Security risk assessment method and device and storage medium

Abstract

The invention provides a security risk assessment method and device and a storage medium, and relates to the technical field of Internet. The method comprises the following steps: obtaining risk association evaluation data among a plurality of device nodes and behavior characteristic data of the plurality of device nodes under multiple time scales, the risk association evaluation data being used for representing a logic connection relationship among the plurality of device nodes and a basic risk value of each device node; the behavior characteristic data is used for representing behavior characteristics of the plurality of equipment nodes in a time dimension; carrying out fusion calculation on the risk association evaluation data and the behavior characteristic data to generate a dynamic risk association matrix which is used for representing real-time attack conduction risk probabilities among a plurality of equipment nodes; and performing attack path evaluation on the dynamic risk incidence matrix, and identifying an attack conduction path and a key risk hub node in the attack conduction path.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a security risk assessment method, apparatus and storage medium. Background Technology

[0002] With the in-depth implementation of the industrial digital transformation strategy, the Industrial Internet, as a key carrier for the deep integration of new-generation information technology and manufacturing, has become an important support for promoting the high-quality development of the industrial economy.

[0003] Current common cybersecurity assessment methods mostly rely on simple rule matching or single-dimensional correlation calculations, failing to deeply integrate and verify logical reachability in the spatial dimension and signal synchronization in the temporal dimension. Due to the lack of effective verification methods, existing systems struggle to scientifically distinguish between accidental concurrent events and inevitable attack propagation sequences, and cannot prove whether there is a genuine harmful relationship between cross-domain vulnerabilities. This results in insufficient credibility of the generated attack paths, affecting the accuracy of security assessment results and the effectiveness of decision-making. Summary of the Invention

[0004] This application provides a security risk assessment method, apparatus, and storage medium, which improves the accuracy of security assessment results.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a security risk assessment method is provided. This method includes: acquiring risk correlation assessment data between multiple device nodes and behavioral characteristic data of multiple device nodes at multiple time scales. The risk correlation assessment data is used to characterize the logical connection relationship between multiple device nodes and the basic risk value of each device node, while the behavioral characteristic data is used to characterize the behavioral characteristics of multiple device nodes in the time dimension. The risk correlation assessment data and the behavioral characteristic data are fused and calculated to generate a dynamic risk correlation matrix. The dynamic risk correlation matrix is ​​used to characterize the real-time attack propagation risk probability between multiple device nodes. The dynamic risk correlation matrix is ​​used to assess attack paths and identify attack propagation paths and key risk hub nodes in the attack propagation paths.

[0007] In one possible implementation, risk correlation assessment data and behavioral feature data are fused and calculated to generate a dynamic risk correlation matrix. This includes: calculating the temporal correlation between each pair of multiple device nodes based on behavioral feature data, where the temporal correlation is used to characterize the temporal dimension correlation of attack propagation risk between device node pairs; a device node pair refers to a pair of nodes with an effective attack path; calculating the spatial risk value of each device node among multiple device nodes based on risk correlation assessment data, where the spatial risk value is used to characterize the potential attack value of a device node in the network; and fusion calculation of temporal correlation and spatial risk value to generate a dynamic risk correlation matrix.

[0008] In one possible implementation, the temporal correlation and spatial risk value are fused and calculated to generate a dynamic risk correlation matrix, including: for each pair of device nodes, performing a weighted product operation on the temporal correlation and spatial risk value corresponding to the pair of device nodes to determine the attack propagation risk probability of the pair of device nodes, so as to obtain the attack propagation risk probability of multiple pairs of device nodes; and generating a dynamic risk correlation matrix based on the attack propagation risk probability of multiple pairs of device nodes.

[0009] In one possible implementation, based on behavioral feature data, the temporal correlation between multiple device nodes is calculated, including: for each pair of device nodes, calculating the waveform similarity of the pair at a target time scale; multiplying the time decay factor, stability factor, and waveform similarity of the pair to determine the comprehensive trust score of the pair, which is used to characterize the possibility of attack propagation of the pair at the target time scale; and weighting and aggregating the comprehensive trust scores of the pair at multiple time scales to generate the temporal correlation of the pair.

[0010] In one possible implementation, based on risk correlation assessment data, the spatial risk value of each device node among multiple device nodes is calculated, including: calculating the network location value of each device node based on logical connection relationships. The network location value refers to the network location value calculated by recursively aggregating the risk transmission potential energy of direct neighbor nodes and indirect neighbor nodes, which is used to measure the potential risk level of a device node as an attack springboard or key hub; multiplying the network location value by the basic risk value of the device node to obtain the original risk value; and normalizing the original risk value to obtain the spatial risk value.

[0011] In one possible implementation, the network location value of each device node is calculated based on logical connection relationships, including: iteratively updating the current value vector of the device node based on the adjacency matrix formed by logical connection relationships; wherein, the network location value of each device node in the (t+1)th iteration is calculated by weighted summing of the network location values ​​of all neighboring nodes pointing to the device node in the tth iteration, and the weight of the weighted sum is the logical connection weight of the corresponding connection edge; repeating the above steps until the difference between the value vectors obtained in two adjacent iterations is less than a preset threshold, and then the value vector is used as the network location value.

[0012] In one possible implementation, attack path evaluation is performed on the dynamic risk correlation matrix to identify attack propagation paths. This includes: based on the dynamic risk correlation matrix, exploring paths from device nodes in the potential attack source set to device nodes in the critical protection set. The potential attack source set consists of device nodes located in low-security areas with known vulnerabilities, while the critical protection set consists of critical device nodes located in high-security areas. During path exploration, when a search path extends from the current device node to its adjacent device node, the cumulative probability of the explored path is multiplied by the corresponding attack propagation risk probability in the dynamic risk correlation matrix to update the cumulative probability of the path reaching the adjacent device node. For target propagation paths whose cumulative probability exceeds a preset threshold and successfully reach any device node in the critical protection set, backtracking is performed based on the recorded path predecessor relationships to determine the attack propagation path.

[0013] In one possible implementation, key risk hub nodes are obtained by determining the display frequency of multiple device nodes in the attack propagation path, and identifying device nodes whose display frequency exceeds a preset threshold as key risk hub nodes.

[0014] In one possible implementation, risk association assessment data between multiple device nodes is obtained, including: determining the basic risk value of each device node based on its node attributes; generating logical connection relationships based on protocol configuration and vulnerability scanning results; and obtaining risk association assessment data based on the logical connection relationships and the basic risk values.

[0015] In one possible implementation, the protocol configuration includes a physical connectivity factor and a service reachability factor. The physical connectivity factor characterizes whether the device nodes in a device node pair are reachable at the network layer, and the service reachability factor characterizes whether the destination device node in the device node pair has opened the communication ports required by the source device node. The vulnerability scan results include a policy permission factor and a jump-board risk gain factor. The policy permission factor characterizes whether firewall and access control policies allow communication connections between the device nodes in the device node pair, and the jump-board risk gain factor characterizes whether the source device node has network configuration characteristics that could be used as a jump-board for cross-domain attacks. Based on the protocol configuration and vulnerability scan results, a logical connection relationship is generated, including: multiplying the physical connectivity factor, service reachability factor, policy permission factor, and jump-board risk gain factor to obtain the logical connection weight of the device node pair; and obtaining the logical connection relationship based on the logical connection weight.

[0016] In one possible implementation, the behavioral feature data is obtained as follows: for each of the multiple device nodes, the security events of the device node are obtained and a corresponding weight value is assigned to the security events; for each device node, the weight values ​​belonging to the target time scale are accumulated to generate the behavioral feature data of the device node under the target time scale, so as to obtain the behavioral feature data of multiple device nodes under multiple time scales.

[0017] In one possible implementation, multiple time scales include: a micro-time window for capturing second-level attack characteristics; a meso-time window for capturing minute-level attack characteristics; and a macro-time window for capturing long-term attack characteristics.

[0018] Secondly, a security risk assessment device is provided. This device includes an acquisition module for acquiring risk correlation assessment data between multiple device nodes and behavioral characteristic data of multiple device nodes at multiple time scales. The risk correlation assessment data characterizes the logical connection relationships between multiple device nodes and the basic risk value of each device node, while the behavioral characteristic data characterizes the behavioral characteristics of multiple device nodes in the time dimension. A processing module is used to fuse and calculate the risk correlation assessment data and behavioral characteristic data to generate a dynamic risk correlation matrix. The dynamic risk correlation matrix characterizes the real-time attack propagation risk probability between multiple device nodes. The processing module is also used to evaluate the attack path of the dynamic risk correlation matrix and identify the attack propagation path and key risk hub nodes within the attack propagation path.

[0019] In one possible implementation, the processing module is specifically used to: calculate the temporal correlation between each pair of multiple device nodes based on behavioral feature data, whereby the temporal correlation is used to characterize the temporal dimension correlation of attack propagation risk between device node pairs; a device node pair refers to a pair of nodes with an effective attack path; calculate the spatial risk value of each device node among multiple device nodes based on risk correlation assessment data, whereby the spatial risk value is used to characterize the potential attack value of a device node in the network; and perform a fusion calculation of the temporal correlation and spatial risk value to generate a dynamic risk correlation matrix.

[0020] In one possible implementation, the processing module is specifically used to: for each pair of device nodes, perform a weighted product operation on the temporal correlation and spatial risk value corresponding to the pair of device nodes to determine the attack propagation risk probability of the pair of device nodes, so as to obtain the attack propagation risk probability of multiple pairs of device nodes; and generate a dynamic risk correlation matrix based on the attack propagation risk probability of multiple pairs of device nodes.

[0021] In one possible implementation, the processing module is specifically used to: calculate the waveform similarity of the device node pair at the target time scale for each device node pair among multiple device nodes; multiply the time decay factor, stability factor and waveform similarity of the device node pair to determine the comprehensive trust score of the device node pair, which is used to characterize the possibility of attack propagation of the device node pair at the target time scale; and perform weighted aggregation of the comprehensive trust scores of the device node pair at multiple time scales to generate the temporal correlation of the device node pair.

[0022] In one possible implementation, the processing module is specifically used to: calculate the network location value of each device node based on logical connection relationships. The network location value refers to the network location value calculated by recursively aggregating the risk transmission potential energy of direct neighbor nodes and indirect neighbor nodes, which is used to measure the potential risk level of the device node as an attack springboard or key hub; multiply the network location value by the basic risk value of the device node to obtain the original risk value; and normalize the original risk value to obtain the spatial risk value.

[0023] In one possible implementation, the processing module is specifically used to: iteratively update the current value vector of the device node based on the adjacency matrix formed by logical connection relationships; wherein, the network position value of each device node in the (t+1)th iteration is calculated by weighted summing of the network position values ​​of all neighboring nodes pointing to the device node in the tth iteration, and the weight of the weighted sum is the logical connection weight of the corresponding connection edge; repeat the above steps until the difference between the value vectors obtained in two adjacent iterations is less than a preset threshold, and then use the value vector as the network position value.

[0024] In one possible implementation, the processing module is specifically used to: explore paths from device nodes in the potential attack source set to device nodes in the critical protection set based on a dynamic risk correlation matrix. The potential attack source set consists of device nodes located in low-security-level areas with known vulnerabilities, while the critical protection set consists of critical device nodes located in high-security-level areas. During the path exploration process, when the search path extends from the current device node to its adjacent device node, the cumulative probability of the explored path is multiplied by the corresponding attack propagation risk probability in the dynamic risk correlation matrix to update the cumulative probability of the path reaching the adjacent device node. For target propagation paths whose cumulative path probability exceeds a preset threshold and successfully reach any device node in the critical protection set, backtracking is performed based on the recorded path predecessor relationships to determine the attack propagation path.

[0025] In one possible implementation, the processing module is specifically used to: determine the display frequency of multiple device nodes in the attack propagation path, and identify device nodes whose display frequency exceeds a preset threshold as key risk hub nodes.

[0026] In one possible implementation, the processing module is specifically used to: determine the basic risk value of each device node based on its node attributes; generate logical connection relationships based on protocol configuration and vulnerability scanning results; and obtain risk association assessment data based on the logical connection relationships and the basic risk values.

[0027] In one possible implementation, the processing module is specifically used to: multiply the physical connectivity factor, service reachability factor, policy permission factor, and springboard risk gain factor to obtain the logical connection weight of the device node pair; and obtain the logical connection relationship based on the logical connection weight.

[0028] In one possible implementation, the acquisition module is further configured to acquire security events for each of the multiple device nodes and assign corresponding weight values ​​to the security events; the processing module is specifically configured to: for each device node, accumulate the weight values ​​belonging to the target time scale to generate behavioral feature data of the device node under the target time scale, so as to obtain behavioral feature data of multiple device nodes under multiple time scales.

[0029] The technical effects of any implementation method in the second aspect can be found in the technical effects of any implementation method in the first aspect mentioned above, and will not be repeated here.

[0030] Thirdly, a computer device is provided, comprising: a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the security risk assessment method described above.

[0031] Fourthly, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the security risk assessment method described above.

[0032] Fifthly, a computer program product is provided, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the security risk assessment method described above is implemented.

[0033] The solutions provided in aspects three through five above are used to implement the method provided in aspect one above, and their specific implementations will not be described in detail here. The technical effects corresponding to any implementation method of the solutions provided in aspects three through five above can be found in the technical effects corresponding to any implementation method in aspect one above, and will not be described in detail here.

[0034] It should be noted that any of the possible implementations of any of the above aspects can be combined, provided that the solutions do not contradict each other.

[0035] The advantages of this application's embodiments compared to existing technologies are as follows: By simultaneously acquiring risk correlation assessment data between device nodes and behavioral characteristic data at multiple time scales, it can take into account both network logical connection relationships and dynamic behavioral changes, providing a comprehensive and multi-dimensional data foundation for risk assessment. Furthermore, by fusing and calculating the above data to generate a dynamic risk correlation matrix, a deep integration of static topology attributes and time-series characteristics is achieved, enabling attack propagation risks to be quantified in probabilistic form in real time, significantly improving the accuracy and timeliness of risk assessment. Based on this, by evaluating attack paths using this matrix, specific attack propagation paths and key risk hub nodes within them can be accurately identified, thereby helping security personnel focus defense resources, effectively blocking cross-domain attack chains, and enhancing the overall network's proactive protection capabilities. Attached Figure Description

[0036] Figure 1 A schematic diagram of the structure of a computer system provided in an embodiment of this application; Figure 2 A flowchart illustrating a security risk assessment method provided in an embodiment of this application; Figure 3 A schematic diagram of an industrial or enterprise network scenario provided for an embodiment of this application; Figure 4 A schematic diagram of another industrial or enterprise network scenario provided for an embodiment of this application; Figure 5 A flowchart illustrating another security risk assessment method provided in this application embodiment; Figure 6 A schematic diagram of a path evaluation process provided for an embodiment of this application; Figure 7 This is a schematic diagram of the structure of a safety risk assessment device provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0037] In the embodiments of this application, in order to clearly describe the technical solutions of the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different. The technical features described by "first" and "second" have no sequential or size order.

[0038] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0039] In the embodiments of this application, at least one can also be described as one or more, and multiple can be two, three, four or more, and this application does not impose any restrictions.

[0040] Furthermore, the network architecture and scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0041] With the deepening of the industrial digital transformation strategy, the Industrial Internet, as a key infrastructure for the deep integration of new-generation information technology and manufacturing, has become a core support for promoting high-quality industrial economic development. Against this backdrop, traditional industrial production models are evolving towards digitalization, networking, and intelligence. To adapt to the development requirements of information industrialization, the previously closed production environment needs to achieve deep integration and data connectivity with external networks to promote the efficient allocation of production factors. This has expanded industrial control systems from their original independent physical areas into complex heterogeneous networks encompassing information technology and operational technology domains, with increasingly frequent data interactions between different levels and security domains.

[0042] In traditional industrial network architectures, production workshops, production lines, and core control domains are typically strictly separated from the enterprise's office network through physical isolation or one-way gateways, forming multiple relatively closed information silos. This isolation mechanism has long reinforced the industry perception that "isolation equals security," resulting in generally weak security protection systems within industrial networks. Furthermore, prioritizing production continuity and stability, industrial field equipment often suffers from outdated system versions, delayed security patch updates, and long-unpatched known vulnerabilities. In an isolated environment, these vulnerabilities remain silent, and the associated risks are easily overlooked, leaving industrial control systems in a state of chronically inadequate security protection.

[0043] However, with the accelerated advancement of information industrialization, the interconnectivity between heterogeneous networks is constantly increasing, blurring the traditional physical isolation boundaries. While network convergence and data interoperability break down information barriers, they also create conditions for the cross-domain extension of attack paths. The logical connection between office networks and production networks enables security risks to propagate across domains. External threats can infiltrate core production areas through channels such as office networks, exhibiting high levels of concealment and uncertainty. Among numerous risk sources, security vulnerabilities are a major hidden danger in industrial network security. In a heterogeneous network environment, a vulnerability in a single asset may not be sufficient to directly cause serious consequences, but attackers can exploit multiple low-risk vulnerabilities in different security domains, through logical combinations and springboard mechanisms, to construct a complete attack chain that crosses physical and logical boundaries, ultimately achieving damage to core control equipment.

[0044] Currently, most common cybersecurity assessment technologies are designed for traditional internet environments, primarily focusing on single-point asset vulnerability scanning or risk detection based on static rules. Faced with the complex heterogeneous network environments of the Industrial Internet, existing technologies struggle to identify the spatiotemporal correlations between vulnerabilities from a global perspective, and are unable to effectively analyze how multiple vulnerabilities chain together to form complete attack paths, what causal dependencies exist between vulnerabilities, or the specific propagation mechanisms of cross-domain attacks. Due to the lack of in-depth analysis capabilities regarding vulnerability correlations and attack paths, current methods are ill-suited for accurately assessing the true security posture in converged network environments.

[0045] Especially in the context of the Industrial Internet of Things (IIoT), cross-domain vulnerability propagation prediction and risk assessment face numerous challenges, including complex heterogeneous environments, covert attack methods, and difficulties in quantifying related logic. Existing technologies still have significant limitations in addressing these issues. The cross-domain topology construction is too simplistic: Related network models are mostly based on physical connections to build homogeneous topologies, failing to fully consider the actual constraints of logical isolation mechanisms such as firewall policies and gateway configurations on attack paths, and also failing to effectively incorporate the business value weight of assets into the topology structure. This modeling approach makes it impossible to identify physically connected but logically blocked invalid paths, and also fails to reflect the risk aggregation effect of critical assets in the network, thus introducing more false alarms.

[0046] Insufficient multi-scale feature extraction in dynamic behavior analysis: Faced with massive heterogeneous log data, existing methods mostly adopt discrete event statistics or fixed time window aggregation strategies, lacking a mechanism to convert discrete alarms into continuous time-series signals. This makes it difficult to simultaneously capture multi-scale features of second-level fast attacks and long-term latent behaviors, resulting in low detection sensitivity for slow attacks and complex time-series attack patterns.

[0047] Vulnerability correlation analysis lacks spatiotemporal causal verification: Correlation analysis methods mostly rely on rule matching or single-dimensional correlation calculation, failing to deeply integrate and probabilistically verify the logical reachability of the spatial dimension and the signal synchronization of the temporal dimension. This makes it difficult to distinguish between accidental concurrent events and real attack transmission sequences, resulting in insufficient credibility of the generated attack paths.

[0048] Inaccurate risk path identification and critical node location: Traditional methods often focus on shortest path search or attack graph size statistics, lacking in-depth modeling of the transitivity and causal dependencies between vulnerabilities, making it difficult to reconstruct a logically continuous complete attack chain. Furthermore, when identifying critical nodes connecting different security domains, they often rely on static topological centrality indicators, failing to consider the actual pivotal role of nodes in dynamic attack flows, resulting in difficulty in providing accurate defense and blocking recommendations.

[0049] Based on this, this application provides a security risk assessment method. By simultaneously acquiring risk correlation assessment data between device nodes and behavioral characteristic data at multiple time scales, it can take into account both network logical connection relationships and dynamic behavioral changes, providing a comprehensive and multi-dimensional data foundation for risk assessment. Furthermore, by fusing and calculating the above data to generate a dynamic risk correlation matrix, a deep integration of static topology attributes and time-series characteristics is achieved, enabling attack propagation risks to be quantified in probabilistic form in real time, significantly improving the accuracy and timeliness of risk assessment. On this basis, by evaluating attack paths using this matrix, specific attack propagation paths and key risk hub nodes can be accurately identified, thereby helping security personnel focus defense resources, effectively block cross-domain attack chains, and enhance the overall network's proactive protection capabilities.

[0050] The solutions provided by the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0051] The solution provided in this application can be applied to Figure 1 In the computer system shown, such as Figure 1 The diagram shown is a structural schematic of a computer system provided in an embodiment of this application.

[0052] For example, Figure 1 The computer system shown includes a data acquisition layer, a data layer, a multi-scale temporal correlation modeling layer, a vulnerability correlation analysis and path evaluation layer, and an output layer.

[0053] In some embodiments, the data acquisition layer is used to collect basic information and event information, and to use the basic information and event information as input.

[0054] The basic information includes, but is not limited to, asset ledgers, vulnerability scan results, and protocol configuration information, which are used to describe the static network environment; the event information includes, but is not limited to, device / system logs, security device alarms, and traffic monitoring data, which are used to capture dynamic network behavior.

[0055] Optionally, the data acquired by the data acquisition layer is fed into the underlying data layer for standardized processing and storage. This layer is configured with an asset and domain library, a vulnerability knowledge base, and a protocol model library to store static metadata. It is also configured with a log event library, an alarm event library, and a traffic database to store dynamic time-series data, providing a unified data foundation for upper-layer analysis.

[0056] In some embodiments, the data layer includes, but is not limited to, an asset and domain library, a vulnerability knowledge base, a protocol model library, a log event library, an alarm event library, and a traffic database.

[0057] In some embodiments, the multi-scale temporal correlation modeling layer includes a heterogeneous graph construction module and a temporal snapshot module. The heterogeneous graph construction module is used to fuse asset value and logical connection weights to construct a weighted heterogeneous graph based on logical reachability. That is, it is used to determine the logical connection relationships between multiple device nodes and the basic risk value of each device node. The temporal snapshot module is used to capture dynamic evolutionary features through multi-scale time windows, generating a temporal graph snapshot sequence. It can also extract fluctuation signals in the time dimension, i.e., obtain behavioral feature data of device nodes.

[0058] In some embodiments, the vulnerability association analysis and path evaluation layer includes a related feature module and a path evaluation module. The related feature module calculates the temporal correlation strength (i.e., temporal correlation) and spatial topological potential (i.e., spatial risk value) respectively, and fuses them at spatiotemporal scales to generate a dynamic risk association matrix. The path evaluation module uses a breadth-first search algorithm to score the association weights based on the dynamic risk association matrix to obtain the attack propagation path.

[0059] In some embodiments, the output layer is used to visually display the analysis results, including cross-domain vulnerability propagation paths sorted by risk value, clearly presenting the complete attack chain from the source vulnerability node through intermediate asset nodes to the target business domain, and a list of high-risk vulnerability nodes identified as key nodes.

[0060] Figure 2 This is a flowchart illustrating a security risk assessment method provided in an embodiment of this application. The method is applied to... Figure 1 The computer system can also be used for other equipment that supports the risk assessment process.

[0061] like Figure 2 As shown in the embodiments of this application, the security risk assessment method may include: Step S201: Obtain risk correlation assessment data between multiple device nodes, as well as behavioral characteristic data of multiple device nodes at multiple time scales.

[0062] Among them, risk association assessment data is used to characterize the logical connection relationship between multiple device nodes and the basic risk value of each device node, while behavioral feature data is used to characterize the behavioral features of multiple device nodes in the time dimension.

[0063] In some embodiments, a basic risk value for each device node is determined based on its node attributes, and a logical connection relationship is generated based on protocol configuration and vulnerability scanning results. Then, risk association assessment data is obtained based on the logical connection relationship and the basic risk value.

[0064] For example, the process of determining the basic risk value specifically includes: the system first establishes an index mapping relationship between IP addresses and graph nodes, for example, mapping IP address 192.168.1.100 to node v1, for example... .

[0065] Subsequently, quantitative values ​​are assigned based on the asset business level to determine the basic risk value of each equipment node. For example... .like Figure 3 As shown, industrial or enterprise networks are divided into three business domains (security domains) and assigned different basic value levels: Office Area (Low Value): Includes Office PC1 [Value = 1], Office PC2 [Value = 1], Office Printer [Value = 1], and IT Jump Server [Value = 2]. The office area also contains a vulnerability: CVE-2023-A (browser vulnerability). Furthermore, thin arrows indicate normally allowed paths (i.e., A = 1), such as the arrow from the office PC to the IT jump server, or from the engineer's workstation to the PLC controller 1.

[0066] Production Management Area (Medium Value): Includes a public web server [value = 3] and a historical database [value = 2]. The public web server and the historical database are connected via a protocol.

[0067] In addition, dashed lines with crosses indicate logical blocking paths (A=0), such as the arrow from the public web server to PLC slave controller 1. Thick arrows indicate high-risk / jump paths (A>1), such as the arrow from the IT jump server to the public web server, i.e., logical weight A=1.2 (authorized cross-domain), or the arrow from the engineer station to the PLC main controller, i.e., logical weight A=1.5 (critical jump path).

[0068] Core Control Area (High Value): Includes primary SCADA server [value = 5], backup SCADA server [value = 4], engineer workstation [value = 4], PLC master controller [value = 5], PLC slave controller 1 [value = 5], PLC slave controller 2 [value = 5], HMI operator station 1 [value = 4], and HMI operator station 2 [value = 4]. The core control area also contains a vulnerability: CVE-2024-B (PLC remote execution).

[0069] Furthermore, if a node belongs to the core control area (such as a PLC controller), it is determined to be high-value and assigned the highest risk value of 5; if it belongs to the production management area (such as an MES server), it is determined to be medium-value and assigned a risk value of 3; if it belongs to the office area (such as employee PCs), it is determined to be low-value and assigned a basic risk value of 1. In this way, a basic risk value vector of all network assets is formed, for example, [v1=5, v2=3, v3=1, ...], thereby clarifying the differences in risk levels of different assets during the initialization phase.

[0070] It should be noted that the protocol configuration includes physical connectivity factor and service reachability factor. The physical connectivity factor is used to characterize whether the device nodes in the device node pair are reachable at the network layer, and the service reachability factor is used to characterize whether the destination device node in the device node pair has opened the communication port required by the source device node.

[0071] Specifically, the physical connectivity factor is determined by checking the network topology configuration. For example, if node v1 (IP: 192.168.1.100 / 24) and node v2 (IP: 192.168.1.101 / 24) are on the same network segment, or if a reachable path exists as confirmed by the routing table, the factor is set to 1; otherwise, it is 0. The service reachability factor is determined by scanning the open ports of the destination node. For example, if node v2 has opened port 502, which is required for the Modbus TCP protocol, and node v1 needs to initiate a connection to that port, the service reachability factor is 1. This dual-verification mechanism ensures the physical foundation of the connection and service availability.

[0072] The vulnerability scan results include policy permission factor and jumper risk gain factor. The policy permission factor is used to characterize whether the firewall and access control policies allow communication connections between device nodes in a device node pair. The jumper risk gain factor is used to characterize whether the source device node has network configuration characteristics that can be used as a jumper for cross-domain attacks.

[0073] The policy allows factors to be implemented by parsing the firewall rule base. For example, even though nodes v1 and v2 are physically reachable and the service is open, if the firewall has the rule "deny from 192.168.1.100 to 192.168.1.101 port 502", then this factor is forced to be set to 0. Figure 3 The dashed line with a fork shown represents the case where the logic path is blocked (A=0).

[0074] The risk gain factor for hops is implemented by detecting the network configuration of nodes. If node v1 is found to have dual network cards (connected to the office network and the production network respectively), it is marked as a potential hop, and the gain constant is set to 0.5. This design can effectively identify key hop nodes for cross-domain attacks.

[0075] Specifically, the logical connection weights of the device node pairs are obtained by multiplying the physical connectivity factor, service reachability factor, policy permission factor, and springboard risk gain factor, and the logical connection relationships are obtained based on the logical connection weights.

[0076] For example, the logical connection weights can be obtained using the following formula 1: Formula 1 in, Physical connectivity factor For service accessibility factor, For the policy allowance factor, This is a risk gain factor for stepping stones.

[0077] For example, taking the connection from PC (v1) in the office area to PLC (v2) in the core area as an example: if the physical connectivity factor is 1 (routable reachable), the service reachability factor is 1 (PLC has an open 502 port), the policy permission factor is 1 (firewall allows), and the jump server risk gain is 0.5 (PC has dual network cards), then the final weight A 12 =1×1×1×(1+0.5)=1.5. This product-fusion mechanism ensures complete filtering during policy blocking (if any factor is 0, the whole is 0), while also highlighting the high-risk nature of the springboard path through the gain coefficient. For example... Figure 3 The thick arrows represent high-risk / stepping stone paths (A>1), and the thin arrows represent normal permitted paths (A=1).

[0078] In some embodiments, behavioral feature data is obtained by: acquiring security events for each of the multiple device nodes and assigning corresponding weight values ​​to the security events; and for each device node, accumulating the weight values ​​belonging to the target time scale to generate behavioral feature data of the device node at the target time scale, so as to obtain behavioral feature data of multiple device nodes at multiple time scales.

[0079] For example, the system receives real-time security event streams from the Security Information and Event Management (SIEM) system. For instance, when it detects an abnormal connection attempt by an office PC with IP address 192.168.1.10 to a core PLC with IP address 192.168.2.20, the system generates a security event log. The system then queries a pre-established node index table Map_IP to ID to assign the event to the corresponding device node (e.g., v_10 and v_20).

[0080] Next, weights are assigned based on event type: if a security event originates from an "abnormal PLC protocol communication" alarm (belonging to D_alert) generated by an intrusion prevention system (IPS), it is assigned a high weight w_e=10.0; if it is a system log of "continuous login failures" (belonging to D_log), it is assigned a medium weight w_e=5.0; and if it is a normal network traffic statistics event (belonging to D_flow), it is assigned a basic weight w_e=0.1. This weighting process ensures that high-threat events receive higher importance in subsequent aggregations.

[0081] In some embodiments, multiple time scales include, but are not limited to, micro-time windows, meso-time windows, and macro-time windows. Specifically, micro-time windows are used to capture second-level attack characteristics; meso-time windows are used to capture minute-level attack characteristics; and macro-time windows are used to capture long-term attack characteristics.

[0082] Specifically, the definition and application of multi-scale time windows are as follows: The system sets the time scale set S = {s1 = 10 seconds, s2 = 60 seconds, s3 = 300 seconds}. The micro-scale s1 is suitable for capturing short-term, high-frequency attacks such as Distributed Denial of Service (DDoS) attacks or brute-force attacks. For example, detecting thousands of connection attempts from the same source IP to the target PLC port 502 within a 10-second window will form a noticeable pulse waveform. The meso-scale s2 is suitable for analyzing persistent attack behaviors such as lateral movement. For example, after an attacker successfully compromises an office network jump server, continuously attempting to connect to multiple production network segments within a 1-minute time window will form a stable rising waveform. The macro-scale s3 is used to detect slow attacks such as Advanced Persistent Threats (APTs). For example, if an attacker transmits a small amount of data every 5 minutes through a DNS tunnel, low-frequency beaconing behavior can be identified through periodic pattern analysis within a 300-second window. Through this multi-scale design, the system achieves full spectrum coverage against both fast and slow attacks.

[0083] During the time-series snapshot generation phase, the system performs independent computation for each node at each scale. For example, for each node... At each selected scale The system maintains a sliding window sequence. First, for time... Events that occurred The system calculates the time slot number to which it belongs. Time slot number = / .

[0084] Next, the system accumulates the weights of all assigned events within the time slot and calculates the overall signal strength for that time slot. : .

[0085] Based on this, the system generates a length of The sliding window vector, i.e., the final time-series snapshot, is the behavioral feature data: Formula 2 For example, taking the calculation of node v_20 (PLC controller) at a microscale s1=10s as an example: assuming the current time τ is 12:00:05, then its time slot number k=floor(τ / s1)=floor(300 seconds / 10 seconds)=30. The system accumulates the weights of all events belonging to v_20 within time slot 30 (i.e., from 12:00:00 to 12:00:10). For example, if there are 2 IPS alarms (weight 10) and 100 abnormal traffic records (weight 0.1) in this window, then the signal strength val_20^s1(30)=2×10.0+100×0.1=30.0. The system maintains a sliding window with a length of T=10, and finally generates the timing snapshot vector Z_20^s1=[val(21), val(22), ..., val(30)] of the node. This vector directly reflects the activity change trend of the PLC under attack in the last 100 seconds, and provides a standardized timing input for subsequent related analysis.

[0086] For example, such as Figure 4 As shown, the Figure 4 The system employs a multi-frame animation presentation, vertically displaying three consecutive time slices: Time Snapshot G(t=1): initial signal acquisition; Time Snapshot G(t=2): signal evolution at intermediate moments; and Time Snapshot G(t=3): signal transmission at subsequent moments. This represents the system performing a "snapshot" sampling of the entire network's asset status at fixed time intervals (e.g., every 10 seconds). It reflects continuous observation at a specific scale (e.g., the microscale s1=10s) within a "multi-scale time window." Each snapshot G(t) captures the real-time behavioral signal strength of each asset in the network at that moment.

[0087] Evolution direction: The arrow "Evolution of time window" indicates that the analysis progresses from the past (t=1) to the present (t=3), simulating the real-time data processing process, that is, the system continuously receives new events and updates snapshots, thereby making the signal waveform flow.

[0088] It should be noted that, Figure 4 In this diagram, each box represents a network entity (device). For example, Office PC1 [Value=1], Office PC2 [Value=1], Office Printer [Value=1], IT Jump Server [Value=2], Public Web Server [Value=3], Historical Database [Value=3], Primary SCADA Server [Value=5], Backup SCADA Server [Value=4], Engineer Station [Value=4], HMI Operator Station 1 [Value=4], HMI Operator Station 2 [Value=4], PLC Master Controller [Value=5], PLC Slave Controller 1 [Value=5], PLC Slave Controller 2 [Value=5].

[0089] It is worth noting that Figure 4 The core value of this demonstration lies in making abstract "behavioral characteristic data" visible: t=1: Attack Initiation: Signal z(t) first appears in the left-hand office area (e.g., office PC1, IT jump server). The waveform is represented by a small box above the node in the diagram. At this time, the waveform may appear as a burst pulse, which corresponds to the detection of a large number of initial intrusion signs such as scanning and brute-force attacks.

[0090] t=2: Lateral Infiltration: The signal is transmitted through an IT jump server (a high-risk connection with A=1.5) to a public web server in the DMZ zone, and further evolves towards the SCADA server and PLC engineering station. At this point, the signal waveform may become a continuous oscillation, indicating that the attacker is attempting to establish a persistent connection or conduct internal network probing.

[0091] t=3: Core Reached: The signal eventually reaches the rightmost core production area, such as the PLC main controller. The waveform may show abnormal peaks, indicating that the attack command has been successfully sent to critical control equipment, which may cause physical impact.

[0092] This dynamic process visually demonstrates the generation and evolution of "behavioral feature data." Essentially, it involves aggregating discrete events into signal strengths (val) according to time windows, forming a time-series vector (Z_i^s). The signal flow in the diagram is a visualization of the attack chain in the time dimension.

[0093] Step S202: Perform fusion calculations on the risk correlation assessment data and behavioral characteristic data to generate a dynamic risk correlation matrix.

[0094] The dynamic risk correlation matrix is ​​used to characterize the probability of attack propagation risk between multiple device nodes in real time.

[0095] In some embodiments, based on behavioral feature data, the temporal correlation between each pair of multiple device nodes is calculated, and based on risk correlation assessment data, the spatial risk value of each device node in the multiple device nodes is calculated. Then, the temporal correlation and spatial risk value are fused and calculated to generate a dynamic risk correlation matrix.

[0096] Among them, temporal correlation is used to characterize the temporal correlation of attack propagation risk between device node pairs; device node pairs refer to node pairs with effective attack paths; spatial risk value is used to characterize the potential attack value of device nodes in the network.

[0097] Specifically, for each pair of device nodes in multiple device nodes, the waveform similarity of the device node pair at the target time scale is calculated, and the time decay factor, stability factor and waveform similarity of the device node pair are multiplied to determine the comprehensive credibility score of the device node pair. The comprehensive credibility scores of the device node pair at multiple time scales are weighted and aggregated to generate the temporal correlation of the device node pair.

[0098] Among them, the comprehensive trust score is used to characterize the possibility of attack propagation between device nodes at the target time scale.

[0099] For example, the calculation process of temporal correlation is implemented as follows: First, a single-scale basic correlation calculation is performed, taking the analysis of the office area PC (node ​​v1) and the core area PLC (node ​​v2) at a microscale of s1=10 seconds as an example. The analysis window length is set to T=10, which examines the signal strength of 10 time slots within the most recent 100 seconds. The signal sequences of nodes v1 and v2 are z1=[2.1, 15.3, 8.7, ..., 12.5] and z2=[0.1, 3.2, 1.8, ..., 4.3], respectively. The system uses the Pearson Correlation Coefficient to calculate waveform similarity, specifically as shown in Formula 3 below: Formula 3 in, and These are the sequence mean, =10 8 is a small constant to prevent division by zero errors. Calculated... =0.85.

[0100] It should be noted that, considering that attack propagation typically manifests as a positive surge (i.e., a large increase in traffic at the source node leads to a corresponding increase in traffic at the target node), a negative correlation usually implies non-aggressive business mutual exclusion. Therefore, a positive correlation truncation is performed to obtain the corrected coefficient: After positive correlation truncation, we get =0.85 (negative values ​​are set to 0 because attack propagation exhibits a positive correlation).

[0101] Next, the dynamic correction factor is calculated. The time decay factor is based on peak time delay analysis, and the decay formula is as follows: Formula 4 in, This is the attenuation constant, controlling the tolerance for time delay. For example, if the peak time of signal v1 is τ... peak (v1)=12:00:45, peak time of v2 τ peak(v2) = 12:00:46, time difference Δτ = 1 second. Assume the attenuation constant. =0.5 (seconds-1), which indicates that a 1-second delay is within a reasonable range, but still needs to be moderately attenuated.

[0102] The stability factor is calculated by measuring ρ over 10 historical windows. 12 The standard deviation is obtained, and the stability factor formula is: Formula 5 If the historical standard deviation is 0.3, then =0.77.

[0103] Furthermore, the overall trust score of the device node pair at the target time scale. It can be obtained through the following formula 6: Formula 6 like, =0.85×0.61×0.77=0.4.

[0104] Finally, multi-scale weighted aggregation is performed. The above process is repeated to obtain the mesoscale score (s² = 60 seconds). =0.25, Macroscale score (s3=300 seconds) =0.10. Weight allocation can be achieved using the following formula 7: Formula 7 Calculation yields α 12 (s ¹ ) =0.53, α 12 (s ² ) =0.33, α 12 (s ³ ) =0.14.

[0105] Furthermore, node pairs are generated through weighted aggregation. Final temporal correlation strength We obtain it through the following formula 8: Formula 8 For example, the final temporal correlation F12 = 0.53 × 0.40 + 0.33 × 0.25 + 0.14 × 0.10 = 0.31. This multi-scale fusion mechanism ensures adaptive detection capability against both fast and slow attacks.

[0106] Based on this, the timing correlation of multiple device nodes is determined using the above method.

[0107] Specifically, based on logical connection relationships, the network location value of each device node is calculated. The network location value is multiplied by the basic risk value of the device node to obtain the original risk value. The original risk value is then normalized to obtain the spatial risk value.

[0108] Among them, network location value refers to the network location value calculated by recursively aggregating the risk transmission potential of direct and indirect neighbor nodes, and is used to measure the potential risk level of a device node as an attack springboard or key hub.

[0109] For example, a simplified industrial network is used to illustrate this, containing five key device nodes: v1 (office PC, base value = 1), v2 (IT jump server, base value = 2), v3 (MES server, base value = 3), v4 (engineering station, base value = 4), and v5 (PLC controller, base value = 5). Their logical connections are shown in the adjacency matrix below (where A_{ij} represents the connection weight from node i to node j): v1v2v3v4v5 v100.8000 v2000.90.70 v30000.60 v400000.9 v500000 First, calculate the network location value (eigenvector centrality). Initialize the centrality vector EC. (0) =[1,1,1,1,1]. The iterative calculation formula is shown in Formula 9 below: Formula 9 For example, after the first iteration, the new centrality of each node is calculated as follows (taking node v4 as an example): [0.7×1+0.6×1]=1.3 / .

[0110] Repeat this process several times until convergence (set the convergence threshold ε=0.001), resulting in the stable centrality vector EC=[0.12, 0.28, 0.33, 0.51, 0.73]. It can be seen that although the PLC controller (v5) has the highest basic value, the engineering station (v4) has a higher network location value due to connecting multiple key nodes.

[0111] Furthermore, based on the adjacency matrix formed by logical connection relationships, the current value vector of the device node is iteratively updated. The above steps are repeated until the difference between the value vectors obtained from two adjacent iterations is less than a preset threshold, and the value vector is used as the network location value.

[0112] The network position value of each device node in the (t+1)th iteration is calculated by weighted summing of the network position values ​​of all neighboring nodes pointing to the device node in the tth iteration. The weight of the weighted sum is the logical connection weight of the corresponding connection edge.

[0113] For example, the above iterative process uses the power method for numerical solution. Taking the calculation of node v5 (PLC controller) in the third iteration as an example, the calculation process is as follows:

[0114] Where λ_max is the dominant eigenvalue of the adjacency matrix, used for normalization. The iteration termination condition is set to the difference in Euclidean norm between two consecutive iteration vectors being less than a threshold: ||EC|| (t+ ¹ ) - EC (t) || < 0.001. Through this iterative approach, the centrality value of each node recursively aggregates the risk transmission effects of all its upstream nodes.

[0115] After calculating the network location value, the system multiplies the network location value by the basic risk value of the device node to obtain the original risk value. It can be obtained through the following formula 10.

[0116] Formula 10 in, Basic risk value, Value of network location.

[0117] For example, take node v2 (IT jump server): Original Value at Risk = V base × EC = 2 × 0.28 = 0.56.

[0118] It should be understood that, in order to accommodate subsequent probability calculations, the system ultimately performs a normalization process to obtain the spatial risk value. : Formula 11 For example, =[0.56 - 0.12] / [3.65 - 0.12]=0.125, thus clearly depicting the comprehensive potential value of node v2 (IT jump server) in a static network structure that can be exploited by attackers.

[0119] Furthermore, for each pair of device nodes, the temporal correlation and spatial risk value of the corresponding pair of device nodes are weighted and multiplied to determine the attack propagation risk probability of the pair of device nodes, so as to obtain the attack propagation risk probability of multiple pairs of device nodes, and a dynamic risk correlation matrix is ​​generated based on the attack propagation risk probability of multiple pairs of device nodes.

[0120] For example, the generation process of the dynamic risk correlation matrix is ​​illustrated through the following specific example. Consider a device node pair consisting of an office area PC (node ​​v1) and a core area PLC controller (node ​​v5). Assume that F is obtained through time-series correlation calculation. 15 =0.85 (indicating that the two nodes exhibit highly synchronized abnormal behavior in the time dimension), and Ω5 =0.92 is obtained through spatial risk value calculation (indicating that the PLC controller has extremely high strategic value in the network).

[0121] It should be understood that an effective attack path requires nodes to have both high spatial value and high centrality. Furthermore, it requires strong signal synchronization between nodes in time. The absence of any single dimension should lead to a significant decrease in the risk value. The system uses normalized product fusion formula 12: Formula 12 For example, the probability of attack propagation risk for the device node pair between the office area PC (node ​​v1) and the core area PLC controller (node ​​v5) is: .

[0122] In contrast, consider another node pair: an IT jump server (node ​​v2) to a SCADA server (node ​​v6). If the time-series correlation F... 26 =0.45 (medium synchronicity), spatial risk value Ω6 = 0.88 (high value), then: .

[0123] Specifically, when examining the node pairs from the office printer (node ​​v7, lower base value) to the PLC controller, although timing dependencies F may exist... 75 =0.80, but since the space risk value of the printer Ω7 = 0.05 (extremely low), then: = 0.80 × 0.05 = 0.04.

[0124] The above calculation results show that the product fusion mechanism of this scheme can effectively achieve risk filtering: First, the v1→v5 path is identified as a high-risk path (0.782) because it has both high temporal correlation and high spatial value; second, the v2→v6 path has a moderate risk value (0.396) because its temporal correlation is average; and although the v7→v5 path has temporal correlation, its risk probability is suppressed to a negligible level (0.04) because the target node value is extremely low, which effectively avoids false alarms for low-value nodes.

[0125] Finally, the system traverses all N device nodes in the network, calculates the W_final(i,j) value for any node pair (i,j), and constructs an N×N dynamic risk correlation matrix. The mathematical expression of this matrix is: = F×Ω; Where F is the temporal correlation matrix, and Ω is the diagonal matrix of the spatial risk value vector. This represents the Hadamard product (element-wise product) of matrices. This matrix-based implementation ensures computational efficiency and enables real-time updates of the overall network risk situation.

[0126] It should be understood that, if (Not related in time), then This means that even if physically connected, no attack propagation has occurred at the current moment, thus completely filtering out static false alarms. If If the target node has no value, the risk weight will also be lowered, meaning that the path does not pose a high level of security threat. Only when both spatiotemporal features have high values... This will highlight high-risk connections. The final output matrix Essentially, it is a dynamically changing weighted directed graph matrix that accurately identifies the active cross-domain attack links at the current moment, providing a reliable basis for path identification that has been rigorously mathematically verified.

[0127] In another example, combined Figure 5 As shown, the inputs are: behavioral characteristic data, basic risk values, and logical connectivity relationships. Behavioral characteristic data includes, but is not limited to, real-time or near real-time security logs and traffic data, reflecting the dynamic activities of device nodes; basic risk values ​​can be understood as the inherent value of assets, and logical connectivity relationships can be understood as network reachability, used to describe the static attributes of the network.

[0128] Furthermore, the system receives the aforementioned core data and performs input analysis, specifically analyzing the characteristics and types of the input data to determine the data flow direction. For example, behavioral feature data is categorized into a time-series data stream, while basic risk values ​​and logical connections are categorized into a spatial data stream. Next, a multi-scale adaptive time-series technology module is used to calculate correlations and waveform similarity, that is, to extract attack correlations in the time dimension from dynamic behavioral data features.

[0129] Simultaneously, factor calculations are performed, including the time decay factor and the stability factor.

[0130] It should be understood that the time decay factor is used to penalize unreasonable time delays between anomalous behaviors of two nodes; the stability factor is used to assess whether such anomalous associations have been historically stable in order to rule out coincidences.

[0131] Then, the original waveform similarity (basic correlation) is multiplied by the two factors mentioned above to obtain the association strength score of the device node pair at a single time scale, i.e., the comprehensive credibility score. Subsequently, the system performs the above calculations at multiple time scales, including micro, meso, and macro scales, and then weights and fuses the calculation results to obtain the temporal correlation for the device node pair, i.e., the system performs multi-scale weighted aggregation. In this way, the temporal correlation of multiple device node pairs is determined.

[0132] For both basic risk values ​​and logical connectivity, the analysis categorizes these two types of data into spatial data streams, which are then calculated by the spatial topology potential energy calculation module. This module aims to calculate the value of nodes in the spatial dimension from static network data. First, the network location value is iteratively calculated based on logical connectivity (i.e., network topology) using algorithms such as eigenvector centrality. The core idea is that the value of a node lies not only in itself but also in the importance of the nodes connected to it. This process recursively aggregates the risk transmission potential energy of the entire network, identifying key hubs (such as jump servers) within the network.

[0133] Subsequently, the initial risk value is calculated by multiplying the calculated network location value (topological importance) with the node's basic risk value (intrinsic value). This means that a device node must be both important and strategically located to obtain a high initial risk value. After determining the initial risk value, the initial risk values ​​of all nodes are mapped to the [0,1] interval to obtain a standardized spatial risk value. This provides a foundation for subsequent fusion with probability values ​​in the time dimension.

[0134] Furthermore, it performs spatiotemporal scale fusion and output. For spatiotemporal scale fusion, this module performs spatiotemporal feature product fusion, specifically by weighting the temporal correlation of device node pairs with the corresponding spatial risk value of those device node pairs. For example... Figure 5 The system performs a weighted calculation of temporal correlation and spatial risk value. Then, it iterates through all N device nodes in the network, performing the above calculation on all device node pairs to obtain a dynamic risk correlation matrix.

[0135] This embodiment demonstrates the core advantages of spatiotemporal fusion computing through specific numerical examples: it avoids false alarms caused by relying solely on behavior detection (such as business peaks being misjudged as attacks), and overcomes the limitations of static assessment that only focuses on asset value, truly achieving accurate targeting of "ongoing attacks against high-value targets".

[0136] Step S203: Evaluate the attack path of the dynamic risk correlation matrix and identify the attack propagation path and the key risk hub nodes in the attack propagation path.

[0137] In some embodiments, based on a dynamic risk correlation matrix, path exploration is performed from device nodes in the potential attack source set to device nodes in the critical protection set. During the path exploration process, when the search path extends from the current device node to its adjacent device node, the cumulative probability of the explored path is multiplied by the corresponding attack propagation risk probability in the dynamic risk correlation matrix to update the cumulative probability of the path reaching the adjacent device node. Then, for target propagation paths whose cumulative path probability exceeds a preset threshold and successfully reach any device node in the critical protection set, backtracking is performed according to the recorded path predecessor relationship to determine the attack propagation path.

[0138] The potential attack source set consists of device nodes located in low-security-level areas and with known vulnerabilities, while the critical protection set consists of critical device nodes located in high-security-level areas.

[0139] For example, such as Figure 6 As shown, the specific implementation of the path evaluation process includes the following three steps: First, input: dynamic risk correlation matrix.

[0140] Step 1: Attack Surface Definition and Initialization The system adds the office PC1 (node ​​v1) with the vulnerability CVE-2023-A in the office area and the public web server (node ​​v3) with the vulnerability CVE-2023-C in the production management area to the potential attack source set S_src (low security zone / known vulnerabilities), and adds the PLC main controller (node ​​v5) and the main SCADA server (node ​​v6) in the core control area to the critical protection set S_dst (high security zone / critical assets).

[0141] Step 2: Path search based on weighted breadth-first search (BFS).

[0142] Initialize the priority queue Q (load the source node), i.e., Q=[v1, v3], with path cumulative probabilities P_cumul[v1]=1.0 and P_cumul[v3]=1.0, and the predecessor mapping table Parent is initially empty. Take v1 from the head of the queue and check its adjacent node v2 (IT jump server).

[0143] Secondly, check if the connection weight W > the threshold. If yes, update the probability and record the predecessor; otherwise, filter out low-probability noise. The update probability can be determined using the following formula: The predecessor can be obtained using the following formula: .

[0144] For example, retrieving the dynamic risk association matrix yields W_final(v1, v2) = 0.8 (greater than the threshold θ_prop = 0.1). Therefore, the cumulative probability of v2 is updated as follows: P_cumul[v2] = P_cumul[v1] × W_final(v1, v2) = 1.0 × 0.8 = 0.8. Parent[v2] = v1 is recorded, and v2 is added to the queue. Next, the connection from v2 to v4 (engineer's station) is examined. W_final(v2, v4) = 0.6, so P_cumul[v4] = 0.8 × 0.6 = 0.48.

[0145] Finally, when the search reaches v5 (PLC), W_final(v4, v5) = 0.9, and the cumulative probability of the complete path v1→v2→v4→v5 is 0.8×0.6×0.9 = 0.432.

[0146] Step 3: Path backtracking and key element extraction First, the system performs path backtracking (reconstructing the attack chain). That is, when it detects that P_cumul[v5]=0.432>0.4 (preset threshold), the system backtracks through the Parent mapping table: Parent[v5]=v4, Parent[v4]=v2, Parent[v2]=v1, thereby reconstructing the attack chain Path1=v1→v2→v4→v5.

[0147] Similarly, the cumulative probability of the other path v3→v2→v6 is 0.72×0.7×0.8=0.403, which also satisfies the threshold condition.

[0148] Secondly, the system performs risk ranking (Top-K filtering). For example, after sorting all paths by cumulative probability, the system outputs: critical attack chains (ranked by risk), i.e., Top-2 attack chains: Path1 (probability 0.432) and Path2 (probability 0.403). This probability-product-based search strategy ensures that only high-confidence complete attack chains are ultimately identified, effectively filtering out isolated security incidents.

[0149] Furthermore, key risk hub nodes are obtained by determining the display frequency of multiple device nodes in the attack propagation path, and identifying device nodes whose display frequency exceeds a preset threshold as key risk hub nodes.

[0150] For example, combined Figure 6 As shown, the system counts the frequency (identifying high-frequency nodes), that is, the frequency of occurrence of nodes in the two attack chains Path1 and Path2 mentioned above, and outputs the critical risk hub nodes (high-frequency jump servers / bottlenecks) based on this. For example, node v1 (office PC) appears once, v2 (IT jump server) appears twice, v3 (web server) appears once, v4 (engineer station) appears once, v5 (PLC) appears once, and v6 (SCADA) appears once. Assuming a frequency threshold φ=1.5, then the frequency of occurrence of node v2 (2.0) exceeds the threshold and is identified as a critical risk hub node.

[0151] Based on this, v2 acts as a springboard connecting office and production areas, playing a crucial relay role in multiple attack paths. Security personnel can implement focused protection for such hub nodes, such as deploying two-factor authentication, strengthening log monitoring, and restricting cross-domain access permissions, thereby maximizing the overall network security protection level at minimal cost. This embodiment clearly demonstrates how to extract actionable threat intelligence from a dynamic risk matrix through specific probability calculations and frequency statistics.

[0152] For example, this application also provides a security risk assessment device for implementing the above-described method embodiments.

[0153] like Figure 7 This is a schematic diagram of a security risk assessment device provided in an embodiment of this application. The security risk assessment device may include an acquisition module 701 and a processing module 702. The acquisition module 701 is used to execute... Figure 2 The illustrated method includes step S201; the processing module 702 is used to execute... Figure 2 The illustrated method includes steps S202 and S203.

[0154] In some embodiments, the aforementioned security risk assessment is used to achieve the above-described functions, which includes corresponding hardware structures and / or software modules for performing each function. Those skilled in the art will readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0155] This application embodiment can divide the security risk assessment device into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0156] like Figure 8 As shown, the computer device provided in this application embodiment may include a processor 801, a bus 802, a communication interface 803, and a memory 804. The processor 801, memory 804, and communication interface 803 communicate with each other via the bus 802. It should be understood that this application does not limit the number of processors and memories in the network device.

[0157] The 802 bus can be a PCI bus, an Extended Industry Standard Architecture (EISA) bus, or a UB bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 8 The bus 802 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 802 may include a path for transmitting information between various components of the network device (e.g., memory 804, processor 801, communication interface 803).

[0158] Processor 801 may include any one or more processors such as CPU, graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0159] The memory 804 may include volatile memory, such as random access memory (RAM). The processor 801 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0160] The communication interface 803 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between network devices and other devices or communication networks.

[0161] The memory 804 stores executable program code, and the processor 801 executes the executable program code to implement the functions of the aforementioned method embodiments. That is, the memory 804 stores instructions for executing the aforementioned security risk assessment method.

[0162] On the one hand, a computer-readable storage medium is provided, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor to implement the security risk assessment method provided in the above-described method embodiments.

[0163] In another aspect, a computer program product is provided, which includes a computer program or instructions that, when executed by a processor, implement the security risk assessment method provided in the above-described method embodiments.

[0164] Through the above description of the implementation methods, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the module can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, modules, and units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0165] Since the indicator generation module, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects obtained can also be referred to the above method embodiments, and the embodiments of the present invention will not be repeated here.

[0166] The method steps in this embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a network device. Of course, the processor and storage medium can also exist as discrete components in the network device.

[0167] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer programs or instructions. When a computer program or instruction is loaded and executed on a computer, the processes or functions of the embodiments of this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, or other programmable module. The computer program or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, a computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; it can also be an optical medium, such as a digital video disc (DVD); or it can be a semiconductor medium, such as a solid-state drive (SSD). The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A safety risk assessment method, characterized in that, The method includes: Obtain risk correlation assessment data between multiple device nodes, as well as behavioral characteristic data of the multiple device nodes at multiple time scales. The risk correlation assessment data is used to characterize the logical connection relationship between the multiple device nodes and the basic risk value of each device node, and the behavioral characteristic data is used to characterize the behavioral characteristics of the multiple device nodes in the time dimension. The risk correlation assessment data and the behavioral feature data are fused and calculated to generate a dynamic risk correlation matrix, which is used to characterize the real-time attack propagation risk probability between the multiple device nodes. The dynamic risk correlation matrix is ​​used to evaluate attack paths and identify attack propagation paths and key risk hub nodes in the attack propagation paths.

2. The method according to claim 1, characterized in that, The process of fusing and calculating the risk correlation assessment data and the behavioral characteristic data to generate a dynamic risk correlation matrix includes: Based on the behavioral feature data, the temporal correlation between each pair of device nodes is calculated. The temporal correlation is used to characterize the temporal correlation of attack propagation risk between device node pairs. The device node pair refers to a node pair with an effective attack path. Based on the risk correlation assessment data, the spatial risk value of each of the multiple device nodes is calculated. The spatial risk value is used to characterize the potential attack value of the device node in the network. The temporal correlation and the spatial risk value are fused and calculated to generate the dynamic risk correlation matrix.

3. The method according to claim 2, characterized in that, The step of fusing the temporal correlation and the spatial risk value to generate the dynamic risk correlation matrix includes: For each pair of device nodes, the temporal correlation and spatial risk value corresponding to the pair of device nodes are weighted and multiplied to determine the attack propagation risk probability of the pair of device nodes, so as to obtain the attack propagation risk probability of multiple pairs of device nodes. The dynamic risk correlation matrix is ​​generated based on the attack propagation risk probability of the multiple device node pairs.

4. The method according to claim 2, characterized in that, The step of calculating the temporal correlation between the multiple device nodes based on the behavioral feature data includes: For each pair of device nodes among the plurality of device nodes, calculate the waveform similarity of the pair of device nodes at the target time scale; The time decay factor, stability factor, and waveform similarity of the device node pair are multiplied to determine the comprehensive trust score of the device node pair. The comprehensive trust score is used to characterize the possibility that the device node pair has attack propagation under the target time scale. The temporal correlation of the device node pairs is generated by weighted aggregation of the comprehensive trust scores of the device node pairs across multiple time scales.

5. The method according to claim 2, characterized in that, The calculation of the spatial risk value of each of the multiple device nodes based on the risk association assessment data includes: Based on the logical connection relationship, the network location value of each device node is calculated. The network location value refers to the network location value calculated by recursively aggregating the risk transmission potential of direct neighbor nodes and indirect neighbor nodes, which is used to measure the potential risk level of the device node as an attack springboard or key hub. Multiply the network location value by the base risk value of the device node to obtain the original risk value; The original risk value is normalized to obtain the spatial risk value.

6. The method according to claim 5, characterized in that, The calculation of the network location value of each device node based on the logical connection relationship includes: Based on the adjacency matrix formed by the logical connection relationships, the current value vector of the device node is iteratively updated until the difference between the value vectors obtained in two adjacent iterations is less than a preset threshold, and the value vector is used as the network position value; wherein, the network position value of each device node in the (t+1)th iteration is calculated by weighted summation of the network position values ​​of all adjacent nodes pointing to the device node in the tth iteration, and the weight of the weighted summation is the logical connection weight of the corresponding connection edge.

7. The method according to claim 1, characterized in that, The attack path evaluation of the dynamic risk correlation matrix and the identification of attack propagation paths include: Based on the dynamic risk correlation matrix, a path exploration is performed from the device nodes in the potential attack source set to the device nodes in the critical protection set. The potential attack source set consists of device nodes located in low security level areas and have known vulnerabilities, while the critical protection set consists of critical device nodes located in high security level areas. During the path exploration process, when the search path extends from the current device node to the adjacent device node of the current device node, the cumulative probability of the explored path is multiplied by the attack propagation risk probability corresponding in the dynamic risk association matrix to update the cumulative probability of the path reaching the adjacent device node. For target propagation paths whose cumulative probability exceeds a preset threshold and successfully reach any device node in the critical protection set, reverse backtracking is performed based on the recorded path predecessor relationship to determine the attack propagation path.

8. The method according to claim 1 or 7, characterized in that, The key risk hub nodes are obtained through the following methods: The display frequency of the multiple device nodes in the attack propagation path is determined, and the device nodes whose display frequency exceeds a preset threshold are identified as the key risk hub nodes.

9. The method according to claim 1, characterized in that, The acquisition of risk correlation assessment data between multiple device nodes includes: Based on the node attributes of each device node, determine the basic risk value of the device node; The logical connection relationship is generated based on the protocol configuration and vulnerability scanning results; Based on the logical connection relationship and the basic risk value, the risk association assessment data is obtained.

10. The method according to claim 9, characterized in that, The protocol configuration includes a physical connectivity factor and a service reachability factor. The physical connectivity factor is used to characterize whether the device nodes in a device node pair are reachable at the network layer. The service reachability factor is used to characterize whether the destination device node in a device node pair has opened the communication port required by the source device node. The vulnerability scan results include a policy permission factor and a jump-board risk gain factor. The policy permission factor is used to characterize whether the firewall and access control policies allow communication connections between device nodes in a device node pair. The jump-board risk gain factor is used to characterize whether the source device node has network configuration characteristics that can be used as a jump-board for cross-domain attacks. The generation of the logical connection relationship based on protocol configuration and vulnerability scanning results includes: The logical connection weight of the device node pair is obtained by multiplying the physical connectivity factor, the service reachability factor, the policy allowance factor, and the jump board risk gain factor. The logical connection relationship is obtained based on the logical connection weights.

11. The method according to claim 1, characterized in that, The behavioral characteristic data is obtained through the following methods: For each of the plurality of device nodes, obtain the security events of the device node, and assign a corresponding weight value to the security events; For each device node, the weight values ​​belonging to the target time scale are accumulated to generate the behavioral feature data of the device node under the target time scale, so as to obtain the behavioral feature data of the multiple device nodes under multiple time scales.

12. The method according to any one of claims 1 to 11, characterized in that, The multiple time scales include: Microscopic time windows are used to capture second-level attack characteristics; Mid-level time windows are used to capture minute-level attack characteristics; Macro-level time windows are used to capture long-term attack characteristics.

13. A safety risk assessment device, characterized in that, The device includes: The acquisition module is used to acquire risk correlation assessment data between multiple device nodes and behavioral characteristic data of the multiple device nodes at multiple time scales. The risk correlation assessment data is used to characterize the logical connection relationship between the multiple device nodes and the basic risk value of each device node. The behavioral characteristic data is used to characterize the behavioral characteristics of the multiple device nodes in the time dimension. The processing module is used to perform fusion calculations on the risk correlation assessment data and the behavioral feature data to generate a dynamic risk correlation matrix, which is used to characterize the real-time attack propagation risk probability between the multiple device nodes. The processing module is also used to evaluate the attack path of the dynamic risk correlation matrix and identify the attack propagation path and the key risk hub nodes in the attack propagation path.

14. A computer device, characterized in that, The computer device includes a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the security risk assessment method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the security risk assessment method as described in any one of claims 1 to 12.

16. A computer program product, characterized in that, The computer program product includes a computer program or instructions that, when executed by a processor, implement the security risk assessment method as described in any one of claims 1 to 12.

Images