers to the benefit gained by an attacker after completing an atomic attack. This invention equates the control privileges gained after a vulnerability is successfully exploited with attack gain (income(e)). i,j The scores were then quantified, and the specific scoring indicators are shown in Table 1.

[0195] Table 1

[0196] Exploit result Privilege level Score Network reachable, no privilege acquisition Low 0.2 Acquire normal user privileges Medium 0.5 Acquire administrator, high-privilege user privileges High 0.8 Acquire system root or domain administrator privileges Highest 1.0

[0197] In some embodiments, the vulnerability age decay factor refers to the natural decay effect of the vulnerability life cycle on the attacker attack tendency, and generally, the longer the vulnerability publication time, the lower the possibility of being exploited by the attacker. The calculation expression is:

[0198]

[0199] In the calculation expression, a is the decay rate, which is 0.005 by default, indicating that about 63% of the weight is reduced every 200 days, which can gradually reduce the weight of the vulnerability in the attack graph which is exposed early but not widely exploited; A v is the vulnerability age, indicating the number of days from the publication date of the vulnerability; and θ is the minimum residual value, which is 0.2 by default, which is set to prevent the probability of old vulnerabilities from approaching zero.

[0200] By comprehensively considering the vulnerability value of the attack node, the attack cost, the attack benefit and the vulnerability age decay factor, the atomic attack probability of the attacker through the vulnerability v i to complete an atomic attack e i,j is calculated as:

[0201]

[0202] In step S603 of some embodiments, the initial attribute attack graph containing loops is iteratively pruned based on the minimum permission set and the depth-first traversal method, and redundant paths and loops are removed to obtain a loop-free attack graph. Exemplarily, the process of this step is as follows:

[0203] Step one: initialize the permission set Q(t) of the target node t as the required permissions to reach t, which can be obtained from the attack graph; then traverse forward from the target node t, and for each node v, derive the permission set of the node v according to the required permissions to reach the successor node u:

[0204]

[0205] Wherein, s(v) represents the successor node set of the node v; Q(u) represents the permission set of the successor node u; and permissions(u) represents the required permissions of the node v to reach the node u.

[0206] Use the queue method to propagate layer by layer from the target node forward until all nodes calculate the permission set

[0207] Step two: add all the entry root nodes of the processed attack graph into the queue M, perform a depth-first traversal, use a stack structure to mark and push all the traversed child nodes, for the directed edge A→B formed by the adjacent two nodes in the traversal, check whether there is an alternative path that does not contain A→B, such that the authority requirement of the path is met. If there is, remove the redundant path A→B, remove the mark of node B in the stack and pop node B from the stack; if there is not, continue the traversal until all the child nodes are traversed or a repeatedly marked child node appears in the stack.

[0208] Step three: if a repeatedly marked child node appears in the stack, backtrack from the discovered node v to the bottom of the stack, extract all the intermediate nodes from the first time the node v is marked to the current node, form a loop node sequence, for each node w in the loop node sequence, read its atomic attack node probability P(w), select the node w with the minimum probability * , and delete the outgoing edge of the node w to eliminate the loop.

[0209] Step four: if the traversal of the child nodes of an entry root node is completed, perform a backtracking operation to pop all the nodes in the stack and remove the marks, continue the traversal of the queue M until the queue M is empty, and output the target loop-free attack graph.

[0210] Then obtain the loop-free attack graph, deduce the path probability of the attack path based on the atomic attack probability, determine the most likely attack path, and mine the complete penetration attack path. For any attack path P, define it as a series of node sequences {v1, v2,..., v k}, where v1 is the entry root node and v k is the target node. The path probability Pr(P) of each path can be calculated by the following formula:

[0211]

[0212] In the calculation formula, p(v i ) represents the atomic attack probability represented by the node v i . This calculation assumes that the success of each atomic attack in the path is independent, and whether a certain atomic attack is successful or not does not affect the probability of subsequent attacks.

[0213] Finally, based on the path probability, the attack path with the highest path probability can be selected as the most likely penetration attack path of the attacker, and as the defense party, the network nodes contained in the path can be focused on for defense, improving the defense accuracy while reducing the defense cost.

[0214] For example Figure 5As shown, the embodiment of the present application constructs a cross-domain threat prediction model based on vulnerability analysis, realizes cross-domain attack path analysis from the Internet to the internal of industrial control system, and mainly covers three parts:

[0215] (1) The attack graph constructed based on vulnerability correlation. Firstly, the network connection graph is constructed according to the network topology information provided by the firewall management tool, the scanning results of Nmap and SNMP network host scanning tools and the passive detection results of the GRASSMARLIN tool, then the Nessus vulnerability scanning tool is run on each node to obtain the scanning report containing the CVE number, vulnerability description and CVSS score, the vulnerability information in the scanning result is mapped and matched with CVE and NVD to ensure the consistency of the vulnerability identification, and the related information of the vulnerability is supplemented in an all-round way, the network connection graph, network management strategy and vulnerability description information are converted into Datalog language facts as the input of MulVAL, which is input to the deduction engine in it for attack process deduction, and finally the attack graph covering the information system and the control system is generated.

[0216] (2) The dependency graph construction method for programmable control logic. Firstly, the XML files of various types of PLC programming languages in the industrial control system are obtained, then the XML tags representing programs and routines such as Program and Routine are identified, the saved PLC control logic is extracted, then the program variables in the XML file are mapped into nodes, and the saved PLC control logic is analyzed based on the information flow analysis method, and the data dependency graph is generated based on the data dependency relationship between variables Figure Four for large PLC programming languages, and the corresponding control dependency graph is generated based on the control dependency relationship between variables.

[0217] (3) Attack path analysis based on attack graph and dependency graph:

[0218] <1> Firstly, the dependency subgraph is constructed for each sink point by using the data dependency graph, then the stable dependency path of each dependency subgraph is deduced by using the historical running data of the device, then the attack target state of the system and the required brakes and their values are determined according to the historical running data of the device, the attack purpose and the control dependency graph, and the required sensors and their values are obtained according to the dependency subgraph of each brake.

[0219] <2> By using the mapping table between program variables and real devices, the analysis result of the dependency graph can be transmitted to the attack graph, so as to determine the possible attack target of the attacker.

[0220] <3> As Figure 4As shown, firstly, the starting position of the attacker and the possible attack target are set, the attribute attack graph generated by MulVAL is acquired, and an atomic attack probability value is assigned to each attack node, then the initial attribute attack graph containing a ring is structurally converted based on the minimum permission set and the depth-first traversal method to obtain a loop-free attack graph, and then the path probability of the attack path is determined based on the atomic attack probability value of the node to obtain the processed attack graph, finally, the most possible attack path is extracted according to the attack path probability in the attack graph, so that the complete penetration attack path is mined.

[0221] The embodiment of the present application also provides a cross-domain threat prediction device based on vulnerability analysis, which can realize the above method, and the device comprises:

[0222] A first attack graph construction module is configured to acquire a network connection graph and first vulnerability information, integrate the network connection graph and the first vulnerability information, and generate input data of an attack graph generation tool;

[0223] A dependency graph construction module is configured to acquire PLC control logic and generate a target dependency graph according to the PLC control logic;

[0224] A dependency graph processing module is configured to acquire a logic node according to the target dependency graph;

[0225] A node mapping module is configured to map the logic node to a field device in an industrial control system to obtain an attack target;

[0226] A second attack graph construction module is configured to generate an attribute attack graph by the attack graph generation tool according to a pre-set starting position of an attacker, an attack target and the input data;

[0227] An attack graph processing module is configured to extract a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result.

[0228] It can be understood that the contents in the above method embodiments are all applicable to the present device embodiment, the present device embodiment specifically realizes the same functions as the above method embodiments, and achieves the same beneficial effects as the above method embodiments.

[0229] The embodiment of the present application also provides an electronic device, which comprises a processor and a memory, the memory stores a computer program, and the processor realizes the above method when executing the computer program.

[0230] It can be understood that the contents in the above method embodiments are all applicable to the present device embodiment, the present device embodiment specifically realizes the same functions as the above method embodiments, and achieves the same beneficial effects as the above method embodiments.

[0231] Reference Figure 6 , Figure 6 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0232] The processor 701 can be implemented in a manner of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0233] The memory 702 can be implemented in a form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory), etc. The memory 702 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 702 and are called and executed by the processor 701 to implement the method of the embodiments of the present application.

[0234] The input / output interface 703 is used to realize information input and output.

[0235] The communication interface 704 is used to realize the communication interaction between the device and other devices, and can realize the communication through a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0236] The bus 705 is used to transmit information between various components (for example, the processor 701, the memory 702, the input / output interface 703, and the communication interface 704) of the device.

[0237] The processor 701, the memory 702, the input / output interface 703, and the communication interface 704 are connected to each other through the bus 705 to realize the communication connection between them in the device.

[0238] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the above method.

[0239] It can be understood that the contents in the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved by the present storage medium embodiment are also the same as those achieved by the above method embodiments.

[0240] The embodiment of the present application further provides a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the foregoing method.

[0241] To sum up, the cross-domain threat prediction method based on vulnerability analysis and the related device have the following advantages:

[0242] 1. The cross-domain threat prediction model is constructed, and complete attack path analysis from the Internet to the internal industrial control system is realized. The attack graph construction technology based on vulnerability correlation is adopted, the unified attack graph covering the information system and the control system is generated through the MulVAL deduction engine, the program variable and the real device mapping mechanism are combined, the cross-domain data effective correlation is realized, and the limitation of the prior art that only analyzes in a single domain is overcome.

[0243] 2. The embodiment of the present application adopts the dependency graph analysis method for programmable control logic, realizes cross-domain threat analysis from the dependency graph to the attack graph, adopts the unified analysis technology based on the XML standard format, constructs the data dependency graph and the control dependency graph through the taint analysis method, combines the historical operation data to calculate the path dependency stability by using the Pearson correlation coefficient, significantly enhances the depth of industrial process analysis, realizes system state compression through the finite state machine and the condensed hierarchical clustering method, and compared with the traditional disassembly method, the analysis efficiency is significantly improved.

[0244] 3. The embodiment of the present application realizes the attack path optimization analysis based on probability, and significantly improves the threat prediction accuracy. Through the attack graph structure conversion method based on the minimum permission set and the depth-first traversal, combined with the node atomic attack probability calculation, efficient conversion from the ring attack graph to the loop-free attack graph and accurate identification of the optimal attack path are realized, and a quantitative decision basis is provided for security protection.

[0245] In some alternative embodiments, the functions / operations mentioned in the block diagram can not occur in the order mentioned in the operation diagram. For example, depending on the functions / operations involved, two blocks shown in succession can actually be executed substantially simultaneously or the blocks can sometimes be executed in reverse order. In addition, the embodiments presented and described in the flowcharts of the present application are provided by way of example, and the purpose is to provide a more comprehensive understanding of the technology. The disclosed method is not limited to the operations and logical flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and in which sub-operations described as part of larger operations are independently executed.

[0246] Furthermore, although the present application is described in the context of functional modules, it is to be understood that one or more of the described functions and / or features can be integrated in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules, unless expressly stated otherwise. It is also to be understood that detailed discussion of the actual implementation of each module is unnecessary to an understanding of the present application. Rather, the actual implementation is to be understood within the context of the properties, functions and interrelationships of the various functional modules disclosed herein. Thus, the present application is to be understood as encompassing the implementation of the present application as set forth in the claims, within the ordinary skill of the artisan, using the ordinary techniques, as contemplated by the properties, functions and interrelationships of the various functional modules disclosed herein. It is also to be understood that the disclosed specific concepts are merely illustrative and are not intended to limit the scope of the present application, which is defined by the full scope of the claims appended hereto, and equivalents thereof.

[0247] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0248] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logic functions, and can be specifically embodied in any computer readable medium for use by an instruction execution system, device or apparatus, such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from the instruction execution system, device or apparatus, or in conjunction with these instructions. For the purpose of this specification, "computer readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by an instruction execution system, device or apparatus, or in conjunction with these instructions.

[0249] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0250] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the embodiments described above, various steps or methods can be implemented, for example, by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following techniques can be used to implement the hardware used in the described embodiments: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and so forth.

[0251] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific feature, structure, material or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In the specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any suitable manner in one or more embodiments or examples.

[0252] Although embodiments of the application have been shown and described, it would be recognized by those of ordinary skill in the art that various changes, modifications, substitutions, and alterations can be made hereto without departing from the spirit and scope of the application. The scope of the application is limited only by the claims and the equivalents thereof.

[0253] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the described embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A method for cross-domain threat prediction based on vulnerability analysis, characterized in that, The method comprises the following steps: obtaining a network connection graph and first vulnerability information, and integrating the network connection graph and the first vulnerability information to generate input data of an attack graph generation tool; obtaining PLC control logic and generating a target dependency graph according to the PLC control logic; obtaining a logic node according to the target dependency graph; mapping the logic node to a field device in an industrial control system to obtain an attack target; generating an attribute attack graph by the attack graph generation tool according to a pre-set starting position of an attacker, the attack target and the input data; extracting a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result.

2. The method of claim 1, wherein, The method for obtaining the network connection graph and the first vulnerability information comprises the following steps: extracting first network topology information by performing a network topology information extraction operation on a network management infrastructure by a firewall management tool; obtaining second network topology information and device information by means of active scanning and passive listening; fusing and associating the first network topology information and the second network topology information to generate the network connection graph; configuring a vulnerability scanning tool according to the network connection graph and the device information; obtaining a scanning report by the vulnerability scanning tool; completing the scanning report to obtain the first vulnerability information.

3. The method of claim 2, wherein, The method for completing the scanning report to obtain the first vulnerability information comprises the following steps: analyzing the scanning report to obtain a vulnerability item list; when the vulnerability item list is not empty, extracting an initial vulnerability item in the vulnerability item list; parallelly querying a CVE number and a NVD database to obtain second vulnerability information; judging whether there is a vulnerability information conflict according to the initial vulnerability item and the second vulnerability information, if there is a vulnerability information conflict, outputting third vulnerability information, and performing de-duplication and redundancy removal processing on the third vulnerability information to output a target vulnerability item of the first vulnerability information, if there is no vulnerability information conflict, performing de-duplication and redundancy removal processing on the initial vulnerability item to output a target vulnerability item of the first vulnerability information.

4. The method of claim 1, wherein, The method for obtaining the PLC control logic comprises the following steps: obtaining an XML file of a PLC programming language in the industrial control system; analyzing the XML file to obtain an XML tag; identifying a logic element tag corresponding to the PLC programming language of different types according to the XML tag; extracting the PLC control logic in the logic element tag.

5. The method of claim 1, wherein, The method for generating a target dependency graph according to the PLC control logic comprises the following steps: obtaining an XML file of a PLC programming language in the industrial control system; obtaining a program variable accessed in the XML file; by a taint analysis method, taking a sensor variable of the PLC control logic as a source point of a taint, and taking a brake variable of the PLC control logic as a sink point of the taint; tracking a propagation process of the taint between the program variables according to the source point and the sink point to obtain a dependency relationship between the program variables; According to the dependency relationship, a data dependency graph is generated; According to the type of the PLC programming language, the PLC control logic is converted into target code blocks; According to the execution relationship between the target code blocks, a control dependency graph is generated; The target dependency graph includes the data dependency graph and the control dependency graph.

6. The method of claim 5, wherein, According to the target dependency graph, a logical node is obtained, including the following steps: According to the data dependency graph, a dependency subgraph of each sink point is constructed; According to device historical operation data, a stable dependency path of each dependency subgraph is obtained; According to the device historical operation data, an attack purpose, and the control dependency graph, an actuator node required for an attack is obtained; According to the dependency subgraph, a sensor node required for an attack is obtained; The logical node includes the actuator node required for an attack and the sensor node required for an attack.

7. The method of claim 1, wherein, According to the attribute attack graph, a target attack path is extracted to obtain a cross-domain threat prediction result, including the following steps: Obtain the vulnerability value, attack cost, attack benefit, and vulnerability age decay factor of the attack node of the attribute attack graph; According to the vulnerability value, the attack cost, the attack benefit, and the vulnerability age decay factor, an atomic attack probability value of the attack node is obtained; Through the least privilege set and the depth-first search method, the attribute attack graph containing a ring is structurally converted to obtain a loop-free attack graph; According to the atomic attack probability value, a path probability of an initial attack path in the loop-free attack graph is obtained; Select the initial attack path corresponding to the maximum path probability as the target attack path to obtain the cross-domain threat prediction result.

8. A cross-domain threat prediction apparatus based on vulnerability analysis, characterized by, It includes: A first attack graph construction module is configured to obtain a network connection graph and first vulnerability information, integrate the network connection graph and the first vulnerability information, and generate input data of an attack graph generation tool; A dependency graph construction module is configured to obtain PLC control logic and generate a target dependency graph according to the PLC control logic; A dependency graph processing module is configured to obtain a logical node according to the target dependency graph; A node mapping module is configured to map the logical node to a field device in an industrial control system to obtain an attack target; A second attack graph construction module is configured to generate an attribute attack graph by the attack graph generation tool according to a pre-set starting position of an attacker, the attack target, and the input data; An attack graph processing module is configured to extract a target attack path according to the attribute attack graph to obtain a cross-domain threat prediction result.

9. An electronic device, comprising: It includes a processor and a memory; The memory is configured to store a program; The processor executes the program to implement the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a program, and the program is executed by a processor to implement the method of any one of claims 1 to 7.

Images