Smart city network system multi-dimensional dynamic risk assessment system
By constructing a dynamic asset topology map and risk calculation module for a smart city network, and combining it with business impact quantification, a global risk matrix is generated and provided with visualization and decision support. This solves the problem of insufficient dynamic identification and decision support for risk assessment in existing systems, and improves the scientificity and accuracy of risk assessment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHAANXI PROVINCIAL NETWORK & INFORMATION SECURITY EVALUATION CENT
- Filing Date
- 2026-03-02
- Publication Date
- 2026-06-02
AI Technical Summary
Existing smart city cybersecurity management systems cannot dynamically identify the topological relationships between assets, lack the integration of external threat intelligence and historical security incidents, cannot quantify the impact of risks on business systems, and the risk assessment results are difficult to reflect the true threat situation, lacking intelligent decision support.
By constructing a dynamic asset topology map, combining the risk calculation module and the business impact quantification module, a global risk matrix is generated. Through visualization rendering and decision support modules, risk prediction and reinforcement priority suggestions are provided, enabling real-time risk identification and intelligent decision-making.
It enables dynamic identification and accurate assessment of risks in smart city network systems, improves the scientific nature and accuracy of risk calculation, supports automated decision-making, and enhances the efficiency of risk management.
Smart Images
Figure CN122137609A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a multi-dimensional dynamic risk assessment system for smart city network systems. Background Technology
[0002] As the scale of smart city construction continues to expand, urban management systems rely entirely on smart city network systems comprised of cloud platforms, IoT terminals, industry business systems, and urban data platforms. Core urban operational functions (such as traffic monitoring, public services, energy dispatching, and emergency command) are all interconnected through these networks. Smart city network assets are complex, including servers, network equipment, application systems, IoT devices, video equipment, and various edge gateways, often numbering in the tens of thousands and constantly changing. The network structure is characterized by cross-regional, multi-level architecture, multi-service domains, and coexistence of equipment from multiple vendors. Communication relationships are diverse and frequently changing, making network security risks transmissible, diffuse, and delayed. If a critical asset is attacked or malfunctions, it could lead to business system interruptions, critical data leaks, or trigger cascading failures, thereby impacting the city's public service capabilities.
[0003] Existing smart city cybersecurity management systems primarily rely on static asset inventories and single-point risk detection. They can only issue isolated alerts for devices, vulnerabilities, or abnormal behavior, failing to establish dynamic topological relationships between assets or identify the propagation logic of risks across assets. This results in a large number of alerts not being linked into a "risk chain." Current risk assessment models typically use fixed-weight scoring methods, lacking the dynamic integration of external threat intelligence and historical security event aggregation, making it difficult for risk calculations to reflect the true threat landscape. Furthermore, existing methods focus more on technical risks and lack the ability to quantify the impact of risks on business systems, failing to assess the potential disruption to critical industry operations (such as urban traffic management, emergency response systems, and government platforms). In addition, risk outputs are usually presented in the form of reports or alert lists, failing to provide a visual representation of risk distribution and lacking intelligent decision-making capabilities that combine risk prediction with compliance requirements. Summary of the Invention
[0004] This invention provides a multi-dimensional dynamic risk assessment system for smart city network systems. Through dynamic asset topology construction, risk calculation and business impact quantification, combined with risk heat map and reinforcement priority output, it realizes real-time risk identification and intelligent decision-making.
[0005] A multi-dimensional dynamic risk assessment system for smart city network systems includes an asset topology construction module, a risk calculation module, a business impact quantification module, and a result output and decision support module. The asset topology construction module collects attribute information of various assets in the smart city network and their communication relationships to construct a dynamically updated asset topology diagram; the asset topology diagram is used to represent the logical and data connection relationships between assets. The risk calculation module, based on the asset topology map, integrates externally input threat intelligence streams and internally recorded historical security events, and calculates them using a dynamic weighting algorithm, outputting an asset vulnerability score and a threat probability score for each asset. The business impact quantification module analyzes the impact propagation path of each asset when a security incident occurs, based on the asset topology map, identifies the affected business systems, and quantifies the business impact value of the security incident on the business; it then combines the asset vulnerability score, threat probability score, and business impact value to generate a global risk matrix. The result output and decision support module generates a visualized risk heat map and a risk prediction model for predicting future risk trends based on the global risk matrix. At the same time, it automatically maps the global risk matrix to the graded protection standard and outputs a list of asset reinforcement priority recommendations based on the mapping results and risk values.
[0006] Optionally, the asset topology construction module includes: By deploying active scanning tools and passive traffic monitoring devices in the smart city network, the attribute information of all online assets in the network and the communication relationships between assets are collected. The attribute information includes asset type, business system to which it belongs, IP address, open ports and installed software services. The communication relationships include source IP, destination IP, communication protocol and communication frequency, forming an initial asset list and an initial communication relationship list. Based on the attribute information in the initial asset list and the initial communication relationship list, each asset is abstracted into a node and the communication relationship between assets is abstracted into an edge through the graph computing engine, and an initial asset topology graph is constructed. This asset topology graph is stored in the graph database in the form of a graph data structure. By continuously receiving real-time data from the active scanning tool and the passive traffic monitoring device, the initial asset list and the initial communication relationship list are dynamically updated, and the asset topology map is reconstructed in real time based on the updated asset list and communication relationship list, ensuring that the asset topology map always reflects the latest connection status of the smart city network.
[0007] Optionally, the proactive scanning tool performs scanning tasks according to a predefined scanning strategy, which includes periodically initiated full network scans and targeted scans triggered by network topology change events, to ensure the integrity of the initial asset inventory.
[0008] Optionally, the dynamic update process specifically includes: comparing the real-time received data with the asset topology map stored in the graph database to identify newly launched assets, offline assets, and changes in communication relationships, and incrementally updating the asset topology map accordingly. The incremental update specifically involves: adding corresponding new nodes and edges to the asset topology map for newly launched assets and their communication relationships; and marking their corresponding nodes and associated edges as invalid in the asset topology map instead of deleting them immediately, so as to retain historical association information for risk analysis.
[0009] Optionally, the risk calculation module includes: The input asset topology map, externally input threat intelligence stream, and internally recorded historical security events are standardized. Threat indicators in the threat intelligence stream are matched and associated with asset attribute information in the asset topology map. At the same time, the historical security events are located in the asset topology map according to the assets involved, forming an asset topology map with threat tags and historical event markers. Based on the asset topology map with threat tags and historical event markers, a dynamic weighting algorithm is applied for calculation. The dynamic weighting algorithm dynamically calculates the basic vulnerability weight and basic threat probability weight of each asset according to the matching tightness between threat tags and asset attributes and the degree of aggregation of historical event markers on the asset association path, and generates a preliminary asset vulnerability score and a preliminary threat probability score. Based on the connections between assets in the asset topology map with threat tags and historical event markers, the risk transmission path is analyzed. The preliminary asset vulnerability score and preliminary threat probability score are superimposed and corrected by the dynamic weighting algorithm. Finally, the asset vulnerability score and threat probability score of each asset after transmission impact adjustment are output.
[0010] Optionally, the matching tightness is determined by calculating the number and criticality of matching items between threat indicators and asset attribute information; the clustering degree is determined by analyzing the ratio of the number of asset nodes with historical event markers to the total number of nodes on the asset association path.
[0011] Optionally, the business impact quantification module includes: Based on the asset topology, a security incident scenario is simulated for each asset node. A graph traversal algorithm is used to analyze all possible propagation paths of the security incident along the asset connection relationship, and the asset nodes traversed by each propagation path and the business system finally reached are recorded to form a complete set of propagation paths. According to the predefined business system value assessment rules, a basic value coefficient is assigned to each business system. At the same time, based on the set of impact propagation paths, the number of assets affected by each impact propagation path is counted and the criticality of these assets in the path is assessed to calculate the impact range coefficient. Then, the basic value coefficient is multiplied by the impact range coefficient to quantify the business impact value of each asset security event on each business system. The business impact values of all assets calculated by the business impact quantification module are aggregated in three dimensions with the asset vulnerability score and threat probability score of the corresponding asset output by the risk calculation module. The data are then matched according to the asset identifier to generate a global risk matrix containing four dimensions: asset identifier, asset vulnerability score, threat probability score, and business impact value.
[0012] Optionally, the graph traversal algorithm is a breadth-first search algorithm, which starts from the asset node where the security event has occurred and traverses all reachable asset nodes in the asset topology graph until it encounters a network boundary isolation device or a predefined business system boundary gateway, thereby determining the complete set of impact propagation paths.
[0013] Optionally, the result output and decision support module includes: Based on the asset location information and corresponding comprehensive risk value in the global risk matrix, a visualized risk heat map covering the smart city network topology is generated through a visualization rendering engine. At the same time, using the global risk matrix and historical security event sequences as training datasets, a risk prediction model for predicting future risk situations is constructed using time series analysis algorithms. The asset attribute information, asset vulnerability score, and threat probability score in the global risk matrix are automatically mapped to the requirements of various clauses in the graded protection standard. Through keyword matching and logical rule reasoning, the differences between the current risk status and compliance requirements are identified and a compliance gap list is generated. By combining the real-time risk distribution in the risk heatmap, the future risk situation warning information output by the risk prediction model, and the compliance difference items in the compliance gap list, a multi-factor decision-making model is established to calculate the urgency and effectiveness index of each asset reinforcement measure, and finally output a priority list of asset reinforcement.
[0014] Optionally, the time series analysis algorithm is a long short-term memory network algorithm. The risk prediction model uses the global risk matrix within the historical time period as input features and is trained with the prediction target of whether a security event will occur within a specific future time period.
[0015] The beneficial effects of this invention are: This invention utilizes an asset topology construction module to perform real-time scanning, attribute identification, and communication relationship updates for all assets in a smart city network, forming a dynamically updated asset topology map. The system employs a dual-channel data acquisition method, combining active scanning tools and passive traffic monitoring devices. This not only collects asset types, IP addresses, open ports, and installed software services, but also analyzes communication relationships and protocol characteristics in real time. A weighted asset topology map is constructed using a graph computing engine, automatically maintaining asset nodes, edges, and communication weight attributes. An incremental update mechanism is supported during topology construction; newly added assets automatically have nodes added, and offline assets are not directly deleted but marked as invalid to preserve historical data for risk analysis. Therefore, this invention continuously maintains consistency between the asset list and topology map and the real network environment, effectively solving the problems of incomplete asset identification and missing topology dimensions in traditional network management systems. This eliminates reliance on manual input or static documents for risk identification, ensuring the completeness and accuracy of risk data sources.
[0016] This invention proposes a risk calculation module that performs risk extrapolation based on an asset topology graph. It introduces a dynamic weighting algorithm to comprehensively consider indicators such as asset "matching tightness" and "historical event clustering degree," automatically generating asset vulnerability scores and threat probability scores. Furthermore, it uses a shortest path algorithm to identify possible risk propagation paths within the topology, achieving link-level risk propagation from asset nodes to nodes. During the calculation process, upstream high-risk assets influence downstream nodes based on their connection weights. The system integrates the initial score with the propagation-corrected score to obtain a more realistic risk assessment result. Simultaneously, a business impact quantification module combines business system value assessment rules to quantify the business impact value based on the set of impact propagation paths. This ensures that risk not only reflects the magnitude of vulnerability risk but also directly relates to actual business impact. This risk scoring method, based on real topology and propagation links, avoids the problems of traditional risk assessment relying on static scoring and subjective experience, achieving deep automated risk analysis and significantly improving the scientific rigor and accuracy of risk calculation.
[0017] This invention, through its result output and decision support module, aggregates asset vulnerability scores, threat probability scores, and business impact values in three dimensions to generate a comprehensive risk matrix. A real-time risk heatmap covering the smart city network topology is then output via a visualization rendering engine, providing a one-screen presentation of risk distribution. Simultaneously, the system trains a time-series analysis model based on the comprehensive risk matrix and historical security event sequences to predict future risk trends and automatically generates a compliance gap list based on the graded protection standard. Building upon this, the system constructs a multi-factor decision-making model to quantify the comprehensive risk value, future risk warning level, and the severity of compliance differences, outputting a priority list for asset hardening. This achieves automated closed-loop management of the entire risk identification-assessment-decision process. This invention significantly improves risk handling efficiency, freeing managers from manual item-by-item analysis, enabling quantifiable risk priorities and executable handling strategies, and providing robust decision support for smart city security systems. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 This is a schematic diagram of the system flow according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the business impact quantification module in an embodiment of the present invention. Detailed Implementation
[0020] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should also be noted that, to make the embodiments more comprehensive, the following embodiments are the best and preferred embodiments, and those skilled in the art can use other alternative methods to implement some well-known technologies; moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.
[0021] It should be noted that the use of terms such as "an embodiment," "an embodiment," "an exemplary embodiment," and "some embodiments" in the specification indicates that the described embodiment may include a specific feature, structure, or characteristic, but not every embodiment necessarily includes that specific feature, structure, or characteristic. Furthermore, when a specific feature, structure, or characteristic is described in connection with an embodiment, implementing such a feature, structure, or characteristic in conjunction with other embodiments (whether explicitly described or not) should be within the knowledge of those skilled in the art.
[0022] Generally, terms can be understood at least partly from their use in context. For example, depending at least partly on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in a singular sense, or a combination of features, structures, or characteristics in a plural sense. Additionally, the term "based on" can be understood not necessarily to convey an exclusive set of factors, but rather, alternatively, depending at least partly on the context, to allow for the presence of other factors that are not necessarily explicitly described.
[0023] like Figures 1-2 As shown, the smart city network system multi-dimensional dynamic risk assessment system includes an asset topology construction module, a risk calculation module, a business impact quantification module, and a result output and decision support module, wherein; The asset topology construction module collects attribute information and communication relationships among various assets in the smart city network to build a dynamically updated asset topology diagram. This topology diagram represents the logical and data connection relationships between assets, specifically: By deploying active scanning tools and passive traffic monitoring devices in the smart city network, the attribute information of all online assets in the network and the communication relationships between assets are collected to form an initial asset list and an initial communication relationship list. The specific process is as follows: The proactive scanning tool executes scanning tasks according to predefined scanning strategies. These strategies are defined by the system administrator in the system configuration center and include periodically initiated comprehensive network scans and targeted scans triggered by network topology change events. Comprehensive network scans scan all network segments of the smart city network within a set time period to ensure the completeness of the initial asset inventory. Targeted scans are initiated immediately when assets are brought online or offline, or when communication links change, improving the real-time performance and effectiveness of the scans.
[0024] The proactive scanning tool sends identification requests to the target assets in sequence, collects attribute information such as asset type, business system to which it belongs, IP address, open ports and installed software services, and performs consistency verification on the scanned results to filter out duplicate or invalid data.
[0025] Passive traffic monitoring devices are deployed at critical network entry and exit points and backbone links, using deep packet inspection (DPI) technology to analyze real-time network traffic. These devices extract communication relationship information from data packets, such as source IP, destination IP, communication protocol, and communication frequency. They also parse software service identifiers related to assets from the data packet content, which are used to update the installed software service fields in the asset attribute information.
[0026] The data collected by the active scanning tool and the data parsed by the passive traffic monitoring device are structured and organized to generate an initial asset list and an initial communication relationship list, which are then stored in the asset data repository to provide basic data for subsequent topology construction.
[0027] Based on the attribute information and initial communication relationship list in the initial asset list, each asset is abstracted as a node and the communication relationships between assets are abstracted as edges through a graph computing engine, constructing an initial asset topology graph and storing it in a graph database. The specific process is as follows: The graph computing engine sequentially traverses the initial asset list, generating a unique node for each asset. The node contains attribute information such as asset type, business system to which it belongs, IP address, open ports, and installed software services.
[0028] The graph computing engine traverses the initial list of communication relationships, creates each communication relationship as an edge between nodes, and records the source IP, destination IP, communication protocol, and communication frequency for each edge.
[0029] When constructing a weighted asset topology graph, each edge is assigned a weight attribute. The weight attribute is calculated based on the communication frequency and communication protocol type in the communication relationship. The higher the communication frequency or the more sensitive the protocol type, the larger the weight value of the edge, which is used as an input factor for the dynamic weight algorithm in the subsequent risk calculation module.
[0030] The graph computing engine stores weighted asset topology graphs in a graph database in the form of graph data structure. The graph database supports multi-dimensional relationship queries, path analysis, and traversal of complex topology structures, providing data support for subsequent risk calculation modules.
[0031] By continuously receiving real-time data from active scanning tools and passive traffic monitoring devices, the asset topology map is dynamically updated to always reflect the latest connectivity status of the smart city network. The specific process is as follows: Dynamic updates are managed by an event-driven engine, which continuously monitors for changes in asset attributes and communication relationships.
[0032] When new data is acquired from active scanning tools or passive traffic monitoring devices, the real-time data is compared with the asset topology map stored in the graph database. The comparison includes asset additions, asset decommissioning, additions or deletions of communication relationships, or changes in the attributes of communication relationships.
[0033] For newly identified online assets and their communication relationships, add corresponding new nodes and edges to the graph database to maintain the integrity of the topology graph structure.
[0034] For assets that have been detected as offline, their nodes and associated edges are marked as invalid instead of being deleted immediately. This is to preserve the historical asset relationships for the risk calculation module to perform risk propagation path analysis.
[0035] When the attributes of a node or edge change, the graph computing engine updates the attribute fields on the node or edge based on real-time data, including asset attribute information and communication relationship information.
[0036] After the change is confirmed, the event-driven engine automatically triggers the topology reconstruction process, and pushes the updated asset topology map to the risk calculation module to ensure that the risk calculation module always performs calculations based on the latest asset relationships and network structure.
[0037] The risk calculation module, based on the asset topology map, integrates externally inputted threat intelligence streams and internally recorded historical security events. It uses a dynamic weighting algorithm to calculate and output an asset vulnerability score and a threat probability score for each asset. Specifically: The input asset topology map, externally input threat intelligence stream, and internally recorded historical security events are standardized. Threat indicators in the threat intelligence stream are matched and associated with asset attribute information in the asset topology map. At the same time, historical security events are located in the asset topology map according to the assets involved, forming an asset topology map with threat tags and historical event markers. The specific process is as follows: The system receives a threat intelligence stream with structured fields from the threat intelligence center. The threat intelligence stream includes fields for the threat source IP, attack tool identifier, attack behavior type, and attack target.
[0038] The system maps threat indicators from different sources in the threat intelligence stream to a unified standard threat indicator type based on predefined threat indicator mapping rules, such as "malicious scanning behavior", "vulnerability exploitation behavior", and "abnormal communication behavior".
[0039] The system performs format conversion on internally recorded historical security events. These events include the event occurrence time, targeted assets, severity level, scope of impact, and handling results. Based on a predefined event classification model, the system categorizes historical security events into three types: "Unauthorized Access Events," "Denial of Service Events," and "Malicious Code Injection Events," each with a fixed descriptive structure.
[0040] The system analyzes the target assets in historical security events, locates the corresponding nodes in the asset topology map by using the IP address and installed software service fields in the asset attribute information, and writes the location results into the tag field of the asset topology map node in the form of "historical event tag".
[0041] The system maps threat indicators to corresponding assets by comparing and matching asset attribute information based on threat indicators in the threat intelligence stream, and marks them on asset nodes in the form of "threat tags", thus completing the construction of an asset topology map with threat tags and historical event markers.
[0042] Based on an asset topology map with threat tags and historical event markers, a dynamic weighting algorithm is applied for calculation. This algorithm dynamically calculates the basic vulnerability weight and basic threat probability weight for each asset based on the matching tightness between threat tags and asset attributes and the degree of clustering of historical event markers along asset association paths, generating preliminary asset vulnerability scores and preliminary threat probability scores. The specific process is as follows: The system quantifies and scores the tightness of the match based on the number and criticality of attribute matches between threat tags and asset attribute information on each asset node. Matching items include whether the port targeted by the attacker is an open port on the asset, and whether the attack tools involve software services installed on the asset.
[0043] Matching tightness , is represented as: ; in, =1 indicates a match between the threat indicator and the asset attribute (port / software service / IP, etc.); otherwise, it is 0. Indicates the weight of threat indicators. The system identifies historical event markers on the associated paths of each asset and counts the number of nodes with historical event markers in the associated paths. The system calculates the ratio of the number of nodes with historical event markers to the total number of nodes on the associated path, and this ratio is used as the degree of clustering.
[0044] degree of aggregation , is represented as: Assets The set of associated paths, This indicates the number of nodes along the path that are marked with historical events. This indicates the total number of nodes in the path.
[0045] The dynamic weighting algorithm inputs matching tightness and clustering degree into the weight calculation formula, and outputs the basic vulnerability weight and the basic threat probability weight. Basic vulnerability weight Weight of basic threat probability The calculation is expressed as: ; ; in, , , , These are the weight coefficients for the dynamic weighting algorithm.
[0046] The system normalizes the basic vulnerability weight and basic threat probability weight for each asset to obtain a preliminary asset vulnerability score and a preliminary threat probability score, which are expressed as follows: ; Based on the connectivity between assets in the asset topology map with threat tags and historical event markers, the risk transmission path is analyzed. A dynamic weighting algorithm is used to overlay and correct the initial asset vulnerability score and initial threat probability score, ultimately outputting the asset vulnerability score and threat probability score for each asset after adjusting for transmission effects. The specific process is as follows: The system invokes the shortest path algorithm built into the graph database to identify all potential risk transmission paths, starting from the threat entry asset and ending at the business-critical asset.
[0047] For each asset node, the system iterates through all its upstream associated assets and performs calculations based on the connection weights. The connection weights are determined by the edge attributes and the importance of the asset node; the higher the importance of the upstream node, the greater its connection weight.
[0048] The system multiplies the initial threat probability score of upstream related assets by the connection relationship weight and adds it to the current asset to correct the initial asset vulnerability score of the current asset.
[0049] After the overlay correction is completed, the system outputs the asset vulnerability score and threat probability score for each asset after dynamic propagation correction.
[0050] The business impact quantification module analyzes the propagation path of the impact of a security incident on each asset based on the asset topology map, identifies the affected business systems, and quantifies the business impact of the security incident. Combining asset vulnerability scores, threat probability scores, and business impact values, it generates a global risk matrix, specifically: Based on the asset topology graph, a security incident scenario is simulated for each asset node. A graph traversal algorithm is used to analyze all possible propagation paths of the security incident along the asset connections. The asset nodes traversed by each propagation path and the final business system reached are recorded, forming a complete set of propagation paths. The specific process is as follows: The system first selects any asset node from the asset topology map as a "security event trigger point" for simulation. This asset node is the starting node of the current security event.
[0051] The graph traversal algorithm is invoked to perform impact propagation analysis. The graph traversal algorithm uses a breadth-first search algorithm, starting from the starting node and sequentially visiting all directly connected asset nodes.
[0052] When an asset node is accessed, the system adds that node to the current impact propagation path and continues to access the next asset node along the connection relationship of the asset topology graph.
[0053] The graph traversal algorithm continues to execute until it encounters a network boundary isolation device or a predefined business system boundary gateway during the traversal process. At this point, path extension stops, and the current impact propagation path is marked as a valid path.
[0054] The system stores all effective impact propagation paths as an impact propagation path set. Each path contains a starting node, a sequence of asset nodes along the path, and the identifier of the business system it finally reaches.
[0055] Based on predefined business system value assessment rules, a basic value coefficient is assigned to each business system. Simultaneously, based on the set of impact propagation paths, the number of assets affected by each path is counted, and the criticality of these assets within the path is assessed to calculate the impact range coefficient. Then, the basic value coefficient is multiplied by the impact range coefficient to quantify the business impact of each asset security incident on each business system. The specific process is as follows: The system calculates a basic value coefficient for each business system based on the business system value assessment rules. The business system value assessment rules are pre-configured by the management center, and the evaluation dimensions include three quantitative indicators: the number of service objects of the business system, the economic losses caused by service interruption, and the data security level of the business system. The basic value coefficient is generated through a weighted calculation model.
[0056] The system extracts all impact propagation paths corresponding to a specific security event trigger point from the set of impact propagation paths, and counts the number of assets affected in each impact propagation path.
[0057] To assess the criticality of an asset in the path, the system reads the centrality index of each asset node in the asset topology graph. This centrality index is used to quantify the importance of the asset in the topology structure. The centrality index is calculated using the degree centrality and betweenness centrality methods.
[0058] The system calculates the impact range coefficient, which is the product of the "number of affected assets" and the "sum of the average centrality index values of these assets".
[0059] The system multiplies the impact range coefficient with the basic value coefficient of the corresponding business system to calculate the business impact value of the current security event on different business systems.
[0060] The business impact values of all assets calculated by the business impact quantification module are aggregated in three dimensions with the asset vulnerability scores and threat probability scores of the corresponding assets output by the risk calculation module. These are then matched according to asset identifiers to generate a global risk matrix containing four dimensions: asset identifier, asset vulnerability score, threat probability score, and business impact value. The specific process is as follows: The system normalizes the asset vulnerability score, threat probability score, and business impact value of each asset to ensure that the three have a consistent numerical range, so as to carry out unified quantitative analysis.
[0061] The system performs three-dimensional aggregation on the three normalized indicators and calculates the comprehensive risk value using a weighted summation: ; in, This represents the overall risk value, used to reflect the ultimate level of risk of an asset. Indicates asset vulnerability score, Indicate the likelihood of a threat. Indicates the business impact value. , , These are the weight parameters in the weighted summation formula.
[0062] The system supports dynamic weight configuration: when the evaluation objective focuses on ensuring critical business continuity, the system automatically increases the weight corresponding to the business impact value; when the evaluation objective focuses on resisting external attacks, the system increases the weight corresponding to the threat probability score.
[0063] The final generated global risk matrix includes asset identification, asset vulnerability score, threat probability score, business impact value, and comprehensive risk value, and is provided to the results output and decision support module for visualization and asset reinforcement priority generation.
[0064] The results output and decision support module generates a visualized risk heatmap and a risk prediction model for forecasting future risk trends based on the global risk matrix. Simultaneously, it automatically maps the global risk matrix to the graded protection standards and outputs a priority list of asset reinforcement recommendations based on the mapping results and risk values. The system automatically maps asset attribute information, asset vulnerability scores, and threat probability scores from the overall risk matrix to the requirements of various clauses in the graded protection standards. Through keyword matching and logical rule reasoning, it identifies the differences between the current risk status and compliance requirements and generates a compliance gap list. The specific process is as follows: The system calls the natural language processing unit to perform structured parsing of the text content of the graded protection standard, extract key control points from the clauses and generate structured data.
[0065] The system reads the asset attribute information, asset vulnerability score, and threat probability score of each asset from the global risk matrix and inputs the above data into the mapping rule base.
[0066] The mapping rule base stores rules predefined by security experts. Each rule includes key control point conditions, required asset attribute characteristics, minimum asset vulnerability score threshold, and minimum threat probability score threshold.
[0067] The system uses a rule engine to match key control points in the graded protection standard with the actual parameters of the assets one by one. If an asset does not meet the corresponding control point requirements, the asset identifier and the corresponding missing control point are recorded in the compliance gap list.
[0068] The compliance gap list is output in a tabular structure. Each record includes the asset identifier, the number of the unmet graded protection clause, the risk level, and a description of the difference between the clause and the security capability requirements.
[0069] By integrating the real-time risk distribution in the comprehensive risk heatmap, the future risk situation warning information output by the risk prediction model, and the compliance differences in the compliance gap list, a multi-factor decision-making model is established to calculate the urgency and effectiveness index of each asset reinforcement measure, and finally output a priority list of asset reinforcement. The specific process is as follows: The system reads three input indicators for each asset: the real-time comprehensive risk value from the risk heatmap, the risk warning level from the risk prediction model, and the severity of compliance differences from the compliance gap list.
[0070] The system invokes a multi-factor decision-making model to calculate reinforcement priorities. This model is a weighted scoring model, assigning weights to the three indicators and calculating the reinforcement urgency index and reinforcement benefit index for each asset. The multi-factor decision-making model uses a weighted formula: ; in, Assets The urgency index for reinforcement The overall risk value is derived from the risk heatmap. The future risk warning level output by the risk prediction model indicates that... This indicates the severity of the compliance differences recorded in the compliance gap list. , , These are multi-factor weight values, configured by the system administrator.
[0071] The system sorts the calculated reinforcement urgency index and reinforcement benefit index to generate a priority list of asset reinforcement recommendations.
[0072] When the global risk matrix, risk prediction model, or compliance gap list changes, the system immediately triggers the multi-factor decision model to re-execute the calculation process and update the asset reinforcement priority recommendation list according to the latest risk status, so that it remains effective in real time.
[0073] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.
[0074] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A multi-dimensional dynamic risk assessment system for smart city network systems, characterized in that: It includes an asset topology construction module, a risk calculation module, a business impact quantification module, and a result output and decision support module, among which; The asset topology construction module collects attribute information of various assets in the smart city network and their communication relationships to construct a dynamically updated asset topology map. The asset topology diagram is used to represent the logical and data connection relationships between assets; The risk calculation module, based on the asset topology map, integrates externally input threat intelligence streams and internally recorded historical security events, and calculates them using a dynamic weighting algorithm, outputting an asset vulnerability score and a threat probability score for each asset. The business impact quantification module analyzes the impact propagation path of each asset when a security incident occurs, based on the asset topology map, identifies the affected business systems, and quantifies the business impact value of the security incident on the business. By combining the asset vulnerability score, threat probability score, and business impact value, a global risk matrix is generated. The result output and decision support module generates a visualized risk heat map and a risk prediction model for predicting future risk situations based on the global risk matrix. Simultaneously, the global risk matrix is automatically mapped to the graded protection standard, and an asset reinforcement priority recommendation list is output based on the mapping results and risk values.
2. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 1, characterized in that, The asset topology construction module includes: By deploying active scanning tools and passive traffic monitoring devices in the smart city network, the attribute information of all online assets in the network and the communication relationships between assets are collected. The attribute information includes asset type, business system to which it belongs, IP address, open ports and installed software services. The communication relationships include source IP, destination IP, communication protocol and communication frequency, forming an initial asset list and an initial communication relationship list. Based on the attribute information in the initial asset list and the initial communication relationship list, each asset is abstracted into a node and the communication relationship between assets is abstracted into an edge through the graph computing engine, and an initial asset topology graph is constructed. This asset topology graph is stored in the graph database in the form of a graph data structure. By continuously receiving real-time data from the active scanning tool and the passive traffic monitoring device, the initial asset list and the initial communication relationship list are dynamically updated, and the asset topology map is reconstructed in real time based on the updated asset list and communication relationship list, ensuring that the asset topology map always reflects the latest connection status of the smart city network.
3. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 2, characterized in that, The proactive scanning tool performs scanning tasks according to a predefined scanning strategy, which includes periodically initiated full network scans and targeted scans triggered by network topology change events, to ensure the integrity of the initial asset inventory.
4. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 2, characterized in that, The dynamic update process specifically includes: comparing the real-time received data with the asset topology map stored in the graph database to identify newly launched assets, offline assets, and changes in communication relationships, and incrementally updating the asset topology map accordingly. The incremental update specifically involves: adding corresponding new nodes and edges to the asset topology map for newly launched assets and their communication relationships; and marking their corresponding nodes and associated edges as invalid in the asset topology map instead of deleting them immediately, in order to retain historical association information for risk analysis.
5. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 2, characterized in that, The risk calculation module includes: The input asset topology map, externally input threat intelligence stream, and internally recorded historical security events are standardized. Threat indicators in the threat intelligence stream are matched and associated with asset attribute information in the asset topology map. At the same time, the historical security events are located in the asset topology map according to the assets involved, forming an asset topology map with threat tags and historical event markers. Based on the asset topology map with threat tags and historical event markers, a dynamic weighting algorithm is applied for calculation. The dynamic weighting algorithm dynamically calculates the basic vulnerability weight and basic threat probability weight of each asset according to the matching tightness between threat tags and asset attributes and the degree of aggregation of historical event markers on the asset association path, and generates a preliminary asset vulnerability score and a preliminary threat probability score. Based on the connections between assets in the asset topology map with threat tags and historical event markers, the risk transmission path is analyzed. The preliminary asset vulnerability score and preliminary threat probability score are superimposed and corrected by the dynamic weighting algorithm. Finally, the asset vulnerability score and threat probability score of each asset after transmission impact adjustment are output.
6. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 5, characterized in that, The matching tightness is determined by calculating the number and criticality of matching items between threat indicators and asset attribute information; the clustering degree is determined by analyzing the ratio of the number of asset nodes with historical event markers to the total number of nodes on the asset association path.
7. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 5, characterized in that, The business impact quantification module includes: Based on the asset topology, a security incident scenario is simulated for each asset node. A graph traversal algorithm is used to analyze all possible propagation paths of the security incident along the asset connection relationship, and the asset nodes traversed by each propagation path and the business system finally reached are recorded to form a complete set of propagation paths. According to the predefined business system value assessment rules, a basic value coefficient is assigned to each business system. At the same time, based on the set of impact propagation paths, the number of assets affected by each impact propagation path is counted and the criticality of these assets in the path is assessed to calculate the impact range coefficient. Then, the basic value coefficient is multiplied by the impact range coefficient to quantify the business impact value of each asset security event on each business system. The business impact values of all assets calculated by the business impact quantification module are aggregated in three dimensions with the asset vulnerability score and threat probability score of the corresponding asset output by the risk calculation module. The data are then matched according to the asset identifier to generate a global risk matrix containing four dimensions: asset identifier, asset vulnerability score, threat probability score, and business impact value.
8. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 7, characterized in that, The graph traversal algorithm is a breadth-first search algorithm. Starting from the asset node where the security event has occurred, it traverses all reachable asset nodes in the asset topology graph until it encounters a network boundary isolation device or a predefined business system boundary gateway, thereby determining the complete set of impact propagation paths.
9. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 7, characterized in that, The results output and decision support module includes: Based on the asset location information and corresponding comprehensive risk value in the global risk matrix, a visualized risk heat map covering the smart city network topology is generated through a visualization rendering engine. At the same time, using the global risk matrix and historical security event sequences as training datasets, a risk prediction model for predicting future risk situations is constructed using time series analysis algorithms. The asset attribute information, asset vulnerability score, and threat probability score in the global risk matrix are automatically mapped to the requirements of various clauses in the graded protection standard. Through keyword matching and logical rule reasoning, the differences between the current risk status and compliance requirements are identified and a compliance gap list is generated. By combining the real-time risk distribution in the risk heatmap, the future risk situation warning information output by the risk prediction model, and the compliance difference items in the compliance gap list, a multi-factor decision-making model is established to calculate the urgency and effectiveness index of each asset reinforcement measure, and finally output a priority list of asset reinforcement.
10. The multi-dimensional dynamic risk assessment system for smart city network systems according to claim 9, characterized in that, The time series analysis algorithm is a long short-term memory network algorithm. The risk prediction model uses the global risk matrix within the historical time period as input features and is trained with the prediction target of whether a security event will occur within a specific future time period.