Dynamic calculation method for exposure value of attack surface of power target based on multi-dimensional fusion
By constructing a target topology model of the power system and multi-dimensional attack surface indicators, and dynamically calculating the attack surface exposure value, the problem of real-time assessment lag in power system network security protection is solved, and more comprehensive risk assessment and resource optimization allocation are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-03-13
AI Technical Summary
Existing power system network security protection methods cannot quantify attack surface changes in real time, resulting in lagging protection and an inability to support dynamic defense and optimized resource allocation.
By constructing a target topology model, identifying interaction characteristics, calculating multi-dimensional attack surface indicators, dynamically calculating attack surface exposure values, and combining asset attributes and external threat intelligence, real-time risk assessment can be achieved.
It enhances the dynamism of attack surface assessment, provides scientific security situation awareness and defense decision-making, and enables the optimal allocation of security resources.
Smart Images
Figure CN121664480A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the technical field of network security protection, and in particular to a dynamic calculation method for the attack surface exposure value of a power target based on multi-dimensional fusion. Background Technology
[0002] Currently, with the accelerated development of digitalization and networking in the power system, a large number of dispatch control, transmission and distribution monitoring, and intelligent terminal devices are interconnected through information and communication networks. At the same time, the power system is gradually exposed to a complex network threat environment. Hacker attacks, malicious code, and APTs (Advanced Persistent Threats) may target and damage the power system, thereby endangering its stable operation.
[0003] Current power system network security protection mainly relies on static measures such as firewalls, intrusion detection, and whitelist access control. These methods focus on pre-configuration and policy restrictions, lacking the ability to detect real-time changes in the attack surface. For example, when the asset size, service exposure status, or communication topology of power targets change, traditional protection methods cannot quantify the new risk level in a timely manner, resulting in delayed attack surface assessment results and failing to support dynamic defense and resource optimization. Summary of the Invention
[0004] To address the issues of delayed attack surface assessment results and inability to quantify new risks in a timely manner in existing technologies, this application provides a dynamic calculation method for the attack surface exposure value of power targets that integrates multiple dimensions. This method can dynamically calculate the attack surface exposure value by combining the asset attributes, network interaction behavior, and external threat intelligence of power targets, thus providing support for the security situation awareness and defense decision-making of power systems.
[0005] Firstly, the above-mentioned inventive objective of this application is achieved through the following technical solution: A dynamic calculation method for the attack surface exposure value of a power target, comprising multi-dimensional fusion, the method comprising: Obtain target objects in the power system, model the target objects, and construct a target topology model; The interaction features between the target object and the external environment are identified through the target topology model, and the exposure features of the target object are extracted. Based on the exposure characteristics, attack surface attack indicators are calculated, and weights are assigned to each attack surface attack indicator to construct a multi-dimensional indicator system for the attack surface of the power system. The attack surface attack index of the multi-dimensional index system is quantified, and the real-time exposure value of the target object is dynamically calculated.
[0006] In a preferred embodiment, this application can be further configured as follows: the step of quantifying the attack surface attack indicators of the multi-dimensional indicator system and dynamically calculating the real-time exposure value of the target object specifically includes: The expression for calculating the real-time exposure value is as follows: (1) Specifically, express The target object exposure value at time t, where α, β, γ, and δ represent the static weights of the attack surface attack metrics. The accessibility index represents a multi-dimensional indicator system. The vulnerability index represents a multi-dimensional indicator system. Key index indicators representing a multi-dimensional indicator system. Indicators representing the availability of a multi-dimensional indicator system.
[0007] In a preferred embodiment, this application can be further configured as follows: the process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional indicator system of the power system's attack surface specifically includes: The calculation expression for the reachability index in the attack surface attack metrics is as follows: (2) Specifically, Represents the reachability index, which characterizes the visibility of a target object on the external attack surface. Indicates the actual number of open ports on the device. This indicates the total number of configurable ports on the device. This indicates the number of IP addresses that can be directly exposed to the public internet. This represents the total number of IPs owned by the target object. Port protocol The risk factor, This indicates the total number of port protocols owned by the target object. , , This indicates the weights assigned to the accessibility index. .
[0008] In a preferred embodiment, this application can be further configured as follows: the process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional indicator system of the attack surface of the power system further includes: The vulnerability index in the attack surface attack metrics is calculated as follows: (3) in, This represents a vulnerability index indicator. Indicates the first The CVSS baseline score for each vulnerability. Indicates the total number of vulnerabilities. This indicates the use of difficulty factors. Indicates the first The timing of vulnerability disclosure This represents the time decay constant.
[0009] In a preferred embodiment, this application can be further configured as follows: the process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional indicator system of the attack surface of the power system further includes: The calculation expression for the key index in the attack surface attack metrics is as follows: (4) in, A key index indicating the importance of a target within the power business system. A coefficient representing the importance of a business function. A coefficient indicating the importance of topological location. , representing the importance coefficient for a single point of failure. This indicates the number of redundant devices used for backup of the target object. , , This indicates the weighting of key index indicators. .
[0010] In a preferred embodiment, this application may be further configured as follows: the step of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing a multi-dimensional indicator system for the attack surface of the power system further includes: The exploitability index of the multi-dimensional indicator system is evaluated by comprehensively considering the number of publicly available exploit tools, vulnerability complexity, exploitation cost, and historical exploitation frequency.
[0011] In a preferred embodiment, this application can be further configured as follows: the process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing a weight allocation process in the multi-dimensional indicator system of the attack surface of the power system specifically includes: assigning weights to each attack surface attack indicator using the analytic hierarchy process or the entropy weight method.
[0012] In a preferred embodiment, this application can be further configured as follows: acquiring target objects in the power system, modeling the target objects, and constructing a target topology model specifically includes: Obtain target objects of the power system and analyze the topological relationships between the target objects to construct a target topology model of the power system. The topological relationships include communication relationships or service dependencies. For each target object, multidimensional attributes are defined, and the target topology model is optimized based on the defined multidimensional attributes and the business functions of the target object to obtain a target topology model carrying the multidimensional attribute set of the target.
[0013] In a preferred embodiment, this application can be further configured as follows: the step of identifying the interaction features between the target object and the external environment through the target topology model and extracting the exposure features of the target object specifically includes: The traffic data of the target object interacting with the external environment is obtained, the traffic data is parsed according to the protocol, and the interaction characteristics of the target object and the external environment are identified, including communication frequency, external dependencies and remote access interfaces. The interaction features are analyzed for security vulnerabilities, and security vulnerabilities that are at risk of being exploited are marked based on the analysis results. These security vulnerabilities include vulnerability information, unencrypted communication, and weak passwords.
[0014] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solutions: A dynamic calculation system for the attack surface exposure value of a power target, comprising multiple dimensions, is provided. The system is applied to the aforementioned dynamic calculation method for the attack surface exposure value of a power target, and includes: The target modeling module is used to acquire target objects in the power system, model the target objects, and construct a target topology model. The exposure feature extraction module is used to identify the interaction features between the target object and the external environment through the target topology model, and extract the exposure features of the target object; The attack surface index calculation module is used to calculate the attack surface attack index based on the exposure characteristics, assign weights to each attack surface attack index, and construct a multi-dimensional index system for the attack surface of the power system. The exposure value calculation module is used to quantify the attack surface attack indicators of the multi-dimensional indicator system and dynamically calculate the real-time exposure value of the target object.
[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. This application can update the attack surface exposure value in real time as the power system assets and network topology change, overcoming the shortcomings of the traditional static assessment method, enhancing the dynamics of the attack surface exposure value assessment, and comprehensively considering the asset characteristics, interactive behavior, and vulnerability of the target to achieve a more comprehensive attack surface measurement. By combining the asset attributes of the power target, network interactive behavior and external threat intelligence, the attack surface exposure value is dynamically calculated, providing support for the security situation awareness and defense decision of the power system. 2. This application also provides a scientific priority reference for power safety operation and maintenance based on the dynamic ranking of exposure values, realizes the optimal scheduling of security resources, and drives the defense of security resources based on the exposure risk of the attack surface; 3. This application can be applied to various power targets such as power dispatching, power transmission and distribution monitoring, and smart terminals. It has good scalability and promotion value and strong versatility. Attached Figure Description
[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.
[0017] Figure 1 This is a flowchart illustrating the implementation of the dynamic calculation method for the multi-dimensional fusion of power target attack surface exposure values in this embodiment.
[0018] Figure 2 This is a flowchart illustrating the implementation of step S10 of the dynamic calculation method for the exposure value of the power target attack surface in this embodiment.
[0019] Figure 3 This is a flowchart illustrating the implementation of step S20 of the dynamic calculation method for the exposure value of the power target attack surface in this embodiment.
[0020] Figure 4 This is a block diagram of the dynamic calculation system for the exposure value of the attack surface of a power target, which integrates multiple dimensions in this embodiment. Detailed Implementation
[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0022] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0023] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0024] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0025] In one embodiment, such as Figure 1 As shown, this application discloses a dynamic calculation method for the attack surface exposure value of a power target based on multi-dimensional fusion, which specifically includes the following steps: S10: Obtain target objects in the power system, model the target objects, and construct a target topology model.
[0026] Specifically, such as Figure 2 As shown, step S10 includes: S101: Obtain target objects of the power system and analyze the topological relationships between target objects to construct a target topology model of the power system. The topological relationships include communication relationships or business dependencies.
[0027] Specifically, in this embodiment, the target objects of the power system include dispatching hosts, monitoring terminals, relay protection devices, smart meters, communication gateways, etc. A target topology model is established based on topological relationships. The communication relationships or business dependencies between target objects are analyzed. The equipment topology diagram of the power system is established with target objects as nodes and communication relationships or business dependencies as edges, i.e., the target topology model.
[0028] S102: Define multi-dimensional attributes for each target object, and optimize the target topology model based on the defined multi-dimensional attributes and business functions of the target object to obtain a target topology model carrying the multi-dimensional attribute set of the target.
[0029] Specifically, multi-dimensional attributes are defined for each target object, including hardware characteristics, software version, open ports, protocol stack, historical vulnerabilities, etc. Based on business functions, such as defining functional attributes for each target object, such as control functions, acquisition functions, and forwarding functions, a multi-dimensional attribute set for each target object is formed. The target topology model is then optimized to obtain an optimized target topology model carrying the multi-dimensional attribute set.
[0030] S20: Identify the interaction features between the target object and the external environment through the target topology model, and extract the exposure features of the target object.
[0031] Specifically, such as Figure 3 As shown, step S20 includes: S201: Acquire traffic data of the target object interacting with the external environment, perform protocol parsing on the traffic data, and identify the interaction characteristics of the target object with the external environment, including communication frequency, external dependencies, and remote access interfaces.
[0032] Specifically, based on traffic collection and protocol parsing, the interaction characteristics between the target object and the external environment are identified, including communication comments, external dependencies, and remote access interfaces.
[0033] S202: Perform security vulnerability analysis on interaction characteristics and mark security vulnerabilities that are at risk of being exploited based on the analysis results. Security vulnerabilities include vulnerability information, unencrypted communication, and weak passwords.
[0034] Specifically, security vulnerability analysis is performed based on interaction characteristics, and security vulnerabilities that are at risk of being exploited are marked. Security vulnerabilities include vulnerability information, unencrypted communication, weak passwords, etc.
[0035] Exposure characteristics include: network layer characteristics such as public network reachability, number of ports, protocol exposure, and communication traffic characteristics; system layer characteristics such as operating system type, patch status, application service version, and weak passwords; business layer characteristics such as the system's criticality in power dispatching and control, and whether it is a single point of failure; and security event characteristics such as historical attack records and related vulnerability exploitation in threat intelligence.
[0036] In this embodiment, after extracting the exposure features of the target object, feature standardization is performed to transform features of different dimensions into quantifiable feature vectors.
[0037] S30: Calculate attack surface indicators based on exposure characteristics, assign weights to each attack surface indicator, and construct a multi-dimensional indicator system for the attack surface of the power system.
[0038] Specifically, attack surface metrics include reachability index, vulnerability index, criticality index, and exploitability. The calculation process includes: Specifically, the reachability index represents the visibility of a target object on the external attack surface, such as the number of public IP addresses and the exposure of external ports.
[0039] The reachability index in the attack surface attack metrics is calculated as follows: (2) Specifically, Represents the accessibility index. Indicates the actual number of open ports on the device. This indicates the total number of configurable ports on the device. This indicates the number of IP addresses that can be directly exposed to the public internet. This represents the total number of IPs owned by the target object. Port protocol Risk coefficients, such as Telnet=0.9, HTTP=0.6, HTTPS=0.3, Modbus / TCP=0.8; This indicates the total number of port protocols owned by the target object. , , This indicates the weights assigned to the accessibility index. .
[0040] In this embodiment, the accessibility index is simulated and calculated, and the configured parameters are as follows: Port: 4 open / 10 configurable → 4 / 10 = 0.40 IP: Public IP 1 / Total IP 2 → 1 / 2 = 0.50 Protocol risks: SSH (0.40) + HTTP (0.60) + HTTPS (0.30) + RDP (0.85) = 2.15 Calculation result: A = 0.40 × 0.40 + 0.20 × 0.50 + 0.40 × 2.15 = 0.16 + 0.10 + 0.86 = 1.12.
[0041] Specifically, the vulnerability index is used to characterize whether there are high-risk, unpatched vulnerabilities.
[0042] The vulnerability index in the attack surface attack metrics is calculated as follows: (3) in, This represents a vulnerability index indicator. Indicates the first The CVSS baseline score for each vulnerability, ranging from 0 to 10. Indicates the total number of vulnerabilities. The exploit difficulty factor is as follows: if a publicly available exploit tool exists, Ui=1; if a higher technical threshold is required, Ui=0.5; if no exploit code exists, Ui=0.2. Indicates the first The timing of vulnerability disclosure This represents the time decay constant, used to reflect the decreasing importance of a vulnerability as it remains unpatched for an extended period.
[0043] In this embodiment, the vulnerability index is simulated and calculated, and the configured parameters are as follows: Vulnerability list (N=3): CVSS 9.8, U=1.0, Δt=20 days CVSS 7.5, U=0.5, Δt=200 days CVSS 5.0, U=0.2, Δt=800 days Calculate the vulnerability index for each CVSS: The mean value is obtained by calculation: .
[0044] Specifically, the criticality index is used to measure the importance of a target in the power business system, and is classified into levels based on the analytic hierarchy process (AHP).
[0045] The calculation formula for the key index in the attack surface attack metrics is as follows: (4) in, Indicates key index, A coefficient representing the importance of a business function. A coefficient indicating the importance of topological location. , representing the importance coefficient for a single point of failure. This indicates the number of redundant devices used for backup of the target object. , , This indicates the weighting of key index indicators. The weights can be obtained through expert scoring or training with historical accident data.
[0046] In this embodiment The value range is: scheduling master station = 1.0, auxiliary scheduling system = 0.7, edge terminal = 0.3.
[0047] In this embodiment The value range is as follows: 1.0 for core nodes (such as substation main control equipment), 0.6 for intermediate transmission nodes (such as communication gateways), and 0.3 for peripheral access nodes (such as electricity meters).
[0048] In this embodiment The value range is as follows: if the equipment has no redundancy (N=1), then the value = 1; if there is dual-machine hot standby (N=2), then the value = 0.5.
[0049] In this embodiment, the key index is simulated and calculated, and the parameters are configured as follows: Business Function: Dispatch Master Station → F Service = 1.0 Topological location: Core → F topology = 1.0 Redundancy: Dual-machine hot standby N=2 → F single point of failure = 1 / 2 = 0.5 Calculation results: .
[0050] Specifically, the exploitability index is determined by comprehensively evaluating a multi-dimensional indicator system based on the number of publicly available exploit tools, vulnerability complexity, exploitation cost, and historical exploitation frequency. The exploitability index measures the likelihood that a particular power asset or its vulnerability can be exploited in an actual attack. It reflects whether attackers have readily available methods, the cost of the attack, and the barrier to entry for exploitation.
[0051] Among these, the number of publicly disclosed exploit tools, such as whether there are existing PoCs, exploits, or automated attack scripts; the exploitation cost, such as the time, computing power, and expertise required for the attack; and the historical exploitation frequency, such as whether there have been exploitation cases in real attacks, are obtained through threat intelligence or CVE exploitation statistics.
[0052] The range of values includes: E∈[0,1], the higher the value, the easier it is for an attacker to directly exploit the asset or vulnerability.
[0053] E≈0: Almost unusable (no vulnerabilities or requires extremely high costs / conditions).
[0054] E≈0.3: A vulnerability exists, but no publicly available exploit tools exist.
[0055] E≈0.5: There is some Proof of Concept (PoC), but it requires more complex configuration.
[0056] E≈0.7: Mature attack scripts or semi-automatic tools exist.
[0057] E≈1.0: There are automated tools available on a large scale, almost readily available.
[0058] In this embodiment, the availability index is simulated and calculated, and the parameters are configured as follows: The main site contains a CVE-2023-XXXX vulnerability.
[0059] A public proof-of-concept (PoC) has been released, and automation toolkits have been found being sold on attack forums.
[0060] The vulnerability is of medium difficulty to exploit and requires no user interaction.
[0061] The calculation results are shown below: The vulnerability has mature exploitation tools → E should be relatively high; The barrier to entry is low → E is close to 0.7–0.8.
[0062] Rating: E=0.70.
[0063] The weight allocation process in step S30 of this embodiment specifically includes: allocating weights to each attack surface indicator using the analytic hierarchy process or the entropy weight method.
[0064] S40: Quantify the attack surface attack indicators of the multi-dimensional indicator system and dynamically calculate the real-time exposure value of the target object.
[0065] Specifically, the expression for calculating the real-time exposure value is as follows: (1) Specifically, express The target object exposure value at time t, where α, β, γ, and δ represent the static weights of the attack surface attack metrics, can be dynamically optimized through regression learning using historical attack data. The accessibility index represents a multi-dimensional indicator system. The vulnerability index represents a multi-dimensional indicator system. Key index indicators representing a multi-dimensional indicator system. Indicators representing the availability of a multi-dimensional indicator system.
[0066] In this embodiment, based on the above simulation calculations, weights are assigned to each attack indicator, such as α=0.25, β=0.35, γ=0.25, δ=0.15. The calculation process for the total exposure value is as follows: =1.778 It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0067] In one embodiment, a dynamic calculation system for the attack surface exposure value of a power target, which integrates multiple dimensions, is provided. This system corresponds one-to-one with the dynamic calculation method for the attack surface exposure value of a power target in the above embodiments. Figure 4 As shown, this multi-dimensional fusion dynamic calculation system for the attack surface exposure value of a power target includes a target modeling module, an exposure feature extraction module, an attack surface index calculation module, and an exposure value calculation module. Detailed descriptions of each functional module are as follows: The target modeling module is used to acquire target objects in the power system, model the target objects, and construct a target topology model.
[0068] The exposure feature extraction module is used to identify the interaction features between the target object and the external environment through the target topology model, and extract the exposure features of the target object.
[0069] The attack surface index calculation module is used to calculate attack surface attack indices based on exposure characteristics, assign weights to each attack surface attack index, and construct a multi-dimensional index system for the attack surface of the power system.
[0070] The exposure value calculation module is used to quantify attack surface attack indicators of a multi-dimensional indicator system and dynamically calculate the real-time exposure value of the target object.
[0071] Specific limitations regarding the dynamic calculation system for the multi-dimensional fusion power target attack surface exposure value can be found in the limitations of the dynamic calculation method for the multi-dimensional fusion power target attack surface exposure value described above, and will not be repeated here. Each module in the aforementioned dynamic calculation system for the multi-dimensional fusion power target attack surface exposure value can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0072] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application of the technical solution and the constraints involved. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.
[0073] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.
[0074] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0075] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.
[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.
Claims
1. A dynamic calculation method for the attack surface exposure value of a power target using multi-dimensional fusion, characterized in that, The method includes: Obtain target objects in the power system, model the target objects, and construct a target topology model; The interaction features between the target object and the external environment are identified through the target topology model, and the exposure features of the target object are extracted. Based on the exposure characteristics, attack surface attack indicators are calculated, and weights are assigned to each attack surface attack indicator to construct a multi-dimensional indicator system for the attack surface of the power system. The attack surface attack index of the multi-dimensional index system is quantified, and the real-time exposure value of the target object is dynamically calculated.
2. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of quantifying the attack surface attack indicators of the multi-dimensional indicator system and dynamically calculating the real-time exposure value of the target object specifically includes: The expression for calculating the real-time exposure value is as follows: （1） Specifically, express The target object exposure value at time t, where α, β, γ, and δ represent the static weights of the attack surface attack metrics. The accessibility index represents a multi-dimensional indicator system. The vulnerability index represents a multi-dimensional indicator system. Key index indicators representing a multi-dimensional indicator system. Indicators representing the availability of a multi-dimensional indicator system.
3. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional indicator system of the power system's attack surface specifically includes: The calculation expression for the reachability index in the attack surface attack metrics is as follows: （2） Specifically, Represents the reachability index, which characterizes the visibility of a target object on the external attack surface. Indicates the actual number of open ports on the device. This indicates the total number of configurable ports on the device. This indicates the number of IP addresses that can be directly exposed to the public internet. This represents the total number of IPs owned by the target object. Port protocol The risk factor, This indicates the total number of port protocols owned by the target object. , , This indicates the weights assigned to the accessibility index. .
4. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional attack surface indicator system of the power system further includes: The vulnerability index in the attack surface attack metrics is calculated as follows: （3） in, This represents a vulnerability index indicator. Indicates the first The CVSS baseline score for each vulnerability. Indicates the total number of vulnerabilities. This indicates the use of difficulty factors. Indicates the first The time of vulnerability disclosure This represents the time decay constant.
5. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing the attack surface attack indicator calculation process in the multi-dimensional attack surface indicator system of the power system further includes: The calculation expression for the key index in the attack surface attack metrics is as follows: （4） in, A key index indicating the importance of a target within the power business system. A coefficient representing the importance of a business function. A coefficient indicating the importance of topological location. , representing the importance coefficient for a single point of failure. This indicates the number of redundant devices used for backup of the target object. , , This indicates the weighting of key index indicators. .
6. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The step of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing a multi-dimensional indicator system for the attack surface of the power system further includes: The exploitability index of the multi-dimensional indicator system is evaluated by comprehensively considering the number of publicly available exploit tools, vulnerability complexity, exploitation cost, and historical exploitation frequency.
7. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of calculating attack surface attack indicators based on the exposure characteristics, assigning weights to each attack surface attack indicator, and constructing a weight allocation process in the multi-dimensional indicator system of the power system's attack surface specifically includes: The attack indicators of each attack surface are weighted using either the analytic hierarchy process (AHP) or the entropy weighting method.
8. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The process of acquiring target objects in the power system, modeling the target objects, and constructing a target topology model specifically includes: Obtain target objects of the power system and analyze the topological relationships between the target objects to construct a target topology model of the power system. The topological relationships include communication relationships or service dependencies. For each target object, multidimensional attributes are defined, and the target topology model is optimized based on the defined multidimensional attributes and the business functions of the target object to obtain a target topology model carrying the multidimensional attribute set of the target.
9. The dynamic calculation method for the exposure value of a multi-dimensional fusion power target attack surface according to claim 1, characterized in that, The step of identifying the interaction features between the target object and the external environment through the target topology model and extracting the exposure features of the target object specifically includes: The traffic data of the target object interacting with the external environment is obtained, the traffic data is parsed according to the protocol, and the interaction characteristics of the target object and the external environment are identified, including communication frequency, external dependencies and remote access interfaces. The interaction features are analyzed for security vulnerabilities, and security vulnerabilities that are at risk of being exploited are marked based on the analysis results. These security vulnerabilities include vulnerability information, unencrypted communication, and weak passwords.
10. A dynamic calculation system for the attack surface exposure value of a multi-dimensional fusion power target, characterized in that, The system is applied to the dynamic calculation method for the multi-dimensional fusion of the power target attack surface exposure value as described in any one of claims 1-9, and the system includes: The target modeling module is used to acquire target objects in the power system, model the target objects, and construct a target topology model. The exposure feature extraction module is used to identify the interaction features between the target object and the external environment through the target topology model, and extract the exposure features of the target object; The attack surface index calculation module is used to calculate the attack surface attack index based on the exposure characteristics, assign weights to each attack surface attack index, and construct a multi-dimensional index system for the attack surface of the power system. The exposure value calculation module is used to quantify the attack surface attack indicators of the multi-dimensional indicator system and dynamically calculate the real-time exposure value of the target object.