Industrial internet high-risk software identification system and method

Abstract

The application discloses an industrial internet high-risk software identification system and method, and particularly relates to the technical field of industrial internet security, and comprises an industrial software gene map automatic construction module, a business context-aware dynamic risk assessment module and a map-associated precise disposal strategy recommendation module; through multi-dimensional feature acquisition and fusion technology, a unique digital identity is generated for software assets, precise identification is realized; the real security risk of software assets is dynamically quantified by comprehensively considering vulnerability severity, business criticality and network exposure; based on asset relationship map and game analysis, the optimal disposal strategy with the least impact on business is generated and recommended for high-risk software. The application solves the problems of inaccurate industrial software identification, risk assessment out of business context and lack of intelligent decision support for disposal measures in the prior art, realizes automatic closed-loop management from identification, evaluation to disposal, and significantly improves the security protection capability of the industrial internet.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, and more specifically, to a system and method for identifying high-risk software in the industrial internet. Background Technology

[0002] As a product of the deep integration of industrial systems and internet technology, the secure and stable operation of the Industrial Internet is a crucial guarantee for the security of national critical infrastructure. Industrial control environments deploy a large number of specialized software programs from various vendors, such as configuration software, data acquisition and monitoring systems, and programmable logic controller (PLC) programming tools. These software programs have become core components of industrial control systems. However, these software programs generally suffer from issues such as version fragmentation, lack of long-term updates, and insufficient security considerations during the design and development phases, making them prime targets for attackers. Traditional IT security protection methods are severely inadequate when facing highly specialized and customized industrial software. Accurately identifying high-risk software assets has become a core challenge that urgently needs to be addressed in the field of Industrial Internet security.

[0003] Currently, the industry primarily relies on two types of technologies for software identification and risk analysis. The first is signature-based malware detection methods, which identify threats by comparing them to known features in virus databases. This method is effective for known, general-purpose software with obvious malicious behavior, but it struggles to detect disguised targeted attack software aimed at industrial environments, and it also fails to identify legitimate industrial software that poses a high risk due to unpatched vulnerabilities. The second is asset management systems based on static attributes (such as file hashes and version numbers). This method can perform basic software inventory, but it cannot handle situations where software has been tampered with while the file hash remains unchanged, and it lacks the ability to dynamically assess the true risk of software within a specific business context. These existing technologies all suffer from the shortcomings of being "invisible, inaccurate, and incompletely assessable"—they cannot comprehensively discover assets, accurately identify software versions, or combine business needs, impact factors, and quantify risks.

[0004] In summary, the shortcomings of existing technologies can be categorized into three aspects: First, at the identification level, there is a lack of deep integration and accurate identity verification capabilities for the multi-dimensional characteristics of industrial software, resulting in low identification rates for disguised software and version variants. Second, at the assessment level, software vulnerabilities are viewed in isolation, failing to correlate vulnerability information, the network exposure of the software, and its business criticality in the industrial production process, thus failing to reflect the true risks. Finally, at the disposal level, there is a lack of intelligent strategy recommendations based on asset relationships, making it difficult to generate precise security disposal solutions while ensuring business continuity. Therefore, there is an urgent need for an integrated solution that can achieve accurate identification, context-aware risk assessment, and intelligent disposal recommendations. Summary of the Invention

[0005] To overcome the above-mentioned deficiencies of the prior art, embodiments of the present invention provide an industrial internet high-risk software identification system and method.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] An industrial internet high-risk software identification system includes the following modules:

[0008] The automatic construction module for industrial software gene maps generates unique digital identities for software assets in the network through multi-dimensional feature collection and fusion.

[0009] The business context-aware dynamic risk assessment module comprehensively considers vulnerability severity, business criticality, and network exposure to dynamically quantify the true security risks of software assets.

[0010] The graph-based disposal strategy recommendation module, based on asset relationship graphs and game theory analysis, generates and recommends the optimal disposal strategy with the least impact on business for high-risk software.

[0011] Specifically, the industrial software gene map automatic construction module performs the following:

[0012] Multi-modal asset discovery and detection identifies active devices and the software processes and services running on them in the network through passive listening and active scanning;

[0013] Multidimensional feature fingerprint extraction: software feature fingerprints are collected from four dimensions: network behavior, file static attributes, memory image, and process behavior.

[0014] Gene map generation and matching integrates multidimensional feature fingerprints into structured software gene map data objects, and matches them with industrial software gene libraries to determine the unique identity of the software.

[0015] Specifically, the automatic gene map construction module for industrial software also includes:

[0016] Matching is performed through multi-level similarity calculation, prioritizing file hash value matching, followed by fuzzy matching of version information, and finally similarity matching of network behavior sequences.

[0017] Once a match is successful, a version identification and error correction mechanism based on confidence propagation is initiated. The accuracy of the identification result is verified through contextual consistency checks, neighbor node confidence propagation, and historical version evolution rationality checks.

[0018] Specifically, the business context-aware dynamic risk assessment module performs the following:

[0019] Inherent risk value calculation is based on the software identity query vulnerability knowledge base, and the basic inherent risk value is calculated according to the severity and exploitability of the vulnerability.

[0020] The assessment of the chain reaction effect of complex vulnerabilities analyzes the correlation between multiple vulnerabilities, identifies the combination of vulnerabilities that form an attack chain, and calculates the chain risk bonus.

[0021] The importance of a business is determined by analyzing the communication frequency between the software and key devices or by manual marking by the administrator.

[0022] Specifically, the business context-aware dynamic risk assessment module also performs:

[0023] Network exposure surface assessment evaluates the network exposure of software from three dimensions: accessibility, authentication strength, and host protection, and calculates the exposure surface coefficient.

[0024] Dynamic risk fusion calculation integrates inherent risk values, business criticality weights, and network exposure surface coefficients to calculate the final dynamic risk value and classify risk levels.

[0025] Specifically, the strategy recommendation module for the associated graphs is executed as follows:

[0026] Impact scope analysis: Based on the asset relationship map generated by automatic learning, analyze all network assets and devices directly and indirectly affected by high-risk software;

[0027] Multi-strategy generation and simulation automatically generates handling strategies including isolation, virtual patching, upgrade and replacement path recommendations, and security hardening suggestions, and pre-assesses the business impact of each strategy.

[0028] Specifically, the graph association processing strategy recommendation module also performs the following:

[0029] Dynamic strategy optimization is based on a game theory model that constructs a game model between the defender and the attacker. By defining a payoff function and solving the mixed-policy Nash equilibrium, the strategy with the highest defender probability is selected as the optimal recommended strategy.

[0030] The strategy recommendation and execution function presents the optimal strategy and its expected benefits to the administrator, supports one-click deployment or manual handling, and feeds back the handling results to the system to optimize the risk assessment model.

[0031] Specifically, a method for identifying high-risk software in the industrial internet includes the following steps:

[0032] B1. Asset Discovery and Multimodal Feature Acquisition: Identify software assets and collect their multi-dimensional feature fingerprints through active scanning and passive listening;

[0033] B2. Software Genome Map Construction and Identity Recognition: Genome map is constructed by fusing feature fingerprints, and the unique identity of the software is determined through matching and error correction mechanisms;

[0034] B3. Context-aware multidimensional risk analysis: Calculate inherent risks and assess vulnerability cascading effects, business criticality, and network exposure surface;

[0035] B4. Dynamic Risk Fusion and Level Determination: Integrating multi-dimensional risk factors to calculate the final risk value and classify risk levels;

[0036] B5. Intelligent Disposal Strategy Generation and Execution: Analyze the scope of impact and generate multiple strategies. Recommend the optimal strategy through game analysis and execute it.

[0037] The technical effects and advantages of this invention are as follows:

[0038] By constructing an industrial software gene map, the system achieves comprehensive and accurate identification and authentication of various software assets in the industrial environment, effectively solving the problem of "inaccurate identification" caused by complex versions and tampering. The system employs multi-dimensional feature fusion and dynamic context awareness technology to comprehensively and quantitatively analyze the inherent risks of vulnerabilities, the business criticality of software, and network exposure surfaces. This significantly improves the accuracy and practicality of risk assessment, enabling precise identification of high-risk software that truly poses a threat to production operations, and greatly reducing false positives and false negatives.

[0039] Furthermore, the system innovatively applies asset relationship mapping and game theory models to the safety disposal decision-making process, automatically generating and recommending optimal disposal strategies that balance safety benefits with business impact. This system achieves automated closed-loop management from asset identification and risk assessment to intelligent disposal, significantly improving the security protection efficiency and intelligence level of the Industrial Internet, and effectively ensuring the continuity and stability of industrial production processes. Attached Figure Description

[0040] Figure 1 This is a system block diagram of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] like Figure 1 As shown, a module of an industrial internet high-risk software identification system is as follows:

[0043] The industrial software gene map automatic construction module generates unique digital identities for software assets in the network through multi-dimensional feature collection and fusion, achieving accurate identification; execution steps:

[0044] Multi-mode asset discovery and detection: Passively monitor network traffic using a network scanner and proactively perform lightweight scans of industrial network segments to identify all active IP addresses and devices. For identified devices (such as engineering workstations, operator workstations, and HMI servers), obtain a list of processes and services running on the device using security credentials or by leveraging the service discovery capabilities of industrial protocols (such as S7 and EtherNet / IP).

[0045] Multidimensional Feature Fingerprint Extraction: For each software process or service to be identified, its feature fingerprint is extracted from the following four dimensions:

[0046] Network behavior fingerprinting: extracting the characteristics exhibited in network communication, including but not limited to: the port being listened to, the type of industrial protocol used (such as S7comm, OPC, UA), banner information carried in protocol communication, and message interaction sequence patterns.

[0047] File static fingerprint: Where possible, obtain the software's executable file, dynamic library, or configuration file, calculate its hash value, and extract its file version information, digital signature, compilation timestamp, and specific strings contained in the file.

[0048] Memory image characteristics: For a running software process, obtain its memory image and extract key characteristics from it, such as the list of modules loaded in the process, specific strings or keys existing in memory, and the signature of function entry points.

[0049] Process behavior fingerprinting: Run the software briefly in a controlled environment and observe its typical process behavior, such as the mutexes created, registry keys, temporary file paths, etc.

[0050] Genome map generation and matching: The extracted multidimensional feature fingerprints are fused to form a structured software genome map data object; the data object adopts JSON or Protocol / Buffers format, and the main fields include: unique asset ID, IP address, software name, vendor, version number, fingerprint dictionary, which includes four sub-items: network, file, memory, behavior, and identification confidence;

[0051] This graph is matched against a built-in industrial software gene database. This database is a continuously updated database, pre-built by crawling manufacturer websites, security announcements, and analyzing publicly available industrial software samples, and stores standard feature templates for the software. The gene database stores standard gene graphs of various versions of mainstream domestic and international industrial software manufacturers. Multi-level similarity calculations are performed (specifically, precise matching of file hash values ​​is prioritized; if that fails, fuzzy matching of version information is performed (e.g., using the edit distance algorithm); if still unable to determine the match, finally, similarity matching of network behavior sequences is performed (e.g., using the Dynamic Time Warping (DTW) algorithm).

[0052] When the overall similarity score exceeds a preset threshold (e.g., 0.85), a match is considered successful. Upon successful matching, a version identification and error correction mechanism based on confidence propagation is activated to further verify the accuracy of the identification results.

[0053] Context consistency check: Checks the consistency between the identified software version and its runtime environment, including:

[0054] Operating system compatibility: Verify whether this software version supports the current operating system version; Industrial equipment compatibility: Verify whether this software version is compatible with the industrial equipment models in the current network;

[0055] Neighbor node confidence propagation: In a network topology, if adjacent nodes (such as multiple engineering stations connected to the same PLC) have the same software installed, the identification results of these nodes mutually verify each other; the confidence propagation formula is defined as follows:

[0056]

[0057] in, To ultimately identify the confidence level, To determine its own confidence level, Identify confidence levels for neighboring nodes. , The weights are coefficients and their sum is 1, where N is the number of neighboring nodes;

[0058] Historical version evolution rationality check: If the asset has been identified before, check the rationality of the version evolution path to avoid abnormal version number jumps;

[0059] The software's unique identity is ultimately determined, including the vendor, product line, full version number, and patch level. The generated complete genomic map data object will be published to the system's central data storage area (such as Redis or a Kafka message queue) and marked as "identified," awaiting further processing.

[0060] A business context-aware dynamic risk assessment module comprehensively considers vulnerability severity, business criticality, and network exposure to dynamically quantify the true security risks of software assets; Execution steps:

[0061] Data Input and Triggering: This module acts as a consumer, retrieving software gene map data objects with an "identified" status published by Module 1 from a designated topic in a central data storage area (such as Kafka). A risk assessment process is triggered when new identification results arrive or the network context of the asset changes.

[0062] Inherent risk value calculation: Based on the identified unique software identity, query industrial vulnerability knowledge bases (such as NVD, CNVD, and our self-developed industrial vulnerability database) to obtain all known vulnerability information for this software version. Calculate a basic inherent risk value based on factors such as the vulnerability's CVSS baseline score, vulnerability type, and whether there are publicly available exploits (EXPs).

[0063] Assessment of the Chain Reaction Effect of Complex Vulnerabilities: For multiple vulnerabilities in the software, analyze their potential chain attack effects; use grey relational analysis to calculate the correlation between vulnerabilities and identify high-risk vulnerability combinations that may form attack chains. The process is as follows:

[0064] Vulnerability feature vector construction: For each vulnerability Extract its feature vector:

[0065]

[0066] Grey relational degree calculation: Calculate vulnerability pairs ( Grey relational degree between :

[0067]

[0068] in For the vulnerability pair ( The degree of gray correlation between them The dimension of the feature vector. For vulnerabilities The value at the k-th feature dimension, after normalization, For vulnerabilities The value at the k-th feature dimension is normalized, where k is the feature dimension index. The resolution coefficient is set to 0.5. It is the minimum absolute difference between two vulnerability feature values ​​across all feature dimensions. The maximum absolute difference between two vulnerability feature values ​​across all feature dimensions;

[0069] Chain reaction risk amplification: Regarding the degree of correlation Vulnerabilities with a 0.7 rating or higher are considered highly correlated, and a cascading risk bonus is added to the base inherent risk value: ,in , The initial risk value for each vulnerability;

[0070] The final inherent risk value = the basic inherent risk value + the cascading risk bonus.

[0071] Business criticality weight assignment: By analyzing network traffic and learning business logic, a business criticality weight is automatically or manually assigned to the business functions carried by the software.

[0072] Automatic weight assignment: Maintains a list of critical devices (predefined by the administrator, such as the IP addresses of core PLCs and SCADA servers). By analyzing network traffic logs, it counts the number of data packets or connection attempts made by the software with devices in the list per unit time. The higher the communication frequency, the higher the criticality weight. The specific calculation formula is: Automatic weight = min(1.0) (Actual communication frequency / reference communication frequency), where the reference communication frequency is determined by a historical baseline;

[0073] Manual assignment: Administrators can mark the software as core, important, or general based on business importance and map it to specific weight values;

[0074] Weight fusion: The final business criticality weight is the larger value between the automatic weight and the manual weight to ensure that the risk is not underestimated;

[0075] Network exposure assessment: This assesses the network exposure level of the software; assessment factors include:

[0076] Accessibility: Exposed to the Internet (3 points), exposed to the corporate intranet (2 points), only on the industrial control network (1 point).

[0077] Authentication strength: Use weak password / default password (2 points), use strong password (1 point);

[0078] Host protection: The host has no security protection (2 points), but has basic protection (1 point).

[0079] Network exposure coefficient = (sum of scores for each factor) / maximum possible score. For example, if the total score is 4 and the maximum possible score is 7, the coefficient is approximately 0.57.

[0080] Dynamic risk fusion calculation: The final dynamic risk value is calculated using the following formula (or similar algorithm): Final risk value = inherent risk value × business criticality weight × (1 + network exposure surface coefficient), where the network exposure surface coefficient is an exposure score calculated based on factors such as network accessibility, authentication strength, and host protection, and is ≥0; the business criticality weight is a weighting coefficient set according to the importance of the software in the business, and is ≥1.

[0081] Based on the final risk score, software assets are classified as follows: 0-3 points are low risk, 4-6 points are medium risk, 7-9 points are high risk, and 10 points and above are critical risk. A risk report is generated, which clearly indicates whether the main source of risk is the vulnerability itself, the criticality of the business, or the excessive exposure.

[0082] The graph-based disposal strategy recommendation module, based on asset relationship graphs and game theory analysis, generates and recommends the optimal disposal strategy with the least impact on business for high-risk software; execution steps:

[0083] Triggering and Data Input: When the calculated final risk value reaches the high-risk or emergency risk threshold, the risk assessment report for the asset will be published to the high-risk alarm topic in the central data storage area. Listen to this topic; once a new alarm is received, the handling and analysis process will be initiated immediately.

[0084] Impact Scope Analysis: The analysis involved querying the asset relationship graph (a graph data structure where nodes represent assets and edges represent communication relationships) automatically generated based on network traffic to analyze all network assets and devices directly and indirectly affected by the high-risk software. For example, the analysis revealed that the high-risk HMI software was communicating with three PLCs and one data server.

[0085] Multi-strategy generation and simulation: Based on the impact scope analysis results, multiple alternative response strategies are automatically generated, and the business impact of each strategy is pre-assessed.

[0086] Strategy A (Precise Isolation): Generate a specific network access control rule that blocks communication between the high-risk software and specific non-essential IP addresses or ports, while allowing necessary communication with core production equipment to continue. For example, block the HMI software's internet access traffic, but allow it to access the PLC.

[0087] Strategy B (Virtual Patch): Generate rules for an industrial firewall or intrusion detection system to detect and block attack traffic that exploits known vulnerabilities in the software without requiring an immediate software upgrade.

[0088] Strategy C (Upgrade / Replacement Path Recommendation): Based on the gene mapping matching information, check with official channels whether the software has a security patch or an upgradeable secure version, and provide detailed download links and upgrade instructions.

[0089] Strategy D (Reinforcement Recommendation): Provides specific security configuration reinforcement recommendations for this software version, such as modifying default configurations and disabling unnecessary services.

[0090] Dynamic strategy optimization: Based on a game theory model, the behavior of attackers and defenders is simulated, the expected utility of each strategy is calculated, and the optimal strategy is recommended. The process is as follows:

[0091] Constructing a game theory model: Defining the defender's (our) action set For the generated set of disposal strategies, the set of attacker actions This is a collection of possible attack methods (such as vulnerability exploitation, password brute-force, supply chain attacks, etc.).

[0092] Payoff function definition: For each policy pair ( Define payment function ,in:

[0093] Strategies for Defenders The attacker took an attack The utility function value at that time;

[0094] Loss reduction = Loss caused by successful attack × (1 - Strategy) (Blocking rate); where the loss caused by a successful attack is the expected economic loss if the attack is successful, strategy. The blocking rate is the treatment strategy. Success rate of blocking a specific attack, ranging from 0 to 1;

[0095] Strategy cost = Strategy implementation cost Operation and maintenance costs + business impact costs;

[0096] Hybrid strategy Nash equilibrium solution: Assuming the attacker chooses an attack action with probability distribution p and the defender chooses a strategy with probability distribution q, find the Nash equilibrium point such that neither side can increase their own payoff by changing their strategy alone;

[0097] Optimal strategy selection: Under Nash equilibrium, the strategy with the highest defender probability is selected as the optimal recommended strategy, i.e. ;in: The optimal handling strategy, i.e., the best option recommended to the administrator. The parameter q represents the value of the variable that maximizes the function value. To determine the defender's strategy under Nash equilibrium The probability distribution;

[0098] The optimal strategy is highlighted in the strategy recommendation and its expected utility relative to other strategies is explained.

[0099] Policy Recommendation and Execution: Multiple generated policies and their pre-assessed business impacts (e.g., "Execute policy A to block its connection to the IT network, without affecting communication with the control network") are presented to the security administrator. The administrator can choose to issue the policies with a single click (policies A and B can be implemented through linkage with firewalls / switches), or manually handle them by referring to policies C and D. All actions and results are recorded and fed back to the system for optimizing future risk assessment models.

[0100] A method for identifying high-risk software in the industrial internet, comprising the following steps:

[0101] Step 1: Asset Discovery and Multimodal Feature Collection: All active devices and software processes are identified through a combination of active scanning and passive monitoring. Subsequently, the software's fingerprint features are comprehensively collected from four dimensions: network behavior, file static attributes, memory image, and process behavior, laying the data foundation for subsequent accurate identification.

[0102] Step Two: Software Gene Map Construction and Identity Recognition: The collected multimodal features are fused to construct a structured software gene map data object. By performing multi-level similarity matching between this map and a pre-built industrial software gene library, and combining error correction mechanisms such as neighbor node confidence propagation, the unique identity information of the software, such as the manufacturer, product line, and version number, can be accurately determined.

[0103] Step 3: Context-Aware Multidimensional Risk Analysis: First, calculate the risk value of inherent software vulnerabilities and analyze the potential chain attack effects between multiple vulnerabilities. Simultaneously, comprehensively assess the software's criticality in business flows and its network exposure, thereby transforming purely technical vulnerability risks into contextual risks that incorporate business impact.

[0104] Step Four: Dynamic Risk Fusion and Level Determination: A fusion algorithm summarizes the multi-dimensional analysis results into an intuitive risk score. This algorithm combines inherent risk values, business criticality weights, and network exposure surface coefficients to calculate the final dynamic risk value. Based on this score, the system automatically classifies software assets into four risk levels: low, medium, high, and urgent, and generates a clear risk report.

[0105] Step 5: Intelligent Disposal Strategy Generation and Execution: Based on the asset relationship graph analysis of its impact range, various strategies such as precise isolation, virtual patching, and upgrade recommendations are automatically generated. Game theory models are used to simulate attack and defense confrontations, quantitatively evaluate the expected utility of each strategy, recommend the optimal solution to the administrator, and support one-click execution, forming a closed loop from analysis to action.

[0106] The above formulas are all dimensionless calculations. Dimensionless calculations can be performed using various methods such as standardization, which will not be elaborated here. The formulas are derived from software simulations based on a large amount of collected data, and the preset parameters in the formulas can be set by those skilled in the art according to the actual situation.

[0107] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, ATA hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0108] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0109] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0111] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0112] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0113] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable ATA hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0114] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A high-risk software identification system for the industrial internet, characterized in that, Includes the following modules: The automatic construction module for industrial software gene maps generates unique digital identities for software assets in the network through multi-dimensional feature collection and fusion. The business context-aware dynamic risk assessment module comprehensively considers vulnerability severity, business criticality, and network exposure to dynamically quantify the true security risks of software assets. The graph-related disposal strategy recommendation module, based on asset relationship graphs and game analysis, generates and recommends the optimal disposal strategy with the least impact on business for high-risk software. The industrial software gene map automatic construction module specifically executes as follows: Multi-modal asset discovery and detection identifies active devices and the software processes and services running on them in the network through passive listening and active scanning; Multidimensional feature fingerprint extraction: software feature fingerprints are collected from four dimensions: network behavior, file static attributes, memory image, and process behavior. Gene map generation and matching integrates multidimensional feature fingerprints into structured software gene map data objects, and matches them with industrial software gene libraries to determine the unique identity of the software. The industrial software gene map automatic construction module also includes: Matching is performed through multi-level similarity calculation, prioritizing file hash value matching, followed by fuzzy matching of version information, and finally similarity matching of network behavior sequences. Once a match is successful, a version identification and error correction mechanism based on confidence propagation is initiated. The accuracy of the identification result is verified through contextual consistency checks, neighbor node confidence propagation, and historical version evolution rationality checks.

2. The industrial internet high-risk software identification system according to claim 1, characterized in that, The business context-aware dynamic risk assessment module is specifically executed as follows: Inherent risk value calculation is based on the software identity query vulnerability knowledge base, and the basic inherent risk value is calculated according to the severity and exploitability of the vulnerability. The assessment of the chain reaction effect of complex vulnerabilities analyzes the correlation between multiple vulnerabilities, identifies the combination of vulnerabilities that form an attack chain, and calculates the chain risk bonus. The importance of a business is determined by analyzing the communication frequency between the software and key devices or by manual marking by the administrator.

3. The industrial internet high-risk software identification system according to claim 2, characterized in that, The business context-aware dynamic risk assessment module also performs: Network exposure surface assessment evaluates the network exposure of software from three dimensions: accessibility, authentication strength, and host protection, and calculates the exposure surface coefficient. Dynamic risk fusion calculation integrates inherent risk values, business criticality weights, and network exposure surface coefficients to calculate the final dynamic risk value and classify risk levels.

4. The industrial internet high-risk software identification system according to claim 1, characterized in that, The specific execution of the processing strategy recommendation module for the associated graphs is as follows: Impact scope analysis: Based on the asset relationship map generated by automatic learning, analyze all network assets and devices directly and indirectly affected by high-risk software; Multi-strategy generation and simulation automatically generates handling strategies including isolation, virtual patching, upgrade and replacement path recommendations, and security hardening suggestions, and pre-assesses the business impact of each strategy.

5. The industrial internet high-risk software identification system according to claim 4, characterized in that, The graph association processing strategy recommendation module also performs the following: Dynamic strategy optimization is based on a game theory model that constructs a game model between the defender and the attacker. By defining a payoff function and solving the mixed-policy Nash equilibrium, the strategy with the highest defender probability is selected as the optimal recommended strategy. The strategy recommendation and execution function presents the optimal strategy and its expected benefits to the administrator, supports one-click deployment or manual handling, and feeds back the handling results to the system to optimize the risk assessment model.

6. A method applied to an industrial internet high-risk software identification system according to any one of claims 1-5, characterized in that, Includes the following steps: B1. Asset Discovery and Multimodal Feature Acquisition: Identify software assets and collect their multi-dimensional feature fingerprints through active scanning and passive listening; B2. Software Genome Map Construction and Identity Recognition: Genome map is constructed by fusing feature fingerprints, and the unique identity of the software is determined through matching and error correction mechanisms; B3. Context-aware multidimensional risk analysis: Calculate inherent risks and assess vulnerability cascading effects, business criticality, and network exposure surface; B4. Dynamic Risk Fusion and Level Determination: Integrating multi-dimensional risk factors to calculate the final risk value and classify risk levels; B5. Intelligent Disposal Strategy Generation and Execution: Analyze the scope of impact and generate multiple strategies. Recommend the optimal strategy through game analysis and execute it.

Images