ATTCK attack simulation confrontation method and system in water conservancy system

Abstract

The invention relates to the technical field of electronic data processing, and discloses ATTamp in a water conservancy system. The invention discloses a CK attack simulation confrontation method and system, and the method comprises the steps: constructing a knowledge graph, calculating the physical process coupling degree for each node based on the centrality and a controllable parameter disturbance range, and constructing a weighted attack graph; acquiring an attack starting point and target assets, generating candidate attack paths by adopting a path search algorithm, and calculating a composite confrontation path coverage rate; judging whether the composite confrontation path coverage rate reaches a preset system security baseline, if not, feeding back and adjusting the attack state transition probability, and regenerating the attack path until the system security baseline is reached; and for an attack path set reaching a system security baseline, identifying security control points on an effective path, and performing descending order arrangement on the security control points according to the accumulated failure contribution value to form a defense reinforcement priority. According to the method, the key node which plays a decisive role in preventing serious physical damage can be accurately identified, and the pertinence of defense reinforcement is improved.

Description

Technical Field

[0001] This invention relates to the field of electronic data processing technology, specifically to a method and system for simulating and countering ATT&CK attacks in a water conservancy system. Background Technology

[0002] As a critical national infrastructure, water conservancy systems increasingly rely on complex cyber-physical systems (CPS) comprised of sensors, controllers, actuators, and communication networks. This dependence makes them a prime target for cyberattacks. Attackers may exploit system vulnerabilities to infiltrate industrial control networks from cyberspace, maliciously manipulating physical equipment such as gates and pumps, leading to severe consequences such as water outages, floods, or even dam failures. To address such threats, security researchers often use attack graphs and the ATT&CK framework to model and simulate potential attack paths. However, existing attack graph construction methods mostly focus on network-level connectivity and vulnerability exploitability, making it difficult to accurately quantify the disruptive capabilities of different cyberattack techniques on specific physical processes and their cascading effects. Consequently, the generated attack graphs fail to accurately reflect the actual threat level to physical security.

[0003] Several issues exist with existing technologies for attack graph simulation and defense decision-making. First, in the path generation phase, path search algorithms tend to find the shortest or simplest path, resulting in insufficient diversity of simulated attack scenarios and an inability to fully cover the complex combinations of techniques attackers might employ—a "coverage" problem. Second, coverage metrics used to evaluate simulation effectiveness are often too simplistic, such as merely counting the number of attack techniques or vulnerabilities hit, failing to consider the impact of attack paths on critical physical assets and the severity of their physical consequences. This makes the evaluation results insufficient to comprehensively guide the optimization of the defense system. Finally, when identifying critical defense nodes for hardening, current methods rely heavily on static network topology metrics (such as node centrality) or simple path frequency statistics, lacking an evaluation mechanism that combines the cumulative impact of multiple effective attack paths and physical coupling characteristics. This makes it difficult to precisely focus defense resources on the most critical security control points for preventing severe physical damage. Summary of the Invention

[0004] This invention provides a method and system for simulating and countering ATT&CK attacks in a water conservancy system to solve the problem in the prior art that it is difficult to accurately identify the key nodes that play a decisive role in preventing serious physical damage, resulting in insufficient targeting of defense reinforcement.

[0005] In a first aspect, the ATT&CK attack simulation and countermeasure method in the water conservancy system of the present invention includes the following steps: A knowledge graph representing the correlation between attack techniques and physical assets in a water conservancy system is constructed. Based on the centrality of attack technique nodes in the knowledge graph and the range of controllable parameter perturbations on associated physical assets, the physical process coupling degree of each node is calculated, and a weighted attack graph is constructed. The attack starting point and target assets are obtained from the weighted attack graph. A path search algorithm based on attack state transition probability is used to generate candidate attack paths. When the vulnerability activation cost corresponding to the next attack technique node is higher than the dynamic cost threshold, the corresponding attack state transition probability is reduced. The number of attack techniques involved, the number of critical assets affected, and the average physical consequence severity at the path endpoint of the candidate attack path set are normalized and weighted to obtain a composite adversarial path. Path coverage; determine whether the coverage of composite adversarial paths has reached the preset system security baseline. If not, adjust the attack state transition probability by reducing the attack state transition probability of covered paths and increasing the attack state transition probability of untouched attack technology nodes, and regenerate attack paths until the coverage of composite adversarial paths reaches the system security baseline. For the set of attack paths that have reached the system security baseline, identify security control points on effective paths that reach critical assets. Combine physical process coupling and attack state transition probability to calculate the cumulative failure contribution value of each security control point on all effective paths. Sort the security control points in descending order according to the cumulative failure contribution value to form a defense hardening priority.

[0006] Preferably, the centrality is calculated using the PageRank algorithm.

[0007] Preferably, the calculation of physical process coupling for each node based on the centrality of attack technology nodes in the knowledge graph and the range of controllable parameter perturbations on associated physical assets includes: The range of controllable parameter disturbances to associated physical assets by each attack technique node is quantified into a normalized disturbance impact score S, where ; Multiplying the centrality C by the perturbation impact score S yields the physical process coupling degree PPC for each attack technique node.

[0008] Preferably, the dynamic cost threshold is calculated in the following way: Obtain the basic cost threshold B; During the path search process, for a candidate attack path of length L, the sum of the physical process coupling degrees of all nodes that already contain attack techniques along the candidate attack path is calculated. ; The dynamic cost threshold T is calculated using the following formula: .

[0009] Preferably, the process of normalizing and weighting the number of attack techniques, the number of critical assets affected, and the average physical consequences at the end of the path in the candidate attack path set to obtain the composite adversarial path coverage includes: The number of attack technique nodes reached by the candidate attack path set. , Divide by the total number of attack nodes to obtain the technology coverage. ; Count the number of key assets affected , The asset coverage ratio is obtained by dividing by the total number of key assets. ; Calculate the physical consequence severity score for the endpoint of each candidate attack path, and then normalize the physical consequence severity scores to obtain the average physical consequence severity. ; Composite Countermeasure Path Coverage Calculated using the following formula: ,in, , , As weight.

[0010] Preferably, the feedback adjustment of the attack state transition probability includes: For the attack state transition probability P(i,j) between any two adjacent attack technique nodes i and j on the covered path, apply the decay factor. Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probability from attack node k on a covered path to an untouched attack node m. Application of enhancement factors Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probabilities starting from attack technique node k are normalized.

[0011] Preferably, the calculation of the cumulative failure contribution value of each security control point across all effective paths includes: For a given security control point SC, identify the set of all valid paths passing through the security control point. ; For each valid path passing through the security control point SC Calculate the overall attack state transition probability of the effective path. The overall attack state transition probability is the product of the attack state transition probabilities along the effective path. Valid path Physical process coupling of the endpoint target asset ; The security control point is on the valid path. Failure contribution value Calculated using the following formula: ; The cumulative failure contribution value is obtained by summing the failure contribution values ​​of the security control point on all valid paths passing through it. .

[0012] Preferably, the step of generating candidate attack paths using a path search algorithm based on attack state transition probability includes: A path search algorithm is used, treating nodes and state transitions in the weighted attack graph as vertices and edges, respectively. When extending from the end node of the current path to the next node, determine whether the activation cost of the vulnerability corresponding to the next node is higher than the dynamic cost threshold calculated based on the current path; If so, then reduce the probability of the corresponding attack state transition; Set the weight of each edge to the negative logarithm of the adjusted or original attack state transition probability; Starting from the obtained attack origin, search for the few attack paths with the lowest cost as candidate attack paths.

[0013] Preferably, the security control points include firewall policies, intrusion detection system signatures, and access control list entries.

[0014] Secondly, the ATT&CK attack simulation and countermeasure system in the water conservancy system of the present invention includes a memory and a processor. The memory stores computer instructions, and when the processor executes the computer instructions, it implements the above-mentioned ATT&CK attack simulation and countermeasure method in the water conservancy system.

[0015] The beneficial effects of this invention are as follows: By constructing a weighted attack graph that quantifies the impact of attack techniques on physical processes, this invention makes attack simulation more closely resemble the physical reality of water conservancy systems, reducing the limitation of attack graphs that only focus on network connectivity. In attack path generation, cost constraints related to path length and physical impact are introduced. A composite coverage index that considers technology coverage, asset impact, and physical consequences is used to evaluate and guide the simulation process, ensuring that the generated attack path set has higher diversity and threat realism. This invention proposes a security control point ranking method based on cumulative failure contribution value. This method integrates the physical coupling degree and state transition probability on multiple effective attack paths, enabling the identification of key nodes that play a decisive role in preventing severe physical damage, thus improving the targeting and effectiveness of defense hardening. Attached Figure Description

[0016] Figure 1 A flowchart illustrating the ATT&CK attack simulation and countermeasure method in a water conservancy system provided in this embodiment of the invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0018] like Figure 1 As shown, an embodiment of the ATT&CK attack simulation and countermeasure method in a water conservancy system provided by the present invention includes the following steps: S1. Construct a knowledge graph representing the correlation between attack techniques and physical assets in the water conservancy system. Based on the centrality of the attack technique nodes in the knowledge graph and the range of controllable parameter perturbations on the associated physical assets, calculate the physical process coupling degree for each node and construct a weighted attack graph.

[0019] Specifically, all physical assets in the water conservancy system are identified, such as main dams, floodgates, dispatch center servers, PLC controllers, and hydrological sensors, treating these physical assets as entity nodes. Simultaneously, attack techniques from the ATT&CK framework are introduced as another type of entity node, such as T0831 manipulation and control, and T0855 man-in-the-middle attack. By analyzing system architecture, vulnerability reports, and historical security events, relationships between these nodes are established. For example, PLC controller A has a vulnerability CVE-X, which can be exploited by attack technique T0831, and PLC controller A controls the physical asset floodgate B. This forms a knowledge graph containing multi-dimensional information including assets, vulnerabilities, and attack techniques. Then, the centrality of each attack technique node is calculated, i.e., the number of asset nodes directly associated with that node. Furthermore, the perturbation range of controllable parameters on associated physical assets is quantified for each technique node. For example, an attack that can change the gate opening from 0% to 100% has a higher perturbation range score than an attack that can only adjust by 5%. Finally, the normalized centrality value and the perturbation range score are weighted and summed to obtain the physical process coupling degree of the attack technique. This coupling degree will be used as the weight of the corresponding attack step or node in the attack graph to construct the weighted attack graph.

[0020] S2: Obtain the attack starting point and target asset in the weighted attack graph, and generate candidate attack paths using a path search algorithm based on attack state transition probability. When the vulnerability activation cost corresponding to the next attack technology node is higher than the dynamic cost threshold, the corresponding attack state transition probability is reduced.

[0021] Specifically, first, a clear attack starting point (e.g., an accessible IP address on an external network) and target asset are defined, such as the control system of a dam's spillway. Path searching employs an improved Monte Carlo tree search algorithm. During the search, the initial probability of each state transition depends on the ease of exploiting the corresponding vulnerability, such as the CVSS score. During the search, a dynamic cost threshold is calculated in real-time. For example, the dynamic cost threshold decreases as the attack path deepens, its length increases, or the path has already caused significant physical impact, i.e., the cumulative physical process coupling is high. If the next attack step explored, such as using a complex zero-day vulnerability for activation, has an activation cost higher than the currently calculated dynamic cost threshold, the state transition probability of the selected step is multiplied by a decay factor less than 1, such as 0.5. This simulates an attacker's tendency to choose low-cost, high-efficiency attack methods after the attack has deepened, generating more realistic candidate attack paths.

[0022] S3 normalizes and weights the number of attack technologies touched by the candidate attack path set, the number of critical assets affected, and the average physical consequences severity of the path endpoints to obtain the composite adversarial path coverage rate; determines whether the composite adversarial path coverage rate reaches the preset system security baseline. If it does not reach the baseline, it feeds back to adjust the attack state transition probability by reducing the attack state transition probability of covered paths and increasing the attack state transition probability of untouched attack technology nodes, and regenerating attack paths until the composite adversarial path coverage rate reaches the system security baseline.

[0023] Specifically, firstly, the number of different ATT&CK attack techniques covered by all generated candidate attack paths is counted to obtain the technique coverage number. Secondly, a list of critical assets is predefined, such as main control PLCs, emergency power supplies, and scheduling databases. The number of assets in this list touched by each path is counted to obtain the critical asset impact number. Thirdly, a physical consequence severity level table is defined, for example, level 1 is information leakage, level 2 is partial functional failure, level 3 is regional water supply interruption, and level 4 is dam failure risk. A severity level score is assigned to the endpoint state of each attack path, and the average score of all paths is calculated. The technique coverage number, critical asset impact number, and average physical consequence severity score are each min-max normalized to ensure that the values ​​fall within the range of 0 to 1. Weighting coefficients are obtained according to the defense strategy; for example, the highest concern for physical consequences is assigned a weighting coefficient of 0.5, and the weights for technique coverage and asset impact are 0.25. The three normalized values ​​are multiplied by their respective weights and summed to obtain the composite adversarial path coverage rate.

[0024] First, a system security baseline value is set, for example, 0.8. Then, the calculated composite adversarial path coverage is compared with 0.8. If the current coverage is 0.7, which is lower than the baseline, a feedback adjustment mechanism is initiated. All currently generated paths are traversed, and the probability of each state transition constituting these paths, such as from node A to node B, is multiplied by a decay factor, such as 0.9. Simultaneously, attack technique nodes existing in the attack graph but not yet reached by any path are identified, and all preceding state nodes capable of transitioning to these unreached nodes are identified. The state transition probabilities from these preceding nodes to unreached nodes are multiplied by an enhancement factor, such as 1.1. After completing the probability adjustment, the current candidate attack path set is cleared, and the path search algorithm in step two is re-executed with the updated state transition probabilities to generate a new path set, and the coverage is recalculated. This process is repeated until the calculated composite adversarial path coverage is greater than or equal to 0.8.

[0025] S4 identifies security control points on effective paths that reach critical assets, based on the set of attack paths that reach the system security baseline. Combining physical process coupling and attack state transition probability, it calculates the cumulative failure contribution value of each security control point on all effective paths. Based on the cumulative failure contribution value, the security control points are sorted in descending order to form a defense hardening priority.

[0026] Specifically, from the set of attack paths reaching the security baseline, all paths ending at critical assets, such as the path to the main control PLC, are selected as valid paths. Security control points (SCCPs) on these valid paths are identified, such as firewall policies, intrusion detection system signatures, and access control list entries. For each SCCP, its failure contribution value on a single path is calculated. The failure contribution value equals the product of the state transition probability of the attack step caused by the control point's failure and the physical coupling degree of the attack step. The failure contribution values ​​of the SCCP on all valid paths passing through it are summed to obtain the total cumulative failure contribution value. For example, if a firewall rule A appears on three valid paths leading to serious consequences, the cumulative failure contribution value is the sum of its contributions on each of those three paths. All SCCPs are sorted from highest to lowest cumulative failure contribution value. The highest-ranked SCCP, such as one that blocks a specific access control policy on multiple high-physical-impact paths, is the most priority for reinforcement.

[0027] In an optional embodiment, the calculation of physical process coupling for each node based on the centrality of attack technology nodes in the knowledge graph and the range of controllable parameter perturbations on associated physical assets includes: The range of controllable parameter disturbances to associated physical assets by each attack technique node is quantified into a normalized disturbance impact score S, where ; Multiplying the centrality C by the perturbation impact score S yields the physical process coupling degree PPC for each attack technique node.

[0028] The centrality is calculated using the PageRank algorithm.

[0029] For example, firstly, the importance of each attack technique node in the overall attack network is assessed. Assuming a knowledge graph containing nodes T1, T2, and T3, running the PageRank algorithm yields centrality values ​​C of 0.6, 0.3, and 0.1, respectively, indicating that T1 is the most important hub node in the network. Secondly, the actual physical impact of each technique node is quantified. For example, technique node T1 can change the speed of a water pump by 80% of its maximum permissible range, while T2 can only change it by 40%. Normalizing these impact levels, the perturbation impact score S for T1 is 0.8, and for T2 it is 0.4. Finally, the importance of the nodes is combined with their physical impact. For node T1, the physical process coupling degree (PPC) is calculated as the centrality value of 0.6 multiplied by the perturbation impact score of 0.8, resulting in 0.48. For node T2, the PPC value is 0.12. By calculating the PPC value for each technique node, the highest-risk technique nodes that are both in critical attack positions and capable of causing significant physical damage can be identified.

[0030] In an optional embodiment, the dynamic cost threshold is calculated in the following manner: Obtain the basic cost threshold B; During the path search process, for a candidate attack path of length L, the sum of the physical process coupling degrees of all nodes that already contain attack techniques along the candidate attack path is calculated. ; The dynamic cost threshold T is calculated using the following formula: .

[0031] For example, first, a fixed base cost threshold B is set, such as 100. While exploring an attack path, the path's characteristics are calculated in real time. Assuming the current path contains 3 nodes (path length L equals 3), and the Physical Process Coupling (PPC) values ​​of these 3 nodes are 0.5, 0.3, and 0.4 respectively, the sum of the PPC values ​​is 1.2. According to the formula, T is approximately equal to 27.8. Starting from the end node of the current path, path exploration continues only if the activation cost of the next attack step is below 27.8. For shorter paths or paths with less physical impact, the dynamic threshold is higher, allowing exploration of more costly attack steps, ensuring the effective discovery of diverse and potentially threatening attack paths.

[0032] In an optional embodiment, the process of normalizing and weighting the number of attack techniques, the number of critical assets affected, and the average physical consequences severity at the path endpoints of the candidate attack path set to obtain the composite adversarial path coverage includes: The number of attack technique nodes reached by the candidate attack path set. , Divide by the total number of attack nodes to obtain the technology coverage. ; Count the number of key assets affected , The asset coverage ratio is obtained by dividing by the total number of key assets. ; Calculate the physical consequence severity score for the endpoint of each candidate attack path, and then normalize the physical consequence severity scores to obtain the average physical consequence severity. ; Composite Countermeasure Path Coverage Calculated using the following formula: ,in, , , As weight.

[0033] For example, suppose there are a total of 100 attack technology nodes and 20 critical physical assets. After path generation, the resulting candidate path set covers a total of 30 different technology nodes, therefore... The value is 0.3. Meanwhile, the path affected five key assets, therefore... The value is 0.25. Assume the severity scores of the physical consequences corresponding to the path endpoints are 8, 7, and 9, respectively, with a maximum score of 10 and an average score of 8. Normalizing this average score to the interval between 0 and 1 yields... The value is 0.8. The three indicators are then weighted and summed according to preset weights to calculate the composite adversarial path coverage. .like It is 0.4. It is 0.4. If the value is 0.2, then the calculated result is 0.38. The coverage of composite adversarial paths reflects the overall threat level of the current set of attack paths.

[0034] In an optional embodiment, the feedback adjustment of the attack state transition probability includes: For the attack state transition probability P(i,j) between any two adjacent attack technique nodes i and j on the covered path, apply the decay factor. Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probability from attack node k on a covered path to an untouched attack node m. Application of enhancement factors Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probabilities starting from attack technique node k are normalized.

[0035] For example, suppose a path is found in a search, containing a single step from node i to node j, with an initial state transition probability of 0.7. To avoid repeatedly finding similar paths in subsequent searches, this transition probability is multiplied by a decay factor of 0.9, reducing the updated probability to 0.63. Simultaneously, exploring unknown areas is encouraged. Suppose node k on the path has two exits, one leading to a node on a known path, and the other leading to a new node m not yet reached by any path, with an initial probability of 0.2. The probability leading to the new node m is multiplied by an enhancement factor of 1.1, increasing the probability to 0.22. To ensure the effectiveness of the probabilistic model, all transition probabilities originating from node k need to be re-normalized to ensure their sum is 1. Through this biased adjustment, the search scope can be progressively expanded, resulting in a more comprehensive understanding of potential attack paths in the system.

[0036] In an optional embodiment, calculating the cumulative failure contribution value of each security control point across all valid paths includes: For a given security control point SC, identify the set of all valid paths passing through the security control point. ; For each valid path passing through the security control point SC Calculate the overall attack state transition probability of the effective path. The overall attack state transition probability is the product of the attack state transition probabilities along the effective path. Valid path Physical process coupling of the endpoint target asset ; The security control point is on the valid path. Failure contribution value Calculated using the following formula: ; The cumulative failure contribution value is obtained by summing the failure contribution values ​​of the security control point on all valid paths passing through it. .

[0037] For example, taking a firewall rule SC as an example, from the generated set of valid attack paths, all paths that must pass through this firewall to succeed are filtered out. Suppose two paths are filtered out, path 1 and path 2. For path 1, the overall attack state transition probability is obtained by multiplying the state transition probabilities of each step. The physical process coupling of the asset in a path attack is 0.1. The value is 0.8. Therefore, the firewall's failure contribution value on path 1 is... This equals 0.08. The same calculation is then performed for path 2. Assume the overall attack state transition probability for path 2. It is 0.05. If the value is 0.9, then the firewall's contribution to failure on path 2 is... The value is 0.045. The cumulative failure contribution value is obtained by summing the failure contribution values ​​of the firewall on all relevant paths. The value is 0.125. The higher the total value, the more high-probability and high-physical-harm attack paths the firewall rules have blocked, and the greater their importance in the overall security system.

[0038] In an optional embodiment, the step of generating candidate attack paths using a path search algorithm based on attack state transition probabilities includes: A path search algorithm is used, treating nodes and state transitions in the weighted attack graph as vertices and edges, respectively. When extending from the end node of the current path to the next node, determine whether the activation cost of the vulnerability corresponding to the next node is higher than the dynamic cost threshold calculated based on the current path; If so, then reduce the probability of the corresponding attack state transition; Set the weight cost of each edge to the negative logarithm of the adjusted or original attack state transition probability P, i.e., weight cost = -log(P). Starting from the obtained attack origin, search for the few attack paths with the lowest cost as candidate attack paths.

[0039] For example, the attack path generation process can be transformed into a problem of finding the lowest-cost path on a weighted attack graph. Cost verification is performed when expanding the path. For instance, the dynamic cost threshold of the current path is calculated to be 50, while the activation cost of the next potential attack node B is 60. Since 60 is higher than 50, directly expanding to B is not cost-effective; the state transition probability from the current node to B is temporarily lowered to reduce the likelihood of choosing this branch. The state transition probabilities of all edges in the graph are converted into costs for path search. A high-probability transition with a probability of 0.9 has a cost of approximately 0.105, while a low-probability transition with a probability of 0.1 has a cost of approximately 2.30. Through this conversion, the path with the highest probability becomes the path with the lowest cumulative cost. Starting from a preset attack entry point, a shortest path algorithm such as Dijkstra's algorithm is run to find a batch of paths with the lowest cumulative cost, such as the top 100 lowest-cost paths. These paths constitute the most feasible set of candidate attack paths.

[0040] The implementation principle of the ATT&CK attack simulation and countermeasure method in the water conservancy system of this invention is as follows: Firstly, this invention constructs a weighted attack graph that quantifies the impact of attack techniques on physical processes, making the attack simulation more closely resemble the physical reality of the water conservancy system and overcoming the limitation of traditional attack graphs that only focus on network connectivity. Secondly, in attack path generation, this invention introduces cost constraints related to path length and physical impact, and uses a composite coverage index that comprehensively considers technology coverage, asset impact, and physical consequences to evaluate and guide the simulation process, ensuring that the generated attack path set has higher diversity and threat realism. Finally, this invention also proposes a security control point ranking method based on cumulative failure contribution value. This method integrates the physical coupling degree and state transition probability on multiple effective attack paths, accurately identifying key nodes that play a decisive role in preventing severe physical damage, thereby improving the targeting and effectiveness of defense hardening.

[0041] An embodiment of the ATT&CK attack simulation and countermeasure system in a water conservancy system provided by the present invention includes a memory and a processor. The memory stores computer instructions, and when the processor executes the computer instructions, it implements the ATT&CK attack simulation and countermeasure method in the water conservancy system described in the above embodiment.

[0042] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for simulating and countering ATT&CK attacks in a water conservancy system, characterized in that, include: A knowledge graph representing the correlation between attack techniques and physical assets in a water conservancy system is constructed. Based on the centrality of attack technique nodes in the knowledge graph and the range of controllable parameter perturbations on associated physical assets, the physical process coupling degree of each node is calculated, and a weighted attack graph is constructed. The attack starting point and target assets are obtained from the weighted attack graph, and a path search algorithm based on attack state transition probability is used to generate candidate attack paths. When the vulnerability activation cost corresponding to the next attack technique node is higher than the dynamic cost threshold, the corresponding attack state transition probability is reduced. The number of attack techniques touched by the candidate attack path set, the number of critical assets affected, and the average physical consequence severity of the path endpoint are normalized and weighted to obtain the composite adversarial path coverage. It is determined whether the composite adversarial path coverage reaches the preset system security baseline. If it does not reach the baseline, the attack state transition probability is adjusted by reducing the attack state transition probability of covered paths and increasing the attack state transition probability of untouched attack technique nodes, and attack paths are regenerated until the composite adversarial path coverage reaches the system security baseline. For the set of attack paths that reach the system security baseline, identify the security control points on the effective paths that reach critical assets. Combine the physical process coupling degree and the attack state transition probability to calculate the cumulative failure contribution value of each security control point on all effective paths. Based on the cumulative failure contribution value, the security control points are sorted in descending order to form a defense hardening priority.

2. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The centrality is calculated using the PageRank algorithm.

3. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 2, characterized in that, The calculation of physical process coupling for each node, based on the centrality of attack technique nodes in the knowledge graph and the range of controllable parameter perturbations on associated physical assets, includes: The range of controllable parameter disturbances to associated physical assets by each attack technique node is quantified into a normalized disturbance impact score S, where ; Multiplying the centrality C by the perturbation impact score S yields the physical process coupling degree PPC for each attack technique node.

4. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The dynamic cost threshold is calculated in the following way: Obtain the basic cost threshold B; During the path search process, for a candidate attack path of length L, the sum of the physical process coupling degrees of all nodes that already contain attack techniques along the candidate attack path is calculated. ; The dynamic cost threshold T is calculated using the following formula: 。 5. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The method of normalizing and weighting the number of attack techniques, the number of critical assets affected, and the average physical consequences at the end of the path in the candidate attack path set to obtain the composite adversarial path coverage includes: The number of attack technique nodes reached by the candidate attack path set. , Divide by the total number of attack nodes to obtain the technology coverage. ; Count the number of key assets affected , The asset coverage ratio is obtained by dividing by the total number of key assets. ; Calculate the physical consequence severity score for the endpoint of each candidate attack path, and then normalize the physical consequence severity scores to obtain the average physical consequence severity. ; Composite Countermeasure Path Coverage Calculated using the following formula: ,in, , , As weight.

6. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The feedback adjustment of the attack state transition probability includes: For the attack state transition probability P(i,j) between any two adjacent attack technique nodes i and j on the covered path, apply the decay factor. Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probability from attack node k on a covered path to an untouched attack node m. Application of enhancement factors Update the attack state transition probability. Calculated using the following formula: ; The attack state transition probabilities starting from attack technique node k are normalized.

7. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The calculation of the cumulative failure contribution value of each security control point across all effective paths includes: For a given security control point SC, identify the set of all valid paths passing through the security control point. ; For each valid path passing through the security control point SC Calculate the overall attack state transition probability of the effective path. The overall attack state transition probability is the product of the attack state transition probabilities along the effective path. Valid path Physical process coupling of the endpoint target asset ; The security control point is on the valid path. Failure contribution value Calculated using the following formula: ； The cumulative failure contribution value is obtained by summing the failure contribution values ​​of the security control point on all valid paths passing through it. .

8. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The generation of candidate attack paths using a path search algorithm based on attack state transition probability includes: A path search algorithm is used, treating nodes and state transitions in the weighted attack graph as vertices and edges, respectively. When extending from the end node of the current path to the next node, determine whether the activation cost of the vulnerability corresponding to the next node is higher than the dynamic cost threshold calculated based on the current path; If so, then reduce the probability of the corresponding attack state transition; Set the weight of each edge to the negative logarithm of the adjusted or original attack state transition probability; Starting from the obtained attack origin, search for the few attack paths with the lowest cost as candidate attack paths.

9. The ATT&CK attack simulation and countermeasure method in a water conservancy system according to claim 1, characterized in that, The security control points include firewall policies, intrusion detection system signatures, and access control list entries.

10. An ATT&CK attack simulation and countermeasure system for a water conservancy system, characterized in that, It includes a memory and a processor. The memory stores computer instructions. When the processor executes the computer instructions, it implements the ATT&CK attack simulation and countermeasure method in the water conservancy system as described in any one of claims 1-9.

Images