Industrial control system residual risk assessment method combined with multi-attribute decision model

Abstract

The invention provides an industrial control system residual risk assessment method combined with a multi-attribute decision model, and solves the technical problems of inaccurate industrial control system protection and unreasonable resource allocation caused by incapability of identifying key atomic attacks, difficulty in distinguishing contribution of the atomic attacks to system risks and lack of dynamic updating capability in existing residual risk assessment. The method comprises the following steps: constructing risk measurement index comparison information and risk measurement index initial information; calculating a risk measurement index weight and a risk measurement index value, and sorting the attack atoms according to the risk measurement index weight and the risk measurement index value to obtain an atomic attack sorting result; extracting an attack path according to the topological information, the atomic attack sorting result and the influence factor, performing normalization to obtain an initial global risk value, judging whether the attack path exists or not, and if so, removing the attack path and recalculating the global risk value; otherwise, outputting the atomic attack and the system risk degree. The method can be widely applied to the technical field of residual risk assessment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of residual risk assessment, and more particularly relates to a residual risk assessment method for industrial control systems in combination with a multi-attribute decision model. BACKGROUND

[0002] With the informatization and networking of industrial control systems, the core position of the industrial control systems in power, manufacturing and other critical infrastructures is continuously improved, and the network attack risk faced by the industrial control systems is increasingly serious. Once attacked, the industrial control systems may cause equipment out of control, production interruption, and even serious consequences such as personnel casualties. There are various system risk assessment methods in the prior art. By constructing a system model based on a Petri net, combining Common Vulnerability Scoring System (CVSS) vulnerability scoring rules to perform attack path risk accumulation calculation, or using Fuzzy Analytic Hierarchy Process (Fuzzy_AHP) to model a multi-level index system, the overall risk grade of the system is calculated. These methods have certain effects on overall risk modeling and can reflect the current security situation of the system. However, in a complex attack scenario and under the realistic condition of limited resources, the traditional risk assessment methods focus on current threat identification and static scoring, and cannot analyze the residual risk of the system.

[0003] The existing Chinese invention patent with the publication number CN120415816A provides a network security space mapping method, system and device based on multi-source data fusion. The firewall rule change set is input into an attack graph reconstruction engine, the change of the attack path is simulated in combination with the current connection state of the dynamic network topology map, the risk propagation probability is recalculated based on a Bayesian network model, and the residual risk is evaluated. However, the patent can only evaluate the overall risk of the entire attack path, cannot identify key atomic attacks, cannot distinguish the contribution of the atomic attacks to the system risk in the risk assessment, lacks the modeling capability of the influence of the path change on the system risk, and cannot realize dynamic updating and iterative optimization, resulting in inaccurate protection decision and unreasonable resource allocation of the industrial control system. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a residual risk assessment method for industrial control systems in combination with a multi-attribute decision model, so as to solve the technical problems in the prior art that the residual risk assessment cannot identify key atomic attacks, cannot distinguish the contribution of the atomic attacks to the system risk, and lacks dynamic updating capability, resulting in inaccurate protection of the industrial control system and unreasonable resource allocation.

[0005] To achieve the above purpose, the embodiments of the present application provide a residual risk assessment method for industrial control systems in combination with a multi-attribute decision model, including the following steps: constructing risk metric index contrast information and risk metric index initial information; calculating risk metric index weights in the risk metric index contrast information based on the best worst method of fuzzy numbers, extracting risk metric index values in the risk metric index initial information, constructing an influence factor according to the risk metric index weights and the risk metric index values, and ranking atomic attacks to obtain an atomic attack ranking result; extracting an attack path according to the topology information in the risk metric index initial information, the atomic attack ranking result and the influence factor, normalizing availability in the attack path to obtain an initial global risk value, judging whether there is an attack path, if yes, removing the attack path, re-calculating the global risk value, and then cyclically judging whether there is an attack path; otherwise, outputting a most critical set of atomic attacks and a risk degree of the system.

[0006] Preferably, the process of extracting risk metric index values in the risk metric index initial information comprises: judging whether the risk metric index initial information is an index based on an attack path, if yes, calculating an index value by graph traversal and assigning the index to an atomic attack in the topology information; otherwise, obtaining an index value from the topology information, judging whether the index value is a numerical type, if yes, assigning the index to the atomic attack in the topology information; otherwise, representing the index value by a fuzzy number and assigning the index to the atomic attack in the topology information to obtain the risk metric index value.

[0007] Preferably, the process of constructing the influence factor comprises: constructing an initial decision matrix according to the risk metric index weights and the risk metric index values, normalizing to obtain a normalized decision matrix, weighting the initial decision matrix and the normalized decision matrix to obtain a final decision matrix, and saving indexes based on CVSS and based on a functional task in the final decision matrix as the influence factor.

[0008] Preferably, the process of obtaining the atomic attack ranking result comprises: calculating a boundary approximation region of each index in the final decision matrix, calculating a distance from the atomic attack to the boundary approximation region, performing cumulative summation to obtain a ranking score of the atomic attack, and ranking to obtain the atomic attack ranking result.

[0009] Preferably, a formula for normalizing availability in the attack path is: ; In the formula, is the availability, is a value of the ES score after normalization, and r is a ranking of the atomic attack.

[0010] Preferably, a formula for calculating the boundary approximation region is: ; wherein, is the boundary approximation region of each indicator, is the number of atomic attacks, is the weighted normalized indicator value.

[0011] Preferably, the process of calculating the risk measurement indicator weight in the risk measurement indicator comparison information based on the best worst method of fuzzy numbers comprises: In the risk measurement indicator comparison information, determine the most important indicator and the least important indicator, extract the expert's language description of the relative importance of the most important indicator to all indicators, and the language description of the relative importance of other indicators to the least important indicator; Convert the relative importance language into a triangular fuzzy number, input the Fuzzy_BWM algorithm to solve the weight fuzzy number, and convert it into a precise number to obtain the risk measurement indicator weight.

[0012] Preferably, the formula for obtaining the normalized decision matrix is: ; wherein, is the normalized indicator value, is the th indicator value of the th atomic attack, and are the minimum value and the maximum value of the th indicator in all atomic attacks, is the th indicator category, is the benefit type indicator, is the cost type indicator.

[0013] Preferably, the risk measurement indicator comparison information is a comparison of the relative importance between risk indicators. The risk indicators include CVSS-based indicators, attack path-based indicators, and function task-based indicators.

[0014] Preferably, the process of obtaining the risk measurement indicator initial information comprises: Using a crawler to obtain the CVSS-based indicator initial information from the CVSS score field; extracting the topology information of the attack graph from the device vulnerability information to obtain the attack path-based indicator initial information; constructing the function task-based indicator initial information based on expert-defined assignments, and combining the CVSS-based indicator initial information, the attack path-based indicator initial information, and the function task-based indicator initial information to obtain the risk measurement indicator initial information.

[0015] The application has the beneficial effects that the application provides a residual risk assessment method of an industrial control system combined with a multi-attribute decision model, the risk measurement index comparison information and the risk measurement index initial information are constructed, the index weight is calculated and the atomic attack is sorted, the effective fusion of multi-source heterogeneous risk indexes is realized, the key atomic attack with the greatest impact on the system risk is accurately identified, the risk contribution of different atomic attacks is quantified, and a precise basis is provided for subsequent residual risk assessment. At the same time, the application extracts the attack path and calculates the initial global risk value through normalization, and then removes the attack path and recalculate the global risk value through circulation, combined with the sorting discount mechanism and the function continuity dimension, not only can dynamically reflect the risk evolution trend caused by the change of the attack path after the system is reinforced, real-time output the most critical atomic attack and the system risk degree, but also can provide scientific support for the protection priority of the industrial control system and the optimal allocation of protection resources, help the staff to carry out iterative reinforcement work, and effectively ensure the stable and safe operation of the industrial control system. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0017] Figure 1 The overall flowchart of a residual risk assessment method of an industrial control system combined with a multi-attribute decision model provided by an embodiment of the application is shown in the figure. Figure 2 The flowchart of obtaining the initial value of the risk measurement index provided by an embodiment of the application is shown in the figure. Figure 3 The flowchart of calculating the risk measurement index weight provided by an embodiment of the application is shown in the figure. Figure 4 The flowchart of assigning the risk measurement index value provided by an embodiment of the application is shown in the figure. Figure 5 The flowchart of atomic attack sorting processing provided by an embodiment of the application is shown in the figure. Figure 6 The flowchart of residual risk calculation provided by an embodiment of the application is shown in the figure. DETAILED DESCRIPTION

[0018] In order to make the technical problems, technical solutions and beneficial effects of the application more clearly understood, the following will further describe the application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application and not to limit the application.

[0019] Please see Figure 1 This application provides an embodiment of a residual risk assessment method for industrial control systems that combines a multi-attribute decision model, comprising the following steps: S1: Construct comparative information and initial information for risk measurement indicators.

[0020] Prepare initial input information based on the data requirements of atomic attack sorting and residual risk assessment functions, mainly including risk measurement indicator comparison information and initial information of risk measurement indicators.

[0021] Specifically, the risk metric comparison information refers to the comparison of the relative importance of various metrics. The scope of risk metrics is atomic attacks, represented as edges between nodes on the attack graph, indicating that an attack on the target node can be achieved by exploiting a vulnerability from the source node. Domain experts determine the types of risk metrics to use, and based on the needs of the weighting algorithm, they combine them in pairs to express their relative importance in a linguistic manner, thus obtaining the risk metric comparison information.

[0022] Please see Figure 2 Risk indicators can be categorized by their source into CVSS-based indicators, attack path-based indicators, and functional task-based indicators.

[0023] CVSS-based metrics include confidentiality, integrity, and availability metrics, which can be used to calculate the impact on the target node after an atomic attack is completed. Among them, the availability metric can be used to calculate the probability of the atomic attack.

[0024] Attack path-based metrics include the number of attack paths, the shortest attack path length, the average attack path length, and the shortest distance from the attack origin. A higher number of attack paths for an atomic attack indicates a higher probability of it being used. The shortest attack path length reflects the minimum effort required for an attacker to execute an attack containing that atomic attack. The average attack path length reflects the average effort required for an attacker to execute an attack containing that atomic attack. A shorter shortest distance from the target node to the attack origin indicates that the atomic attack is easier and faster to execute from the origin.

[0025] Functional task-based metrics include indicators of impact on functional continuity, reflecting the cascading effects of an atomic attack on the entire function and task beyond its direct impact on the target node. They also include key functional metrics, used to measure the function's importance within the overall task framework.

[0026] The initial information for risk metrics mainly includes quantifiable numerical indicators, imprecise indicators that need to be expressed through language or expert knowledge, and topological information used for calculating some indicators while also taking into account the modeling of attack propagation paths. The initial information for risk metrics is obtained in three categories: CVSS-based indicators, attack path-based indicators, and functional task-based indicators.

[0027] Specifically, the initial information for CVSS-based metrics is obtained using a web crawler from the CVSS scoring field of the official, authoritative vulnerability database. The initial information for attack path-based metrics is attack graph topology information. The main acquisition process involves combining system topology information from system design documents and system configuration files with device vulnerability information obtained from vulnerability scanners, using an attack graph generation tool to generate an attack graph, and then outputting the topology information of the attack graph. The initial information for function / task-based metrics originates from the proposals, definitions, and assignments of domain experts.

[0028] S2: Calculate the risk measurement index weights based on the best and worst method of fuzzy numbers to compare risk measurement index information.

[0029] The weights of the risk measurement indicators are obtained by using the Fuzzy Best-Worst Method (Fuzzy_BWM) based on fuzzy numbers.

[0030] Specifically, please refer to Figure 3 First, the most important and least important indicators are identified from the comparison information of all risk measurement indicators. Then, expert descriptions of the relative importance of the most important indicator to all other indicators, as well as descriptions of the relative importance of other indicators to the least important indicator, are extracted from the initial input risk measurement indicator comparison information. These relative importance descriptions can be categorized into five types: equally important, weakly important, quite important, very important, and absolutely important.

[0031] Then, using a general conversion table of relative importance language phrases and triangular fuzzy numbers, the relative importance language phrases are converted into triangular fuzzy numbers. and Each CI (Conformity Index) is also provided to calculate the conformity ratio. Let be the fuzzy number representing the relative importance of the most important indicator to the i-th indicator. Let be the fuzzy number representing the relative importance of the i-th indicator to the least important indicator.

[0032] Next, the triangular fuzzy number and In the Fuzzy_BWM algorithm, the weighted fuzzy number to be solved is set. Represented by upper and lower bounds and the median value When all weight fuzzy numbers are satisfied Converted to precise numbers that sum to 1, and each weight has a fuzzy number. When the upper and lower bounds and the median value meet the size constraint (lower bound ≤ median value ≤ upper bound), the BWM algorithm is used to minimize the difference between the weight ratio and the relative importance language to obtain the weight fuzzy number corresponding to each indicator. Then, the TFN (triangular fuzzy number) precision algorithm is used to convert the weight fuzzy number into a specific precise number to obtain the risk measurement indicator weight. It is worth noting that this application does not limit the method of converting fuzzy numbers into precise numbers, and can be set according to the actual situation. The formula for converting fuzzy numbers to precise numbers in this application is as follows: ; In the formula, For precise numbers, This is the lower bound of the fuzzy number. The median value of the fuzzy number. This is the upper bound of the fuzzy number.

[0033] Finally, consistency verification is performed. Specifically, the fuzzy number of the weight ratio and the difference in relative importance is calculated, and this fuzzy number is converted into a precise number. The precise number is divided by the consistency index (CI, a predetermined empirical value) to obtain the consistency ratio CR. The process ends when the consistency ratio CR is less than 0.1; otherwise, the above process is repeated.

[0034] S3: Extract the risk measurement indicator values ​​from the initial information of the risk measurement indicators.

[0035] The numerical format of the risk measurement indicators in the initial information is clearly defined, converting verbally described indicators into fuzzy numbers. Risk measurement indicator values ​​originate from two parts: one part consists of CVSS-based indicators and function-task-based indicators. These indicators only need to be extracted after their type is clearly defined, and then it is determined whether the indicator value is a numerical type; if not, it is represented as a fuzzy number and assigned a value. The other part consists of indicators based on attack paths reflected in the attack graph structure, obtained by traversing the attack graph.

[0036] Specifically, please refer to Figure 4 First, clarify the type of the initial risk measurement indicator and determine whether it is an attack path-based indicator. If so, calculate the indicator value through graph traversal and assign the value to the atomic attack indicator in the topology information; otherwise, obtain the indicator value from the topology information. After obtaining the value, determine whether it is a numerical type. If so, assign the value to the atomic attack indicator in the topology information; otherwise, represent it as a fuzzy number and assign the value to the atomic attack indicator in the topology information to obtain the risk measurement indicator value.

[0037] S4: Construct an influence factor based on the risk metric weights and risk metric values, and sort the atomic attacks to obtain the atomic attack ranking results.

[0038] After completing the weight calculation and risk measurement index assignment, and obtaining the risk measurement index weights and values, the atomic attacks are sorted using the Multi-Attribute Sorting Method (MCDM) algorithm.

[0039] Specifically, please refer to Figure 5 First, input the topology information and risk metric weights after the metric assignment is completed. Extract all atomic attacks and their corresponding risk metric values ​​from the topology information. Determine if the metric value is a fuzzy number; if so, convert it to a precise number; otherwise, construct the initial decision matrix.

[0040] The precise values ​​of all risk metrics corresponding to all atomic attacks constitute the initial decision matrix. ,in, For the first The first atomic attack Item index value, The number of atomic attacks, The number of types of indicators.

[0041] Next, according to the requirements of the sorting algorithm, the initial decision matrix is ​​normalized. In the MABAC algorithm, this is done by... Min-max normalization is performed separately for each of the benefit and cost types to obtain the normalized decision matrix. ,in for: ; In the formula, The normalized index value, For the first The first atomic attack Item index value, and These are the first of all atomic attacks. The minimum and maximum values ​​of each indicator. For the first Each indicator category For revenue-type indicators, This is a spending-type metric.

[0042] To unify the direction, we categorize the revenue and expenditure types according to the indicators. All indicators are viewed from the attacker's perspective. The higher the indicator value of the revenue type, the greater the attacker's revenue. The higher the indicator value of the expenditure type, the greater the cost that the attacker needs to incur. Therefore, from the attacker's perspective, the normalization of the expenditure type needs to be reversed.

[0043] Then, the input risk metric weights and the corresponding weight matrix are analyzed. , and the normalized decision matrix By weighting, we obtain the normalized weighted final decision matrix. The formula is: ; In the formula, The index value is the weighted normalized value. As weight, The index value is the normalized value. Adding 1 and multiplying it by the corresponding risk measurement indicator weight, then adding 1 to the normalized indicator value ensures... When the value is 0, the weighted value will not be 0. In addition, it is necessary to save the values ​​of the confidentiality, integrity, availability and impact on functional continuity of the atomic attack after normalized weighted calculation, and write them into the impact factor for subsequent residual risk assessment.

[0044] Then, the boundary approximation region for each indicator is calculated. The calculation formula is: ; In the formula, For each indicator, the boundary approximation region, The number of atomic attacks, This is the weighted normalized index value.

[0045] according to The upper and lower boundary approximation regions are defined. For each term in the final decision matrix, the distance to the corresponding index boundary approximation region is calculated. ,like If the value is greater than 0, then the atomic attack belongs to the upper boundary region of this index; conversely, if the value is less than 0, then the atomic attack belongs to the upper boundary region of this index. If <0, then the atomic attack belongs to the region approaching the lower boundary of the index.

[0046] Finally, calculate each atomic attack. The distances to the boundary regions of each indicator are accumulated and summed to obtain the ranking score of each atomic attack. The atomic attacks are then sorted according to their scores to obtain the ranking of the atomic attacks. The ranking information is written to the atomic attack ranking result file for saving.

[0047] S5: Extract attack paths based on the topology information, atomic attack ranking results, and impact factors in the initial information of the risk measurement index. Normalize the exploitability of the attack paths to obtain the initial global risk value. Determine whether there is an attack path. If there is, remove the attack path and recalculate the global risk value. Repeat the process of determining whether there is an attack path. Otherwise, output the most critical set of atomic attacks and the risk level of the system.

[0048] Please see Figure 6 First, input the topology information, atomic attack sorting results, edges to be deleted, and influence factors.

[0049] Then, based on the attack start point, end point, and attack graph structure, all attack paths are extracted from the topology information. At the same time, atomic attacks contained in the attack paths are recorded, and the ranking information, edges to be deleted, and related influencing factors of all atomic attacks are read.

[0050] Next, the exploitability of all atomic attacks is normalized to calculate the initial global risk value.

[0051] Specifically, traditional exploitability is assigned a value based on the exploitability score (ES) in the CVSS scoring system, and the impact is determined by confidentiality, integrity, and availability in the CVSS scoring system. This application adjusts exploitability and impact.

[0052] In computational availability In this case, an atomic attack ranking discount mechanism is introduced to more reasonably assess the actual risk contribution of atomic attacks in the attack graph. The formula is as follows: ; In the formula, The value is the normalized ES score, where r is the ranking of atomic attacks.

[0053] The impact value I is incorporated into the calculation of the impact on functional continuity to effectively reflect the effect of the attack on the system's continuous control and real-time response. The formula is as follows: ; In the formula, , , , These represent the confidentiality, integrity, availability, and impact on functional continuity of the current i-th atomic attack, respectively. These indicators, after normalized weighted calculations, are stored in advance as influencing factors.

[0054] After completing the initial global risk calculation, atomic attacks to be deleted are removed sequentially. Here, "deleted atomic attack" refers to an atomic attack that the current system has blocked and resolved, preventing it from occurring and being used by attackers. After deleting the corresponding atomic attack, it needs to be removed from the list of atomic attacks to be deleted. Then, the topology is updated to calculate new attack paths, and the ranking is updated. The global risk is recalculated based on the updated ranking information. Once all atomic attacks to be deleted have been removed, the current global risk value, i.e., the residual risk value, can be output.

[0055] Finally, the atomic attack ranking results and residual risk values ​​are collected and processed to output a set of the most critical atomic attacks and the current risk level of the system. These can be used to guide whether the system urgently needs to be repaired and the order in which the system should be repaired.

[0056] Specifically, the final output includes not only the calculated residual risk value of the system after deleting all atomic attacks to be deleted, but also the initial global risk value of the system and the current atomic attack ranking results. Furthermore, the final output is processed to obtain the system risk level, the percentage reduction in attack handling risk, and the most critical set of atomic attacks currently affecting the system. These results provide a more intuitive representation of the recommendations following the risk assessment compared to direct data output.

[0057] Based on the minimum and maximum system risks set by experts, the residual risk value is normalized using a maximum-min method. The resulting normalized residual risk value is between 0 and 1. The risk level of the current system is then determined according to the risk classification set by experts, making the system risk situation more clearly and simply, allowing relevant personnel to react accordingly. For example, risk levels are divided into low, medium, and high risk, corresponding to the normalized residual risk value ranges [0, 1 / 3), [1 / 3, 2 / 3), and [2 / 3, 1], respectively. When the system reaches a high risk level, relevant personnel immediately take corresponding actions to reduce the system risk.

[0058] The system's initial risk value is normalized to obtain a normalized residual risk value, limited to a range of 0 to 1. Based on pre-set standards, such as system sharing, and after completing the initial global risk calculation, atomic attacks to be deleted need to be removed sequentially. Deleting an atomic attack here means that the current system has blocked and resolved the atomic attack, preventing it from occurring and being used by attackers. After deleting the corresponding atomic attack, it needs to be removed from the list of atomic attacks to be deleted. Then, the topology is updated to calculate a new attack path, and the ranking is updated. The global risk is recalculated based on the updated data. Once all atomic attacks to be deleted have been removed, the current global risk value and the current risk level of the system can be output.

[0059] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0060] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for assessing residual risk in industrial control systems by combining a multi-attribute decision model, characterized in that, Includes the following steps: Construct comparative information and initial information for risk measurement indicators; Based on the best-worst method of fuzzy numbers, the risk measurement index weights in the risk measurement index comparison information are calculated, the risk measurement index values ​​in the initial information of the risk measurement index are extracted, and an influence factor is constructed according to the risk measurement index weights and risk measurement index values ​​to sort the atomic attacks and obtain the atomic attack ranking results. Based on the topology information in the initial information of the risk metric, the atomic attack ranking results, and the impact factor, attack paths are extracted. The exploitability of the attack paths is normalized to obtain an initial global risk value. It is then determined whether the attack path exists. If it does, the attack path is removed, the global risk value is recalculated, and the process of determining whether the attack path exists is repeated. Otherwise, the most critical set of atomic attacks and the risk level of the system are output.

2. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The process of extracting the risk measurement indicator values ​​from the initial information of the risk measurement indicator includes: Determine whether the initial information of the risk measurement indicator is an indicator based on the attack path. If so, calculate the indicator value by graph traversal and assign the indicator value to the atomic attack in the topology information. Otherwise, obtain the indicator value from the topology information and determine whether the indicator value is a numerical type. If so, assign the indicator value to the atomic attack in the topology information. Otherwise, represent it with a fuzzy number and assign the indicator value to the atomic attack in the topology information to obtain the risk measurement indicator value.

3. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The process of constructing the impact factor includes: An initial decision matrix is ​​constructed based on the risk measurement index weights and the risk measurement index values. The matrix is ​​then normalized to obtain a normalized decision matrix. The initial decision matrix and the normalized decision matrix are weighted together to obtain a final decision matrix. The indicators based on CVSS and based on functional tasks in the final decision matrix are saved as influencing factors.

4. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 3, characterized in that, The process of obtaining the atomic attack sorting results includes: Calculate the boundary approximation region for each indicator in the final decision matrix, calculate the distance from the atomic attack to the boundary approximation region, sum the results to obtain the ranking score of the atomic attack, and sort the results to obtain the ranking result of the atomic attacks.

5. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The formula for normalizing the exploitability of the attack path is: ； In the formula, For availability, is the normalized value of the ES score, and r is the ranking of the atomic attacks.

6. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 4, characterized in that, The formula for calculating the boundary approximation region is: ； In the formula, For each indicator, the boundary approximation region, The number of atomic attacks, This is the weighted normalized index value.

7. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The process of calculating the weights of the risk measurement indicators in the risk measurement indicator comparison information based on the best-worst method using fuzzy numbers includes: In the risk measurement index comparison information, the most important index and the least important index are determined, and the experts' language descriptions of the relative importance of the most important index to all indicators, as well as the language descriptions of the relative importance of other indicators to the least important index are extracted. The relative importance language is converted into triangular fuzzy numbers, which are then input into the Fuzzy_BWM algorithm to solve for the weight fuzzy numbers. These weight fuzzy numbers are then converted into precise numbers to obtain the risk measurement index weights.

8. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The formula for obtaining the normalized decision matrix is: ； In the formula, The normalized index value, For the first The first atomic attack Item index value, and These are the first of all atomic attacks. The minimum and maximum values ​​of each indicator. For the first Each indicator category For revenue-type indicators, This is a spending-type metric.

9. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 1, characterized in that, The risk measurement index comparison information is a comparison of the relative importance of each risk index; The risk indicators include CVSS-based indicators, attack path-based indicators, and functional task-based indicators.

10. The residual risk assessment method for industrial control systems combining a multi-attribute decision model as described in claim 9, characterized in that, The process of obtaining the initial information of the risk measurement index includes: The crawler is used to obtain initial information of CVSS-based indicators from the CVSS scoring field; the topology information of the attack graph is extracted from the device vulnerability information to obtain initial information of attack path-based indicators; initial information of functional task-based indicators is constructed based on expert definition assignment; and the initial information of risk measurement indicators is obtained by combining the initial information of CVSS-based indicators, the initial information of attack path-based indicators, and the initial information of functional task-based indicators.

Images