A digital-twin-based industrial control system vulnerability ranking and defense decision method, system, device and storage medium

Abstract

The application discloses an industrial control system vulnerability sorting and defense decision method, system and device based on digital twinning and a storage medium, and belongs to the technical field of vulnerability defense. The method comprises the following steps: constructing a digital twinning model according to target industrial control system state data; constructing a vulnerability attack graph comprising a plurality of nodes; calculating the risk priority score of each node in the vulnerability attack graph, and sorting the nodes in descending order of the risk priority score to obtain a risk priority sorting list; in response to an instruction of a dynamic event occurrence, updating the vulnerability attack graph and the dynamic risk priority list, determining the most dangerous attack path and the most dangerous node; performing defense-free benchmark simulation on the most dangerous attack path, formulating a plurality of defense strategies for the most dangerous node and respectively simulating, and comparing the simulation results of the plurality of defense strategies and the benchmark simulation to determine the optimal defense strategy. The application can obtain a reasonable and effective system attack defense countermeasure.

Description

Technical Field

[0001] This invention belongs to the field of vulnerability defense technology, specifically relating to a method, system, device, and storage medium for vulnerability ranking and defense decision-making in industrial control systems based on digital twins. Background Technology

[0002] Industrial control systems, as a core component of the nation's critical information infrastructure, are widely deployed in key sectors such as power, petrochemicals, intelligent manufacturing, and rail transportation. With the deep integration of industrialization and informatization, traditional closed industrial control networks are gradually evolving into open and interconnected IT / OT converged architectures. This exposes the previously relatively secure OT environment to increasing cyber threats. In recent years, cyberattacks targeting industrial control systems have become frequent, such as advanced persistent threat attacks like Industroyer and TRITON, causing serious production disruptions, equipment damage, and even personnel casualties. Against this backdrop, systematic and precise vulnerability analysis and risk assessment of industrial control systems have become a crucial technical aspect for ensuring national security and industrial production safety.

[0003] However, traditional vulnerability analysis primarily relies on the static scoring mechanism provided by the general vulnerability scoring system CVSS, lacking the ability to perceive the real-time status of the system and analyze the importance of asset value. On the one hand, traditional CVSS scoring only performs static evaluation based on the technical attributes of the vulnerability itself, failing to perceive the real-time impact of dynamic events such as changes in operational behavior, firewall policy adjustments, and the start / stop of critical services on the exploitability of the vulnerability during system operation, resulting in assessment results that lag significantly behind the actual security situation. On the other hand, CVSS scoring cannot distinguish the actual importance of the asset hosting the vulnerability to the core production process. Even if a safety instrument PLC controlling a critical reactor and a common sensor used for environmental monitoring have the same CVSS score, their actual risks differ drastically, making it difficult for defenders to accurately identify high-risk vulnerabilities that truly pose a fatal threat to core business from a massive number of vulnerabilities, easily leading to a misallocation of security resources. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, device and storage medium for vulnerability sorting and defense decision-making in industrial control systems based on digital twins. It integrates real-time system operation status perception and asset business value assessment to obtain reasonable and effective system attack defense strategies.

[0005] This invention provides the following technical solution:

[0006] Firstly, a method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins is provided, including: constructing a digital twin model based on pre-acquired target industrial control system state data;

[0007] A vulnerability attack graph consisting of several nodes is constructed based on a digital twin model;

[0008] Calculate the risk priority score for each node in the vulnerability attack graph, and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list.

[0009] The system monitors whether dynamic events occur in the target industrial control system using a digital twin model. In response to the command of a dynamic event, it updates the vulnerability attack graph and obtains an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state.

[0010] Based on the updated vulnerability attack graph and dynamic risk priority list, the most dangerous attack paths and the highest-risk nodes are identified.

[0011] In the digital twin model, the most dangerous attack path is simulated without defense. Multiple defense strategies are formulated for the highest-risk nodes and simulated separately. The simulation results of multiple defense strategies are compared with the simulation results of the benchmark simulation to determine the optimal defense strategy.

[0012] As an optional technical solution of the present invention, the step of constructing a digital twin model based on the pre-acquired target industrial control system state data includes:

[0013] The target industrial control system status data includes basic information data, geometric data, physical attribute data, and historical time series data;

[0014] The basic information data includes a list of key equipment and a list of non-key equipment.

[0015] The digital twin model includes a geometric model, a physical model, and a behavioral model;

[0016] The geometric data includes scene point cloud data of key equipment. The point cloud data is converted into a 3D model, the 3D model is reduced in polygons, and a unique identifier is bound to each corresponding element in the scene to obtain the geometric model.

[0017] Based on physical attribute data, non-critical equipment is modeled using lookup tables or data-driven regression models to obtain non-critical equipment models, and full-order models are established for critical equipment; the intrinsic orthogonal decomposition method is used to convert the full-order models into reduced-order models of critical equipment; the reduced-order models of critical equipment and non-critical equipment models are connected through physical interfaces to obtain a complete physical model.

[0018] The historical time series data is cleaned, and an autoencoder algorithm is used to train a data training model of the target industrial control system under normal conditions. The trained model is then used as a behavioral model for monitoring dynamic events.

[0019] As an optional technical solution of the present invention, the construction of a vulnerability attack graph based on a digital twin model, comprising several nodes, includes:

[0020] The target industrial control system is structured and modeled to obtain a Prolog fact base including an asset table, network connection relationships, and access control rules.

[0021] Based on the CVE IDs of known vulnerabilities obtained in advance, determine the corresponding vulnerability exploitability score;

[0022] Based on key equipment, and combined with the MITRE ATT&CK for ICS framework, we analyze the attacker's attack starting point and clarify the starting permission set and target permission set;

[0023] The Prolog fact base, CVE ID, starting permission set, and target permission set are input into the MulVAL inference tool. The inference results are converted into a graph structure, which is then visualized as a vulnerability attack graph including vulnerability nodes, exploit nodes, permission nodes, and attack path edges.

[0024] As an optional technical solution of the present invention, the risk priority score is expressed as follows:

[0025] ;

[0026] in, Indicates the first Risk priority score for each node Indicates the first The exploitable score for vulnerabilities in each node. This indicates normalization processing. Indicates the first The business criticality vector of each node Indicates the first The impact coefficient of operator behavior at each node. Indicates the first Environmental factors at each node Represents topological weights. , , , , All of these represent weighting coefficients.

[0027] As an optional technical solution of the present invention, the dynamic events include temporary modification of firewall configuration, operator misoperation, and unexpected interruption of critical services.

[0028] As an optional technical solution of the present invention, the step of determining the most dangerous attack path and the highest-risk node based on the updated vulnerability attack graph and dynamic risk priority list includes:

[0029] In the updated dynamic risk priority list, nodes are selected sequentially from highest to lowest risk priority score, and the node sequence corresponding to the starting point is obtained by following the attack path edge of the updated vulnerability attack graph.

[0030] The sequence of nodes with the highest sum of risk priority scores across all nodes is considered the most dangerous attack path.

[0031] The node with the highest risk priority score in the most dangerous attack path is designated as the highest-risk node.

[0032] As an optional technical solution of the present invention, the step of performing a defenseless benchmark simulation on the most dangerous attack path in the digital twin model, formulating multiple defense strategies for the highest-risk nodes and simulating them separately, and comparing the simulation results of the multiple defense strategies with the simulation results of the benchmark simulation to determine the optimal defense strategy includes:

[0033] Using the updated vulnerability attack graph as the initial state of the simulation, the most dangerous attack path is injected into the behavioral model to obtain the simulation results of the benchmark simulation.

[0034] Multiple defense strategies are developed for the highest-risk nodes. For each defense strategy, the same attack on the most dangerous attack path is injected into the behavior model to obtain simulation results for multiple defense strategies. The simulation results include the stage at which the attack is blocked, the blocking time, and the final system stability.

[0035] By comparing the simulation results of the benchmark simulation with the simulation results of various defense strategies, the defense strategy that blocks the attack at the earliest stage, takes the shortest blocking time, and ultimately achieves the highest system stability is selected as the optimal defense strategy.

[0036] Secondly, a digital twin-based industrial control system vulnerability ranking and defense decision-making system is provided, including: a model building module, used to build a digital twin model based on pre-acquired target industrial control system state data;

[0037] The attack graph construction module is used to construct a vulnerability attack graph with several nodes based on a digital twin model.

[0038] The sorting module is used to calculate the risk priority score of each node in the vulnerability attack graph and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list.

[0039] The update module is used to monitor whether dynamic events occur in the target industrial control system through a digital twin model. In response to the command of a dynamic event, it updates the vulnerability attack graph and obtains an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state.

[0040] The priority determination module is used to determine the most dangerous attack path and the highest risk node based on the updated vulnerability attack graph and dynamic risk priority list.

[0041] The output module is used to perform undefended baseline simulation of the most dangerous attack path in the digital twin model, formulate multiple defense strategies for the highest risk node and simulate them separately, and compare the simulation results of multiple defense strategies with the simulation results of the baseline simulation to determine the optimal defense strategy.

[0042] Thirdly, a vulnerability ranking and defense decision-making device for industrial control systems based on digital twins is provided, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the vulnerability ranking and defense decision-making method for industrial control systems based on digital twins described in the first aspect.

[0043] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the digital twin-based industrial control system vulnerability ranking and defense decision method described in the first aspect.

[0044] Compared with the prior art, the beneficial effects of the present invention are:

[0045] This invention provides a vulnerability ranking and defense decision-making method for industrial control systems based on digital twins. By constructing a complete vulnerability attack graph, it overcomes the limitations of traditional static CVSS scoring and achieves contextualized dynamic assessment of vulnerability risks. Through the digital twin behavior model, it perceives dynamic changes in the system in real time and automatically triggers risk re-ranking, providing a dynamic response capability at the minute level. By identifying the most dangerous attack paths and the highest-risk nodes and generating a visual risk priority list, it achieves precise allocation of security resources and effectively avoids misallocation of security resources. Attached Figure Description

[0046] Figure 1 This is a flowchart of the vulnerability ranking and defense decision-making method for industrial control systems based on digital twins in an embodiment of the present invention.

[0047] Figure 2 This is a schematic diagram of the water treatment plant system architecture in an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of the vulnerability attack before the update in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the updated vulnerability attack in an embodiment of the present invention. Detailed Implementation

[0050] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0051] Example 1

[0052] This embodiment provides a method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins, such as... Figure 1 As shown, the specific steps include the following:

[0053] Step 1: Construct a digital twin model based on the pre-acquired state data of the target industrial control system.

[0054] The target industrial control system status data includes basic information data, geometric data, physical attribute data, and historical time series data.

[0055] The basic information data includes a list of critical equipment and a list of non-critical equipment.

[0056] The digital twin model includes a geometric model, a physical model, and a behavioral model.

[0057] The geometric data includes scene point cloud data of key equipment. This point cloud data is converted into a 3D model, and the 3D model is then reduced in polygon count using Blender or Unity. A unique identifier is assigned to each corresponding element in the scene to obtain the geometric model. These identifiers are used for mapping attack graph nodes and real-time data binding. Specifically, the scene point cloud data of the key equipment is obtained by scanning the key equipment and its surrounding environment using a high-precision 3D laser scanner, scanning from at least three angles, with a point cloud accuracy ≤5mm, and then stitching the data together. The scene point cloud data is then imported into SolidWorks and converted into a high-precision 3D model.

[0058] Based on physical property data, non-critical equipment models are obtained by using lookup tables or data-driven regression models. Full-order models of critical equipment are then built using multiphysics simulation software. The intrinsic orthogonal decomposition method is used to convert the full-order models into reduced-order models of the critical equipment. Finally, the reduced-order models of the critical equipment and the non-critical equipment models are connected through a physical interface to obtain a complete physical model. Physical property data includes geometric dimensions, material properties, design parameters, and performance curves. The intrinsic orthogonal decomposition method is used to extract dominant modes, projecting the high-dimensional partial differential equation system onto a low-dimensional subspace, resulting in a reduced-order model with significantly improved computational speed.

[0059] The historical time-series data is cleaned, and an autoencoder algorithm is used to train a data training model of the target industrial control system under normal conditions. The trained model is then used as a behavioral model for monitoring dynamic events. Data cleaning includes using linear interpolation to handle missing values, using the 3σ principle to remove outliers, and using Min-Max normalization.

[0060] Step 2: Construct a vulnerability attack graph including several nodes based on the digital twin model.

[0061] A structured model of the target industrial control system is performed, resulting in a Prolog fact base that includes an asset table, network connectivity relationships, and access control rules. The asset table records component models and operating systems, and clarifies the connection relationships between components.

[0062] Based on the pre-obtained CVE IDs of known vulnerabilities, the corresponding exploitability scores are determined. Specifically, specialized OT security scanning tools, such as Nessus, OpenVAS, and Claroty, are used to scan the device, identify existing configuration flaws and vulnerabilities, record their corresponding CVE IDs, and convert them to Prolog input format.

[0063] Based on key equipment, and combined with the MITRE ATT&CK for ICS framework, we analyze the attacker's attack starting point and clarify the starting permission set and target permission set.

[0064] The Prolog fact base, CVE ID, starting permission set, and target permission set are input into the MulVAL inference tool. The inference result is converted into a graph structure, which is then visualized as a vulnerability attack graph including vulnerability nodes, exploit nodes, permission nodes, and attack path edges. Within the MulVAL inference tool, based on preset logical inference rules, it analyzes how an attacker can exploit the vulnerability and what permissions they can gain. This consequence is used as a premise for attacking the next target, continuing the search for the next consequence recursively until it can no longer proceed or a critical device has been reached.

[0065] Step 3: Calculate the risk priority score for each node in the vulnerability attack graph, and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list.

[0066] The risk priority score is represented as follows:

[0067] ;

[0068] in, Indicates the first Risk priority score for each node Indicates the first The exploitable score for vulnerabilities in each node. This indicates normalization processing. Indicates the first The business criticality vector of each node Indicates the first The impact coefficient of operator behavior at each node. Indicates the first Environmental factors at each node Represents topological weights. , , , , All represent weighting coefficients. .

[0069] No. Influence coefficient of operator behavior at each node Represented as:

[0070] ;

[0071] in, , and All represent weights.

[0072] Step 4: Monitor whether dynamic events occur in the target industrial control system through a digital twin model. In response to the command of a dynamic event, update the vulnerability attack graph and obtain an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state.

[0073] The system continuously monitors real-time data streams using behavioral models. Once a dynamic event is detected, the latest system status data at the trigger time is recorded and structured. These dynamic events include temporary modifications to firewall configurations, operator errors, and unexpected interruptions of critical services.

[0074] The attack graph generator uses MulVAL again for logical reasoning to identify new attack paths activated due to new rules or attack paths that have become invalid due to configuration changes, and updates the vulnerability attack graph.

[0075] The weight coefficients of nodes are automatically adjusted based on the nature of dynamic events. The risk priority scores of all nodes in the updated vulnerability attack graph are recalculated, and the risk priority scores are sorted in descending order to obtain the updated dynamic risk priority list.

[0076] Step 5: Based on the updated vulnerability attack graph and dynamic risk priority list, determine the most dangerous attack path and the highest risk node.

[0077] In the updated dynamic risk priority list, nodes are selected sequentially from highest to lowest risk priority score, and the node sequence corresponding to the starting point is obtained by following the attack path edge of the updated vulnerability attack graph.

[0078] The sequence of nodes with the highest sum of risk priority scores across all nodes is considered the most dangerous attack path.

[0079] The node with the highest risk priority score in the most dangerous attack path is designated as the highest-risk node.

[0080] Step 6: Perform a baseline simulation without defense for the most dangerous attack path in the digital twin model, formulate multiple defense strategies for the highest-risk nodes and simulate them separately, and compare the simulation results of multiple defense strategies with the simulation results of the baseline simulation to determine the optimal defense strategy.

[0081] Using the updated vulnerability attack graph as the initial state of the simulation, attacks on the most dangerous attack paths are injected into the behavioral model to obtain the simulation results of the baseline simulation. Specifically, the physical model perceives the changes caused by the attack behavior injected by the behavioral model in real time, deduces the changes in system parameters, maps the system changes to the geometric model for visualization, and denotes the simulation result as AC0.

[0082] Multiple defense strategies are formulated for the highest-risk nodes. For each defense strategy, the same attack on the most dangerous attack path is injected into the behavioral model, resulting in simulation results for multiple defense strategies, denoted as AC1-AC. n The simulation results include the stage at which the attack is blocked, the time taken to block it, and the final system stability.

[0083] By comparing the simulation results of the benchmark simulation with the simulation results of various defense strategies, the defense strategy that blocks the attack at the earliest stage, takes the shortest blocking time, and ultimately achieves the highest system stability is selected as the optimal defense strategy.

[0084] Example 2

[0085] This embodiment provides an application scenario based on embodiment 1.

[0086] Taking a local water treatment plant system as an example, Figure 2 A schematic diagram of the water treatment plant system architecture is provided. This system architecture is a closed loop based on digital twins for vulnerability prioritization and defense decision-making, ensuring the security of water purification and urban water supply processes at the local water treatment plant. It acquires real-time operational data and network configurations of key assets such as PLC-Chlorine, PLC-Pump, SCADA Server, and EWS (Engineering Workstation) through a data acquisition layer. At the intelligent digital twin layer, the system generates attack graphs based on business criticality (BCV) such as water quality safety, and dynamically prioritizes vulnerabilities and configurations using a risk priority ranking algorithm. For example, the system can immediately identify dynamic events such as temporarily opening firewall ports in the chlorination system and instantly place the risk priority at the highest level. Finally, through What-If decision simulation functionality, managers can quickly identify and implement the optimal defense strategy to eliminate the highest risk without affecting normal water supply.

[0087] Taking a water treatment plant in a certain area as an example, Figure 3 , Figure 4 Schematic diagrams of the vulnerability attack before and after dynamic updates are provided. In this embodiment, the attack... Figure 1 There are four node types: Vulnerable nodes are represented by diamonds filled with yellow, containing the node name and [EAS score], indicating exploitable vulnerabilities or configuration flaws; Exploit nodes are represented by ellipses filled with green, containing the node name and [BIC score], indicating the conditions required for an attacker to perform an exploit; Privilege nodes are represented by rectangles filled with blue, containing the node name and [BCV score], indicating the system access permissions or control capabilities an attacker can gain after exploitation; Core assets (Targets) are represented by parallelograms filled with orange, containing the asset name and [BCV score] label, indicating the attacker's ultimate goal. This attack graph details the connections between various attack paths, descriptions of vulnerable nodes, exploit nodes, privilege nodes, and the location of core assets. Red fill indicates the highest-risk vulnerability node, and red arrows indicate the highest-risk attack path.

[0088] The risk priority lists corresponding to the vulnerability update diagrams before and after the update are shown in Table 1 and Table 2, respectively.

[0089] Table 1. List of Static Baseline Risk Priorities Based on Initial Vulnerability Attack Graph G0

[0090] NV_BlueKeep Vulnerable Nodes EWS 0.88 NU_Lateral_Move Utilizing nodes EWS→PCP 0.85 NP_EWS_Access Permission Node EWS 0.75 NV_Weak_SCADA_Pwd Vulnerable Nodes SCADA Server 0.62 NV_EternalBlue_DH Vulnerable Nodes Data Historian 0.55 Control_PCP Permission Node PLC-Pump 0.50 Control_PCC Permission Node PLC-Chlorine 0.45

[0091] Table 2. List of Dynamic Drift Risk Priorities Based on the Updated Attack Graph G1

[0092] Control_PCC Permission Node PLC-Chlorine 0.99 NU_Direct_Access Utilizing nodes PLC-Chlorine 0.95 NV_Fw_Misconfig Vulnerable Nodes PLC-Chlorine 0.93 NV_BlueKeep Vulnerable Nodes EWS 0.65 NV_Shared_HMI_Pwd Vulnerable Nodes SCADA Server 0.60 Control_PCP Permission Node PLC-Pump 0.50

[0093] Table 1 presents the static baseline risk priority list based on the initial vulnerability attack graph G0. During the system initialization phase, a static baseline risk priority list was first generated based on the results of the SCADA network scan. The initial highest-risk vulnerability was the BlueKeep vulnerability on EWS, with a risk priority score of 0.88. Although PLC-Chlorine (PCC) is the most critical business asset with a BCV of 0.6, the EWS vulnerability has an extremely high exploitability score (EAS), making it the highest-risk entry point for attackers.

[0094] Table 2 presents a dynamic drift risk priority list based on the updated attack graph G1. The system behavior model monitors dynamic events in real time, such as the temporary opening of the PLC-Chlorine remote management port, immediately driving the attack graph generator and risk priority ranking algorithm to generate a dynamic drift risk priority list. At this moment, the risk focus instantly shifts from EWS to the temporary firewall configuration error of PLC-Chlorine, causing PLC-Chlorine's risk priority score to rise to 0.99, becoming the latest highest-risk path. This path provides attackers with a direct route to the core asset with the highest business criticality (BCV) of 0.6. Defenders are then able to shift their attention to the real-time highest-risk path and take further measures to prevent the attack.

[0095] Example 3

[0096] This embodiment provides a vulnerability ranking and defense decision-making system for industrial control systems based on digital twins, including:

[0097] The model building module is used to build a digital twin model based on the pre-acquired state data of the target industrial control system.

[0098] The attack graph construction module is used to construct a vulnerability attack graph with several nodes based on a digital twin model.

[0099] The sorting module is used to calculate the risk priority score of each node in the vulnerability attack graph and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list.

[0100] The update module is used to monitor whether dynamic events occur in the target industrial control system through a digital twin model. In response to the command of a dynamic event, it updates the vulnerability attack graph and obtains an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state.

[0101] The priority determination module is used to determine the most dangerous attack path and the highest risk node based on the updated vulnerability attack graph and dynamic risk priority list.

[0102] The output module is used to perform undefended baseline simulation of the most dangerous attack path in the digital twin model, formulate multiple defense strategies for the highest risk node and simulate them separately, and compare the simulation results of multiple defense strategies with the simulation results of the baseline simulation to determine the optimal defense strategy.

[0103] Example 3

[0104] This embodiment provides a vulnerability ranking and defense decision-making device for industrial control systems based on digital twins, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to perform operations according to the instructions to execute the steps of the vulnerability ranking and defense decision-making method for industrial control systems based on digital twins described in Embodiment 1.

[0105] Example 4

[0106] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the digital twin-based industrial control system vulnerability ranking and defense decision method described in Embodiment 1.

[0107] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0108] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0109] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0110] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0111] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins, characterized in that, include: A digital twin model is constructed based on the pre-acquired state data of the target industrial control system. A vulnerability attack graph consisting of several nodes is constructed based on a digital twin model; Calculate the risk priority score for each node in the vulnerability attack graph, and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list. The system monitors whether dynamic events occur in the target industrial control system using a digital twin model. In response to the command of a dynamic event, it updates the vulnerability attack graph and obtains an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state. Based on the updated vulnerability attack graph and dynamic risk priority list, the most dangerous attack paths and the highest-risk nodes are identified. In the digital twin model, the most dangerous attack path is simulated without defense. Multiple defense strategies are formulated for the highest-risk nodes and simulated separately. The simulation results of multiple defense strategies are compared with the simulation results of the benchmark simulation to determine the optimal defense strategy.

2. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 1, characterized in that, The step of constructing a digital twin model based on pre-acquired target industrial control system status data includes: The target industrial control system status data includes basic information data, geometric data, physical attribute data, and historical time series data; The basic information data includes a list of key equipment and a list of non-key equipment. The digital twin model includes a geometric model, a physical model, and a behavioral model; The geometric data includes scene point cloud data of key equipment. The point cloud data is converted into a 3D model, the 3D model is reduced in polygons, and a unique identifier is bound to each corresponding element in the scene to obtain the geometric model. Based on physical attribute data, non-critical equipment is modeled using lookup tables or data-driven regression models to obtain non-critical equipment models, and full-order models are established for critical equipment; the intrinsic orthogonal decomposition method is used to convert the full-order models into reduced-order models of critical equipment; the reduced-order models of critical equipment and non-critical equipment models are connected through physical interfaces to obtain a complete physical model. The historical time series data is cleaned, and an autoencoder algorithm is used to train a data training model of the target industrial control system under normal conditions. The trained model is then used as a behavioral model for monitoring dynamic events.

3. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 2, characterized in that, The vulnerability attack graph constructed based on the digital twin model includes several nodes, including: The target industrial control system is structured and modeled to obtain a Prolog fact base including an asset table, network connection relationships, and access control rules. Based on the CVE IDs of known vulnerabilities obtained in advance, determine the corresponding vulnerability exploitability score; Based on key equipment, and combined with the MITRE ATT&CK for ICS framework, we analyze the attacker's attack starting point and clarify the starting permission set and target permission set; The Prolog fact base, CVE ID, starting permission set, and target permission set are input into the MulVAL inference tool. The inference results are converted into a graph structure, which is then visualized as a vulnerability attack graph including vulnerability nodes, exploit nodes, permission nodes, and attack path edges.

4. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 3, characterized in that, The risk priority score is represented as follows: ； in, Indicates the first Risk priority score for each node Indicates the first The exploitable score for vulnerabilities in each node. This indicates normalization processing. Indicates the first The business criticality vector of each node Indicates the first The impact coefficient of operator behavior at each node. Indicates the first Environmental factors at each node Represents topological weights. , , , , All of these represent weighting coefficients.

5. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 1, characterized in that, The dynamic events include temporary modifications to firewall configurations, operator errors, and unexpected interruptions to critical services.

6. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 3, characterized in that, The process of determining the most dangerous attack paths and highest-risk nodes based on the updated vulnerability attack graph and dynamic risk priority list includes: In the updated dynamic risk priority list, nodes are selected sequentially from highest to lowest risk priority score, and the node sequence corresponding to the starting point is obtained by following the attack path edge of the updated vulnerability attack graph. The sequence of nodes with the highest sum of risk priority scores across all nodes is considered the most dangerous attack path. The node with the highest risk priority score in the most dangerous attack path is designated as the highest-risk node.

7. The method for vulnerability ranking and defense decision-making in industrial control systems based on digital twins according to claim 2, characterized in that, The process involves performing a baseline simulation without defense for the most dangerous attack path in a digital twin model, developing multiple defense strategies for the highest-risk nodes and simulating them separately, and comparing the simulation results of the multiple defense strategies with the baseline simulation results to determine the optimal defense strategy. This includes: Using the updated vulnerability attack graph as the initial state of the simulation, the most dangerous attack path is injected into the behavioral model to obtain the simulation results of the benchmark simulation. Multiple defense strategies are developed for the highest-risk nodes. For each defense strategy, the same attack on the most dangerous attack path is injected into the behavior model to obtain simulation results for multiple defense strategies. The simulation results include the stage at which the attack is blocked, the blocking time, and the final system stability. By comparing the simulation results of the benchmark simulation with the simulation results of various defense strategies, the defense strategy that blocks the attack at the earliest stage, takes the shortest blocking time, and ultimately achieves the highest system stability is selected as the optimal defense strategy.

8. A vulnerability ranking and defense decision-making system for industrial control systems based on digital twins, characterized in that, include: The model building module is used to build a digital twin model based on the pre-acquired state data of the target industrial control system. The attack graph construction module is used to construct a vulnerability attack graph with several nodes based on a digital twin model. The sorting module is used to calculate the risk priority score of each node in the vulnerability attack graph and sort the nodes in descending order of risk priority score to obtain a risk priority sorting list. The update module is used to monitor whether dynamic events occur in the target industrial control system through a digital twin model. In response to the command of a dynamic event, it updates the vulnerability attack graph and obtains an updated dynamic risk priority list based on the updated vulnerability attack graph. Here, a dynamic event refers to an event in the target industrial control system that deviates from the preset normal state. The priority determination module is used to determine the most dangerous attack path and the highest risk node based on the updated vulnerability attack graph and dynamic risk priority list. The output module is used to perform undefended baseline simulation of the most dangerous attack path in the digital twin model, formulate multiple defense strategies for the highest risk node and simulate them separately, and compare the simulation results of multiple defense strategies with the simulation results of the baseline simulation to determine the optimal defense strategy.

9. A vulnerability ranking and defense decision-making device for industrial control systems based on digital twins, characterized in that, Including processor and storage media; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the digital twin-based industrial control system vulnerability ranking and defense decision method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the digital twin-based industrial control system vulnerability ranking and defense decision method as described in any one of claims 1 to 7.

Images