A ship cyber security protection system and method

Abstract

The application provides a kind of ship network security protection system and method, it is related to ship network security technical field, the system includes storage module, detection management module, selection module and auditing and output module, the ship network security protection system and method provided by the application adopt double confirmation mechanism, the access or change of ship network key parameters is confirmed twice using automated vulnerability scanning tool, additional confirmation step and security requirement are increased, the defense capability of system to potential security threat is significantly improved, it is helpful to prevent hacker or malicious user from executing illegal operation by forging identity or exploiting system vulnerability, so as to protect the safe and stable operation of ship network system, and adopt priority sequencing rule, improve vulnerability processing efficiency, and high-risk vulnerability is processed preferentially to help reduce the exposure of system, reduce the possibility of being attacked by attacker, to improve the overall security of system, protect critical data and business from being violated.

Description

Technical Field

[0001] This invention relates to the field of marine cybersecurity technology, and in particular to a marine cybersecurity protection system and method. Background Technology

[0002] With the rapid development of information technology, computer network technology, information fusion technology, and artificial intelligence technology are increasingly being applied in the shipbuilding industry. The industry is becoming increasingly reliant on various information systems and networks to support ship operations and safety. However, these information systems and networks face increasingly complex security threats, such as cyberattacks, data breaches, and network interference. While the rapid development of information technology brings convenience to the shipbuilding industry, it also introduces more cybersecurity risks. Cybersecurity incidents can lead to operational disruptions, equipment damage, or data loss, resulting in significant economic losses for ship owners and operators. For civilian vessels, these economic losses are particularly pronounced, as they typically undertake cargo or passenger transport missions. Once cybersecurity is compromised, their operational efficiency and profitability are directly affected.

[0003] Existing ship network security protection systems use a single confirmation method. Before performing a sensitive operation, the user must first authenticate their identity by entering a username and password. After successful authentication, the system will display a confirmation dialog box, requiring the user to confirm again whether to perform the operation. The user can then click "Confirm" or "Yes" to execute the operation.

[0004] The existing one-time confirmation method is still insufficient in terms of network security protection. The one-time confirmation method is relatively simple and has poor protection capabilities. Hackers and malicious users can carry out illegal operations by forging identities or exploiting system vulnerabilities, thereby threatening the network security of ships.

[0005] Therefore, it is necessary to provide a new ship cybersecurity protection system and method to solve the above-mentioned technical problems. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a ship network security protection system and method.

[0007] The ship network security protection system provided by this invention includes: a storage module for storing user information and allocating corresponding network access permissions based on the user information; a detection and management module for establishing a unified vulnerability management platform to centrally manage and track various network security vulnerabilities, and setting a dual confirmation mechanism and priority ranking rules based on the vulnerability data reflected by the vulnerability management platform; a selection module for selecting automated vulnerability scanning tools and integrating the automated vulnerability scanning tools into the dual confirmation process within the vulnerability management platform; and an audit and output module for using automated vulnerability scanning tools to perform secondary confirmation on access to or modification of key parameters of the ship network, and taking corresponding security measures based on the audit results.

[0008] The dual confirmation mechanism specifically includes the following steps: Step 1: The user logs into the ship network security protection system, enters their username and password, and the system verifies the user's identity and permissions based on the role model; Step 2: After the initial confirmation is successful, the system activates an automated vulnerability scanning tool for secondary confirmation. This tool scans the network area where the user attempts to access or modify key parameters; Step 3: The automated vulnerability scanning tool determines whether there are high-risk vulnerabilities and security risks in the network area. If they exist, proceed to Step 4; otherwise, proceed to Step 6; Step 4: Based on the scan results, assess the potential impact of high-risk vulnerabilities and security risks on system security and generate a scan and risk assessment report. If the risk assessment result of the scan and risk assessment report is successful, proceed directly to Step 6; otherwise, proceed to Step 5; Step 5: The system requires the user to take additional security measures or provide additional reasons and proof for the operation. If the proof is successful, proceed to Step 6; otherwise, proceed to Step 8; Step 6: The system displays that the secondary confirmation has been successful; Step 7: The user can now access or modify key parameters in the ship network system; Step 8: The system issues an alarm.

[0009] In addition, the priority ranking rule includes classifying vulnerabilities according to their potential severity, dividing them into three categories: high-risk, medium-risk, and low-risk. Specifically, it includes: S1, collecting the latest vulnerability information from the vulnerability management platform; S2, integrating the collected vulnerability information and removing duplicates; S3, after removing duplicates, classifying and prioritizing the integrated vulnerability information, and prioritizing vulnerabilities with high severity and wide impact based on their severity and scope of impact.

[0010] The present invention also provides a method for protecting ship network security, applicable to the aforementioned ship network security protection system, the method comprising the following steps:

[0011] Step 1, Input Phase: Establish a unified vulnerability management platform, and input users' names, passwords, and responsibilities into the vulnerability management platform to create different role models;

[0012] Step 2, Design Phase: Based on the vulnerability data reflected by the vulnerability management platform, set up a dual confirmation mechanism and priority ranking rules;

[0013] Step 3: Select an automated vulnerability scanning tool based on the vulnerability management platform, configure the selected automated vulnerability scanning tool, and integrate the automated vulnerability scanning tool into the dual confirmation process within the vulnerability management platform;

[0014] Step 4: Use automated vulnerability scanning tools to scan the network system and perform secondary verification based on the scan results. When the scan finds that key parameters have been illegally accessed or changed, or that there are serious vulnerabilities, the system triggers the secondary verification mechanism.

[0015] Step 5: Based on the results of the second confirmation, the system takes the following security measures, including: restricting network access, isolating affected system parts, and fixing vulnerabilities;

[0016] Step Six: After the secondary confirmation is completed, the system records all operations related to the secondary confirmation and security measures, including the time, user, and operation content.

[0017] Compared with related technologies, the ship network security protection system and method provided by the present invention have the following beneficial effects:

[0018] 1. This method employs a dual-confirmation mechanism, utilizing automated vulnerability scanning tools to perform secondary confirmation of access to or modification of critical parameters of the ship's network. This adds extra confirmation steps and security requirements, significantly improving the system's ability to defend against potential security threats. It helps prevent hackers or malicious users from performing illegal operations by forging identities or exploiting system vulnerabilities, thereby protecting the safe and stable operation of the ship's network system.

[0019] 2. This method employs a risk assessment approach, combining a graph neural network (GNN) to construct a system security graph model and a fuzzy comprehensive evaluation algorithm. This achieves the following: Visualization of risk propagation paths: The GNN model abstracts system components into a graph structure, intuitively displaying the propagation path and key nodes of security risks, helping to quickly locate weak points in the system. Precise quantification of vulnerability impact scope: Vulnerability information is mapped to the graph structure model, and the potential impact on other components is analyzed by combining vulnerability type, location, and severity, avoiding the limitations of isolated vulnerability assessments. Multi-factor dynamic weighted assessment: The fuzzy comprehensive evaluation algorithm comprehensively considers factors such as vulnerability severity, exploitation difficulty, impact scope, and node importance. Through weight allocation and single-factor evaluation, a more reasonable risk level is derived, reducing the bias of single-indicator assessments. Weighted calculation of overall risk level: Combining the risk assessment results of all vulnerabilities with the graph structure model, a weighted average algorithm is used to derive the overall system risk level, providing maintenance personnel with clearly prioritized remediation strategies and improving vulnerability handling efficiency.

[0020] 3. This method adopts a priority sorting rule to prioritize the handling of high-risk and high-severity vulnerabilities, thereby improving the efficiency of vulnerability handling. Furthermore, prioritizing the handling of high-risk vulnerabilities helps reduce the system's exposure surface, decreases the possibility of being exploited by attackers, and thus improves the overall security of the system, protecting critical data and business from harm. Attached Figure Description

[0021] Figure 1 This is a structural block diagram of the ship network security protection system provided by the present invention;

[0022] Figure 2 A flowchart of the double confirmation mechanism;

[0023] Figure 3 The flowchart illustrates the overall process of the ship network security protection method provided by this invention. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0025] Please refer to the following: Figures 1 to 3 ,in, Figure 1 A flowchart illustrating the overall process of the ship network security protection system provided by this invention; Figure 2 A flowchart of the double confirmation mechanism; Figure 3 The flowchart illustrates the overall process of the ship network security protection method provided by this invention.

[0026] In the specific implementation process, such as Figures 1 to 3 As shown, the ship network security protection system provided by the present invention includes a storage module for storing user information and allocating corresponding network access permissions according to the user information.

[0027] It should be noted that the storage module is used to store user information, including but not limited to username, password, role model, permission level, etc. Based on the user information, the system can automatically assign corresponding network access permissions to ensure that each user can only access network resources within their authorized scope.

[0028] The detection and management module is used to establish a unified vulnerability management platform to centrally manage and track various network security vulnerabilities. Based on the vulnerability data reflected by the vulnerability management platform, it sets up a dual confirmation mechanism and priority sorting rules.

[0029] It should be noted that the dual confirmation mechanism requires users to perform additional confirmation before executing sensitive operations in order to reduce the risk of accidental or malicious operations.

[0030] The priority ranking rules sort vulnerabilities according to their severity and urgency, ensuring that the system can fix and handle critical vulnerabilities in a timely manner.

[0031] The selection module is used to select automated vulnerability scanning tools and integrate these tools into the dual-confirmation process within the vulnerability management platform.

[0032] It should be noted that automated vulnerability scanning tools can automatically perform a comprehensive scan of network systems, detect potential vulnerabilities and threats, and through integration with a two-factor authentication process, the vulnerability management platform can promptly trigger a secondary authentication mechanism when a vulnerability is discovered, ensuring the legality and security of user operations.

[0033] The audit and output module uses automated vulnerability scanning tools to perform secondary verification of access to or modification of key parameters of the ship's network, and takes corresponding security measures based on the audit results.

[0034] It should be noted that during the secondary verification process, the system will review the user's operation request based on the scan results and risk assessment results. If the review is successful, the user is allowed to perform the operation; if the review fails, corresponding security measures will be taken, such as restricting network access and isolating affected system parts. Furthermore, when taking corresponding security measures, the system will also record all operations related to the secondary verification and security measures, including the recording time, user, and operation content.

[0035] It should be noted that the adoption of a dual-confirmation mechanism, which uses automated vulnerability scanning tools to perform secondary confirmation of access to or modification of critical parameters of the ship's network, adds extra confirmation steps and security requirements, significantly improving the system's ability to defend against potential security threats. This helps prevent hackers or malicious users from performing illegal operations by forging identities or exploiting system vulnerabilities, thereby protecting the safe and stable operation of the ship's network system.

[0036] refer to Figures 1 to 3 As shown, in the detection and management module, the vulnerability management platform uses segmented updates to obtain the latest vulnerability information and remediation solutions in a timely manner and updates them in real time. The remediation solutions include patch fixes and configuration modifications.

[0037] The priority ranking rules include classifying vulnerabilities according to their potential severity, dividing them into three categories: high-risk, medium-risk, and low-risk.

[0038] The priority ranking rules include classifying vulnerabilities into three categories: high-risk, medium-risk, and low-risk, based on their potential severity. The specific steps are as follows:

[0039] S1. Collect the latest vulnerability information from the vulnerability management platform to ensure the accuracy of the information;

[0040] S2. Integrate the collected vulnerability information, remove duplicates, and avoid redundancy in subsequent processing;

[0041] S3. After removing duplicates, classify and prioritize the integrated vulnerability information. Classify and prioritize the vulnerabilities based on factors such as severity and scope of impact, and prioritize vulnerabilities with high severity and wide scope of impact.

[0042] It should be noted that the vulnerability classification into high-risk, medium-risk, and low-risk categories is analyzed as follows:

[0043] High-risk vulnerabilities: Vulnerabilities that can lead to serious consequences such as system crashes, data breaches, and exploitation by malicious attackers.

[0044] Medium-risk vulnerabilities: These vulnerabilities will not directly cause system crashes or data leaks, but they can reduce system performance, affect user experience, or pose a risk of being exploited. They should be patched promptly to prevent potential security threats.

[0045] Low-risk vulnerabilities: Vulnerabilities that have a minor impact on system security and stability. Examples include incorrect interface display and inaccurate error messages.

[0046] Prioritization: High-risk vulnerabilities should be patched immediately, medium-risk vulnerabilities should be patched within one week, and low-risk vulnerabilities should be patched during system maintenance.

[0047] It should be noted that for high-risk vulnerabilities, immediate action should be taken to remediate them. The remediation steps are as follows:

[0048] Step 1: Back up data after discovering the vulnerability;

[0049] Backup data: Back up critical data and configuration files of the affected system;

[0050] Backup frequency: Back up immediately after each vulnerability is discovered.

[0051] Step 2: Locate the official patch or update for the affected software version and download it to your local machine;

[0052] Patch source: Software vendor's official website; Patch type: Security update, vulnerability fix, etc.

[0053] Step 3: Install the patch or update in a test environment and conduct thorough testing to ensure it does not break other functions of the system;

[0054] Test environment: A simulated environment similar to the production environment;

[0055] Test content includes: functional testing, performance testing, and security testing.

[0056] Step 4: After confirming that the patch or update is correct, deploy it to the production environment;

[0057] Deployment time: Deploy as soon as possible after testing is successful.

[0058] Step 5: Restart the affected system or service to ensure the patch or update takes effect;

[0059] Restart the service: Ensure the service runs normally after restarting.

[0060] Step 6: After the fix is ​​complete, continuously monitor system logs and security events to ensure that the vulnerability has been successfully fixed and no new security issues have been introduced.

[0061] Monitoring content includes: system logs, security event records, etc.

[0062] Monitoring frequency: Real-time monitoring or periodic inspection.

[0063] It should be noted that for medium-risk vulnerabilities, the remediation time is within one week, and the remediation steps are as follows:

[0064] Step 1: Discover and assess the vulnerability;

[0065] If a medium-risk vulnerability is discovered during a security scan or penetration test, assess the scope and severity of the vulnerability to confirm that it is a medium-risk vulnerability.

[0066] Step 2: Back up the data;

[0067] Backup data: Back up critical data and configuration files of the affected system;

[0068] Backup frequency: Perform backups before the first attempt to fix the vulnerability after it is discovered.

[0069] Step 3: Locate and download the patch;

[0070] Visit the software vendor's official website to find the official patch or update for the affected software version, and download the patch to your local computer.

[0071] Step 4: Test the patch;

[0072] Install the patch in a simulated environment similar to the production environment and conduct comprehensive testing, including functional testing, performance testing, and security testing, to ensure that the patch does not break other functions of the system.

[0073] Step 5: Deploy the patch;

[0074] Once the test is successful, deploy the patch to the production environment as soon as possible, within one week of discovering the vulnerability.

[0075] Step 6: Restart the system or service;

[0076] Restart the affected system or service to ensure the patch takes effect, and verify that the service functions correctly after restarting.

[0077] Step 7: Continuous monitoring;

[0078] After the repair is completed, continuously monitor system logs and security events. The monitoring content includes system logs and security event records. The monitoring frequency is set to real-time monitoring or periodic checks according to the actual situation.

[0079] It should be noted that for low-risk vulnerabilities, the remediation time is during system maintenance, and the remediation steps are as follows:

[0080] Step 1: Record the vulnerability;

[0081] When low-risk vulnerabilities are discovered during security scanning or penetration testing, vulnerability information is recorded, including the vulnerability type and scope of impact.

[0082] Step 2, Planned Repair;

[0083] Incorporate the remediation plan for low-risk vulnerabilities into the system maintenance schedule, determine the remediation time, and perform the remediation during the system maintenance window.

[0084] Step 3: Back up the data;

[0085] Before system maintenance, back up the critical data and configuration files of the affected system.

[0086] Step 4: Locate and download the patch;

[0087] Visit the software vendor's official website to find the official patch or update for the affected software version, and download the patch to your local computer.

[0088] Step 5: Deploy the patch;

[0089] During system maintenance, patches are deployed to the production environment to ensure that the deployment of patches does not interfere with the normal operation of the system.

[0090] Step 6: Continuous monitoring.

[0091] After the repair is completed, continuously monitor system logs and security events;

[0092] The monitoring content includes system logs and security event records;

[0093] The monitoring frequency is set to real-time monitoring or periodic inspection based on the actual situation.

[0094] It should be noted that high-risk vulnerabilities include remote code execution vulnerabilities and database disclosure vulnerabilities.

[0095] Remote code execution vulnerability: Attackers can exploit such vulnerabilities to remotely execute malicious code, thereby gaining complete control of the ship's network system, leading to the leakage of sensitive data, system tampering or damage, or even affecting the normal navigation of the ship.

[0096] Database breach vulnerability: This refers to a vulnerability in the database of a ship's network system that allows attackers to access and steal sensitive data, such as voyage plans and crew information, thereby threatening the ship's security and privacy.

[0097] Medium-risk vulnerabilities include file inclusion vulnerabilities, cross-site scripting vulnerabilities, and session hijacking vulnerabilities.

[0098] Low-risk vulnerabilities, such as weak password policy vulnerabilities and interface operation vulnerabilities, including the functionality or display method of the interface, will not lead to data leakage or system paralysis.

[0099] refer to Figures 1 to 3 As shown, the automated vulnerability scanning tool is the Nessus vulnerability scanning tool, and the Nessus vulnerability scanning tool is integrated into the dual-confirmation process within the vulnerability management platform;

[0100] It should be noted that within the vulnerability management platform, when Nessus detects a potential vulnerability, it triggers a double confirmation process. Double confirmation can avoid false positives and false negatives, improving the accuracy and efficiency of vulnerability management.

[0101] It should be noted that automated vulnerability scanning and dual-confirmation processes can promptly identify and fix security vulnerabilities in ship network systems, thereby improving the overall security protection capabilities of ship networks and reducing the risk of cyberattacks.

[0102] In some embodiments, the ship network security protection method provided by the present invention includes the following steps:

[0103] Step 1, Input Phase: Establish a unified vulnerability management platform and input users' names, passwords, and responsibilities into the platform to create different role models.

[0104] Step 2, Design Phase: Based on the vulnerability data reflected by the vulnerability management platform, set up a dual confirmation mechanism and priority ranking rules;

[0105] Step 3: Select an automated vulnerability scanning tool based on the vulnerability management platform, configure the selected automated vulnerability scanning tool, and integrate the automated vulnerability scanning tool into the dual confirmation process within the vulnerability management platform;

[0106] Step 4: Use automated vulnerability scanning tools to scan the network system and perform secondary verification based on the scan results. When the scan finds that key parameters have been illegally accessed or changed, or that there are serious vulnerabilities, the system triggers the secondary verification mechanism.

[0107] Step 5: Based on the results of the second confirmation, the system takes security measures such as restricting network access, isolating affected system parts, and fixing vulnerabilities;

[0108] Step Six: After the secondary confirmation is completed, the system records all operations related to the secondary confirmation and security measures, including the time, user, and operation content.

[0109] In step two, the vulnerability management platform utilizes segmented updates to promptly obtain the latest vulnerability information and remediation solutions for real-time updates. The segmented updates include the following steps:

[0110] Step A: First, divide the update operation into multiple stages, each stage including specific update tasks, time nodes, and responsible persons;

[0111] Step B: Next, update the non-critical parts of the system, including the updates to the auxiliary functions. After updating the non-critical parts, use the performance testing tool JMeter to perform functional, performance and security tests on the system respectively, and compare the test results to ensure that the update has not introduced any new problems.

[0112] Step C: After confirming that the non-critical parts have been updated successfully, start updating the core business parts of the system. Use the performance testing tool JMeter to perform functional, performance and security tests on the system. Compare the test results to ensure that the update has not introduced any new problems. When problems are found, the system is rolled back or repaired, and the update plan is adjusted.

[0113] Step D: After the core business components have been updated, the critical parts of the system are updated, including the database and core application services. Before the update, multiple tests are conducted, including data migration tests and backup and recovery tests.

[0114] It should be noted that by dividing the update process into multiple stages and conducting rigorous testing after each stage, potential problems can be identified and fixed in a timely manner, thereby reducing the risk of introducing new problems during the update process.

[0115] It should be noted that when updating non-critical and core business components, using the performance testing tool JMeter for functional, performance, and security testing can ensure that the updated system still maintains stability and security.

[0116] It should be noted that conducting multiple tests before updating critical components, including data migration tests and backup and recovery tests, can ensure data integrity and system recovery capabilities during the update process, thereby improving system reliability.

[0117] In some embodiments, such as Figure 2 As shown, the specific steps of the double confirmation mechanism in step two are as follows:

[0118] Step 1: First, the user logs into the ship network security protection system, enters their username and password, and the system verifies the user's identity and permissions based on the role model; ensuring that only users with the corresponding permissions can proceed to the next step.

[0119] Step 2: After the initial confirmation is passed, the system starts an automated vulnerability scanning tool for a second confirmation. The automated vulnerability scanning tool includes scanning the network areas where the user attempts to access or change key parameters.

[0120] Step 3: The automated vulnerability scanning tool determines whether there are high-risk vulnerabilities and security risks in the network area; if so, proceed to step 4; otherwise, proceed to step 6.

[0121] Step 4: Based on the scan results, assess the potential impact of high-risk vulnerabilities and security risks on system security, and generate a scan and risk assessment report; if the risk assessment result of the scan and risk assessment report is satisfactory, proceed directly to Step 6; if the risk assessment result of the scan and risk assessment report is unsatisfactory, proceed to Step 5.

[0122] Step 5: The system requires the user to take additional security measures or provide additional reasons and proof for the operation to ensure its legality and necessity, such as using a more secure access method or providing additional authentication information; if the proof is successful, proceed to Step 6; if the proof fails, proceed to Step 8.

[0123] Step 6: The system displays a message indicating that the second confirmation has been successful;

[0124] Step 7: Users can access or modify key parameters in the ship's network system to ensure that operations are carried out under strict security control.

[0125] Step 8: The system will issue an alarm.

[0126] The automated vulnerability scanning tool in step 2 of the dual verification mechanism performs secondary verification, which also includes secondary verification based on reinforcement learning and intelligent vulnerability scanning. The specific process is as follows:

[0127] S1. Reinforcement learning to optimize scanning strategy: First, reinforcement learning algorithms, such as Q-Learning or Deep QNetwork, DQN, are used to build an intelligent vulnerability scanning strategy model. The intelligent vulnerability scanning strategy model uses the system network environment as the learning environment and uses the quantity and quality of discovered vulnerabilities as reward signals.

[0128] The specific implementation steps are as follows:

[0129] S1.1 Define the state space: The state space includes the current network state, such as network topology, active services, open ports, historical scan results, and time factors;

[0130] S1.2 Define the action space: The action space includes actions to adjust scanning parameters, such as expanding or shrinking the scanning range, increasing or decreasing the scanning depth, and adjusting the scanning frequency. During each vulnerability scan, the intelligent vulnerability scanning strategy model dynamically adjusts scanning parameters, such as scanning range, scanning depth, and scanning frequency, based on the current network status and historical scanning experience, to achieve more efficient and comprehensive vulnerability scanning.

[0131] S1.3 Define the reward function: The reward function is set according to the scan results. A high positive reward is given for successfully discovering a high-risk vulnerability, a lower positive reward is given for discovering a medium- or low-risk vulnerability, and a negative reward is given for false positives or false negatives.

[0132] S1.4 Model Training: Using historical scan data as the training set, the intelligent vulnerability scanning strategy model is continuously optimized through iteration, enabling it to dynamically adjust scanning parameters based on the current network status and historical scanning experience.

[0133] S2. Automated Vulnerability Scanning Tool: After the user's initial confirmation, the system automatically starts the scanning tool to perform a comprehensive scan of the network area where the user attempted to access or change key parameters. The scanning tool not only detects known security vulnerabilities or weaknesses in the system, but also uses anomaly detection, behavioral analysis, and machine learning algorithms to analyze network traffic, system logs, and other data to uncover potential new security threats. Through pattern recognition and data mining techniques, the scanning tool can identify activities that deviate significantly from normal behavior, thereby discovering unknown attack methods and vulnerabilities.

[0134] It should be noted that pattern recognition is a technique that uses statistical or machine learning methods to extract features from data and identify known or unknown patterns. In cybersecurity, it is used to detect activities that deviate significantly from normal behavior, i.e., abnormal behavior, thereby discovering potential attacks or vulnerabilities.

[0135] Applications of pattern recognition in vulnerability scanning:

[0136] Normal behavior modeling: The scanning tool first trains the model using historical data, such as normal network traffic and system logs, to establish a baseline of normal behavior and learn the patterns of user access frequency, time, and operation type.

[0137] Anomaly detection:

[0138] When real-time data, such as current network traffic, deviates significantly from the baseline, the tool will flag it as an anomaly. For example:

[0139] Traffic anomaly: A sudden surge in requests from the same IP address may indicate a DDoS attack.

[0140] Abnormal operation: Users frequently modify critical configurations outside of working hours, which may indicate an internal threat;

[0141] Protocol anomaly: The data packet contains illegal fields or formats, which may be an attempt to exploit a vulnerability;

[0142] By matching known attack patterns (such as specific strings in SQL injection or malicious script characteristics in cross-site scripting attacks), attack behaviors can be directly identified.

[0143] It's important to note that data mining is the process of extracting valuable information from large amounts of data, including association rule mining, cluster analysis, and classification prediction. In cybersecurity, it's used to discover hidden threat patterns or vulnerability associations.

[0144] Applications of data mining in vulnerability scanning:

[0145] This includes uncovering the correlations between vulnerabilities. For example, discovering a high probability of a service port being open and a specific vulnerability, such as a weak password, is helpful. After attackers penetrate through vulnerability A, they often use vulnerability B to further escalate privileges. Grouping similar behaviors or vulnerabilities helps identify unknown threats. For example, clustering unknown traffic with known attack traffic helps determine if it is a new type of attack. Clustering vulnerabilities by their impact and severity helps optimize remediation priorities. Predicting the likelihood of exploiting a certain type of vulnerability, such as an unpatched CVE, helps predict peak attack periods and adjust protection strategies in advance.

[0146] In scanning tools, pattern recognition and data mining work together, which has the following advantages:

[0147] Pattern recognition: Quickly detect known attack patterns or obvious abnormal behavior;

[0148] Data mining: In-depth analysis of the correlations or potential patterns in abnormal data to uncover unknown threats;

[0149] S3. Vulnerability Information Collection and Organization: The scanning tool records detected vulnerability information, including but not limited to vulnerability type (e.g., SQL injection, cross-site scripting), vulnerability location (e.g., specific IP address, service port), and vulnerability severity (e.g., high-risk, medium-risk, low-risk). The recorded vulnerability information is then organized into structured data, including database tables and JSON files, containing fields such as vulnerability ID, description, discovery time, impact scope, and remediation suggestions. Based on this structured vulnerability data, the system performs a risk assessment, prioritizing vulnerabilities according to their severity and impact scope. High-risk vulnerabilities are addressed immediately, medium-risk vulnerabilities are addressed within a specified timeframe, and low-risk vulnerabilities are addressed during system maintenance.

[0150] It is worth noting that the above-mentioned secondary verification process based on reinforcement learning and intelligent vulnerability scanning can improve the vulnerability discovery capabilities and processing efficiency of the ship network security protection system, thereby further enhancing the system's security and stability.

[0151] It should be noted that if the risk assessment result of the scan and risk assessment report in step 4 above fails, the system requires the user to take additional security measures, such as using a more secure access method or providing additional authentication information. Among these, using a more secure access method can be secure channel access, that is, accessing through an encrypted secure channel, such as HTTPS or SSH, to prevent data from being intercepted or tampered with during transmission, or restricting access time and location. That is, the system can set specific access time and location restrictions, allowing access to key parameters only within a specific time period or in a specific geographical location, thereby preventing unauthorized access and potential security risks.

[0152] It should be noted that the dual authentication mechanism effectively improves the security of network systems by adding a layer of automated vulnerability scanning and risk assessment. It can detect and address potential security vulnerabilities in a timely manner before users attempt to access or change critical parameters, preventing malicious attacks and unauthorized access.

[0153] The following analysis pertains to the risk assessment phase:

[0154] 1. Constructing a system safety graph model: First, the graph neural network algorithm (GNN) is used to abstract the ship network system into a graph structure model;

[0155] In this model:

[0156] Nodes: Represent various components in the system, including but not limited to servers, network devices such as routers, switches, applications, and databases;

[0157] Edges: Represent the connection between components and the direction of data flow. The weight of an edge indicates the frequency, importance, or security level of data transmission.

[0158] 2. Graph structure model construction steps: First, collect the topology information, component list and their interconnection relationships of the ship network system. Based on the collected data, define the nodes and edges in the graph and set the corresponding attributes, such as node type and edge weight. Use graph visualization tools, such as Gephi, to visualize the graph model and intuitively show the system's security architecture and potential security risk propagation paths.

[0159] 3. Application of graph structure model: By analyzing the paths and connectivity in the graph, possible propagation paths and key nodes of security risks can be identified. Based on the degree and centrality indicators of the nodes, key components in the system can be identified. Failure or attack on these components can lead to the paralysis of the entire system.

[0160] It is worth noting that, for critical nodes: In the graph structure model, nodes represent various components of the system, such as servers, network devices, applications, etc. Critical nodes refer to those nodes that are of high importance or vulnerability in the graph. Their failure or attack will have a significant impact on the security and stability of the entire system.

[0161] Identification criteria: Degree: The degree of a node refers to the number of other nodes directly connected to it. In a graph structure model, nodes with higher degrees tend to undertake more data transmission or processing tasks, so their failure or attack can lead to more risk propagation.

[0162] For critical components: Critical components refer to the actual physical or logical entities in the system, such as servers, routers, databases, etc. In the graph structure model, critical components usually correspond to the key nodes in the graph. Critical components undertake the core functions of the system, such as data processing, storage, and transmission. Their failure or attack can lead to the partial or complete loss of system functions.

[0163] For the risk assessment phase described above, vulnerability information can also be mapped to a graph structure model. The specific steps are as follows:

[0164] 1. Vulnerability Information Collection: During the vulnerability scanning phase, automated vulnerability scanning tools are used to collect vulnerability information in the system, including vulnerability type, location, and severity.

[0165] 2. Vulnerability Information Mapping: The collected vulnerability information is mapped to the system security graph model. The specific component where each vulnerability is located is mapped to a node in the graph. The specific location of the vulnerability is marked on the node, such as a functional module of an application or a port of a network device. Based on the nature of the vulnerability and the connection relationship in the graph, the other nodes and scope that the vulnerability may affect are analyzed. The vulnerability information mapping results are visualized, and different types of vulnerabilities are distinguished by different colors or shapes of markers, as well as the importance and vulnerability of the node where the vulnerability is located.

[0166] 3. Fuzzy Comprehensive Evaluation Risk Assessment: The fuzzy comprehensive evaluation algorithm is adopted to comprehensively consider the impact of multiple factors on vulnerabilities and system risks, including vulnerability severity, scope of impact, exploitation difficulty, and node importance.

[0167] Regarding vulnerability severity: Vulnerabilities are scored based on their potential harm, such as high-risk, medium-risk, and low-risk.

[0168] Regarding the scope of impact: scores are assigned based on the number and importance of other nodes that the vulnerability may affect;

[0169] For exploitation difficulty: scores are given based on how easy it is for attackers to exploit the vulnerability;

[0170] Regarding node importance: a score is awarded based on the importance and vulnerability of nodes in the system security graph model;

[0171] The steps of fuzzy comprehensive evaluation are as follows:

[0172] a. Establish the evaluation set: Define the evaluation set V = {high risk, medium risk, low risk};

[0173] b. Establish a weight set: Based on the degree of influence of each factor on risk, assign corresponding weights W={w1,w2,w3,w4};

[0174] c. Single-factor evaluation: Perform single-factor evaluation on each factor to obtain the fuzzy evaluation matrix R;

[0175] d. Comprehensive evaluation: Using fuzzy synthesis operators, such as the M(∧,∨) operator, the weight set W and the fuzzy evaluation matrix R are synthesized to obtain the comprehensive evaluation result B;

[0176] e. Defuzzification: Defuzzify the comprehensive evaluation result B to obtain the specific risk level.

[0177] At this point, by combining the risk assessment results of all vulnerabilities and the system security graph model, a comprehensive assessment of the security risks faced by the entire system is conducted, and the final overall risk level of the system is obtained through a weighted average algorithm.

[0178] It should be noted that the fuzzy comprehensive evaluation algorithm is a multi-factor decision analysis method based on fuzzy mathematics theory. It introduces fuzzy sets and membership functions to handle the uncertainty and fuzziness in the evaluation process. In the risk assessment stage of ship network security protection systems, the fuzzy comprehensive evaluation algorithm can comprehensively consider multiple factors, such as the severity of vulnerabilities, the scope of impact, the difficulty of exploitation, and the importance of nodes, and their impact on vulnerabilities and system risks, thereby obtaining more reasonable risk assessment results.

[0179] It should be noted that automated scanning and risk assessment can greatly simplify the user's operation process, making the dual-confirmation mechanism more centralized and efficient in security management, and helping to promptly identify and address potential security issues.

[0180] This invention proposes a ship network security protection system and method. The system integrates a storage module, a detection management module, a selection module, and an audit and output module. By integrating a dual confirmation mechanism (using automated vulnerability scanning tools to perform secondary verification of key operations) and a dynamic risk assessment model (combining graph neural networks and fuzzy comprehensive evaluation algorithms), it effectively defends against identity spoofing attacks and system vulnerability exploitation. At the same time, it optimizes the vulnerability remediation process through priority sorting rules (classifying vulnerabilities into high-risk, medium-risk, and low-risk categories), significantly improving the system's security and operational efficiency, and ensuring the stable operation and data security of the ship's network system.

[0181] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects. The scope of the invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention, and no reference numerals in the claims should be construed as limiting the scope of the claims.

[0182] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A ship network security protection system, characterized in that, include: The storage module is used to store user information and allocate corresponding network access permissions based on the user information. The detection and management module is used to establish a unified vulnerability management platform, centrally manage and track various network security vulnerabilities, and set up a double confirmation mechanism and priority ranking rules based on the vulnerability data reflected by the vulnerability management platform; the selection module is used to select automated vulnerability scanning tools and integrate the automated vulnerability scanning tools into the double confirmation process within the vulnerability management platform. The audit and output module uses automated vulnerability scanning tools to perform secondary verification of access to or modification of key parameters of the ship's network, and takes corresponding security measures based on the audit results. The dual confirmation mechanism specifically includes the following steps: Step 1: The user logs into the ship network security protection system, enters their username and password, and the system verifies the user's identity and permissions based on the role model; Step 2: After the initial confirmation is successful, the system activates an automated vulnerability scanning tool for secondary confirmation. This tool scans the network area where the user attempts to access or modify key parameters; Step 3: The automated vulnerability scanning tool determines whether there are high-risk vulnerabilities and security risks in the network area. If they exist, proceed to Step 4; otherwise, proceed to Step 6; Step 4: Based on the scan results, assess the potential impact of high-risk vulnerabilities and security risks on system security and generate a scan and risk assessment report. If the risk assessment result of the scan and risk assessment report is successful, proceed directly to Step 6; otherwise, proceed to Step 5; Step 5: The system requires the user to take additional security measures or provide additional reasons and proof for the operation. If the proof is successful, proceed to Step 6; otherwise, proceed to Step 8; Step 6: The system displays that the secondary confirmation has been successful; Step 7: The user can now access or modify key parameters in the ship network system; Step 8: The system issues an alarm. The dual-confirmation mechanism includes a secondary confirmation process using automated vulnerability scanning tools, as well as a secondary confirmation based on reinforcement learning and intelligent vulnerability scanning. The specific process is as follows: S1. Reinforcement learning to optimize scanning strategy: First, a reinforcement learning algorithm is used to build an intelligent vulnerability scanning strategy model. The intelligent vulnerability scanning strategy model uses the system network environment as the learning environment and uses the quantity and quality of discovered vulnerabilities as reward signals. The specific implementation steps are as follows: S1.1 Define the state space: The state space includes network topology, active services, open ports, historical scan results, and time factors; S1.2 Define the action space: The action space includes actions to adjust scanning parameters. During each vulnerability scan, the intelligent vulnerability scanning strategy model dynamically adjusts the scanning parameters based on the current network status and historical scanning experience. S1.3 Define the reward function: The reward function is set according to the scan results. A high positive reward is given for successfully discovering a high-risk vulnerability, a lower positive reward is given for discovering a medium- or low-risk vulnerability, and a negative reward is given for false positives or false negatives. S1.4 Model Training: Using historical scan data as the training set, the intelligent vulnerability scanning strategy model is continuously optimized through iteration, enabling it to dynamically adjust scanning parameters based on the current network status and historical scanning experience. S2. Automated Vulnerability Scanning Tool: After the user's initial confirmation, the system automatically starts the scanning tool to perform a comprehensive scan of the network area where the user attempted to access or change key parameters. The scanning tool not only detects known security vulnerabilities or weaknesses in the system, but also uses anomaly detection, behavioral analysis, and machine learning algorithms to analyze network traffic and system log data to uncover potential new security threats. Through pattern recognition and data mining techniques, the scanning tool can identify activities that deviate from normal behavior, thereby discovering unknown attack methods and vulnerabilities. S3. Vulnerability Information Collection and Organization: The scanning tool records the detected vulnerability information, including the vulnerability type, and organizes the recorded vulnerability information into structured data, including database tables and JSON format files. Based on the structured data, the system performs a risk assessment and prioritizes the vulnerabilities according to their severity and impact. High-risk vulnerabilities are dealt with immediately, medium-risk vulnerabilities are dealt with within a specified time, and low-risk vulnerabilities are dealt with during system maintenance. In addition, the priority ranking rule includes classifying vulnerabilities according to their potential severity, dividing them into three categories: high-risk, medium-risk, and low-risk. Specifically, it includes: S1, collecting the latest vulnerability information from the vulnerability management platform; S2, integrating the collected vulnerability information and removing duplicates; S3, after removing duplicates, classifying and prioritizing the integrated vulnerability information, and prioritizing vulnerabilities with high severity and wide impact based on their severity and scope of impact.

2. The ship network security protection system according to claim 1, characterized in that, In the detection and management module, the vulnerability management platform uses segmented updates to obtain the latest vulnerability information and remediation solutions in a timely manner and updates them in real time. The remediation solutions include patch repairs and configuration modifications.

3. The ship network security protection system according to claim 2, characterized in that, The automated vulnerability scanning tool is the Nessus vulnerability scanning tool, and the Nessus vulnerability scanning tool is integrated into the dual-confirmation process within the vulnerability management platform.

4. A method for protecting ship network security, applicable to the ship network security protection system according to any one of claims 1 to 3, characterized in that, The method includes the following steps: Step 1, Input Phase: Establish a unified vulnerability management platform and input users' names, passwords, and responsibilities into the platform to create different role models; Step 2, Design Phase: Based on the vulnerability data reflected by the vulnerability management platform, set up a dual confirmation mechanism and priority ranking rules; Step 3: Select an automated vulnerability scanning tool based on the vulnerability management platform, configure the selected automated vulnerability scanning tool, and integrate the automated vulnerability scanning tool into the dual confirmation process within the vulnerability management platform; Step 4: Use automated vulnerability scanning tools to scan the network system and perform secondary verification based on the scan results. When the scan finds that key parameters have been illegally accessed or changed, or that there are serious vulnerabilities, the system triggers the secondary verification mechanism. Step 5: Based on the results of the second confirmation, the system takes the following security measures, including: restricting network access, isolating affected system parts, and fixing vulnerabilities; Step Six: After the secondary confirmation is completed, the system records all operations related to the secondary confirmation and security measures, including the time, user, and operation content.

5. The ship network security protection method according to claim 4, characterized in that, In step two, the vulnerability management platform utilizes segmented updates to promptly obtain the latest vulnerability information and remediation solutions for real-time updates. The segmented updates include the following steps: Step A: First, divide the update operation into multiple stages, each stage including specific update tasks, time nodes, and responsible persons; Step B: Next, update the non-critical parts of the system, including the updates to the auxiliary functions. After updating the non-critical parts, use the performance testing tool JMeter to perform functional, performance and security tests on the system respectively, and compare the test results to ensure that the update has not introduced any new problems. Step C: After confirming that the non-critical parts have been updated successfully, start updating the core business parts of the system. Use the performance testing tool JMeter to perform functional, performance and security tests on the system. Compare the test results to ensure that the update has not introduced any new problems. When problems are found, the system is rolled back or repaired, and the update plan is adjusted. Step D: After the core business components have been updated, the critical parts of the system are updated, including the database and core application services. Before the update, multiple tests are conducted, including data migration tests and backup and recovery tests.

6. The ship network security protection method according to claim 5, characterized in that, The risk assessment in the dual confirmation mechanism specifically includes: 1) Constructing a system security graph model: First, using the Graph Neural Network (GNN) algorithm, the ship network security protection system is abstracted into a graph structure model. In this graph structure model: Nodes: Represent various components in the system, including servers, network devices, applications, and databases; Edges: Represent the connection between components and the direction of data flow. The weight of an edge indicates the frequency, importance, or security level of data transmission. 2) Steps for constructing a graph structure model: First, collect the topology information, component list and their interconnection relationships of the ship network system. Based on the collected data, define the nodes and edges in the graph and set the corresponding attributes, including node type and edge weight. Then, use a graph visualization tool to visualize the graph structure model. 3) Application of graph structure model: By analyzing the paths and connectivity in the graph structure model, the propagation paths and key nodes of security risks can be identified. Based on the degree and centrality indicators of the nodes, the key components in the system can be identified. The failure or attack of these components can lead to the paralysis of the entire system.

7. The ship network security protection method according to claim 6, characterized in that, The risk assessment also includes mapping vulnerability information to a graph structure model, and the specific steps are as follows: 1) Vulnerability Information Collection: During the vulnerability scanning phase, automated vulnerability scanning tools are used to collect vulnerability information in the system, including vulnerability type, location, and severity. 2) Vulnerability information mapping: The collected vulnerability information is mapped to the system security graph model. The specific component where each vulnerability is located is mapped to a node in the graph. The specific location of the vulnerability is marked on the node. Based on the nature of the vulnerability and the connection relationship in the graph, the other nodes and scope affected by the vulnerability are analyzed. The vulnerability information mapping results are visualized. Different types of vulnerabilities are distinguished by different colors or shapes of markers, as well as the importance and vulnerability of the node where the vulnerability is located. 3) Fuzzy Comprehensive Evaluation Risk Assessment: A fuzzy comprehensive evaluation algorithm is used to comprehensively consider the impact of multiple factors on vulnerabilities and system risks, including vulnerability severity, scope of impact, exploitation difficulty, and node importance. The fuzzy comprehensive evaluation steps are as follows: a. Establish the evaluation set: Define the evaluation set V = {high risk, medium risk, low risk}; b. Establish a weight set: Based on the degree of influence of each factor on risk, assign corresponding weights W={w1,w2,w3,w4}; c. Single-factor evaluation: Perform single-factor evaluation on each factor to obtain the fuzzy evaluation matrix R; d. Comprehensive evaluation: Using the fuzzy synthesis operator, the weight set W and the fuzzy evaluation matrix R are synthesized to obtain the comprehensive evaluation result B; e. Defuzzification: Defuzzify the comprehensive evaluation result B to obtain the specific risk level; By combining the risk assessment results of all vulnerabilities with the system security graph model, a comprehensive assessment of the security risks faced by the entire system is conducted, and the final overall risk level of the system is obtained through a weighted average algorithm.

Images